Add clone and tcpconnect tracer

duetector/tracers/base.py

@@ -80,6 +80,14 @@ def _convert_data(self, data) -> NamedTuple:
             v = getattr(data, k)
             if isinstance(v, bytes):
                 v = v.decode("utf-8")
+            elif k == "saddr" or k == "daddr":
+                dq = b""
+                for i in range(0, 4):
+                    dq = dq + str(v & 0xFF).encode()
+                    if i != 3:
+                        dq = dq + b"."
+                    v = v >> 8
+                v = dq
 
             args[k] = v
 

duetector/tracers/clone.py

@@ -34,6 +34,8 @@ def poll_args(self):
     // define output data structure in C
     struct data_t {
         u32 pid;
+        u32 uid;
+        u32 gid;
         u64 timestamp;
         char comm[TASK_COMM_LEN];
     };
@@ -43,6 +45,8 @@ def poll_args(self):
         struct data_t data = {};
 
         data.pid = bpf_get_current_pid_tgid();
+        data.uid = bpf_get_current_uid_gid();
+        data.gid = bpf_get_current_uid_gid() >> 32;
         data.timestamp = bpf_ktime_get_ns();
         bpf_get_current_comm(&data.comm, sizeof(data.comm));
 
@@ -79,7 +83,7 @@ def print_callback(data: NamedTuple):
         if start == 0:
             print(f"[{data.comm} ({data.pid})] 0 ")
         else:
-            print(f"[{data.comm} ({data.pid})]  {(data.timestamp-start)/1000000000}")  # type: ignore
+            print(f"[{data.comm} ({data.pid}) {data.gid} {data.uid}]  {(data.timestamp-start)/1000000000}")  # type: ignore
         start = data.timestamp
 
     tracer.set_callback(b, print_callback)

duetector/tracers/tcpconnect.py

@@ -7,7 +7,7 @@
 
 class TcpconnectTracer(BccTracer):
     """
-    A tracer for openat2 syscall
+    A tracer for tcpconnect syscall
     """
 
     default_config = {
@@ -26,7 +26,7 @@ class TcpconnectTracer(BccTracer):
     def poll_args(self):
         return {"timeout": int(self.config.poll_timeout)}
 
-    data_t = namedtuple("TcpTracking", ["pid", "comm", "saddr", "daddr", "dport"])
+    data_t = namedtuple("TcpTracking", ["pid", "uid", "gid", "comm", "saddr", "daddr", "dport"])
 
     # define BPF program
     prog = """
@@ -43,6 +43,8 @@ def poll_args(self):
         u32 saddr;
         u32 daddr;
         u32 pid;
+        u32 uid;
+        u32 gid;
         char comm[TASK_COMM_LEN];
     };
     int do_trace(struct pt_regs *ctx, struct sock *sk)
@@ -59,6 +61,7 @@ def poll_args(self):
     {
 	    int ret = PT_REGS_RC(ctx);
 	    u32 pid = bpf_get_current_pid_tgid();
+
         struct event event= {};
 
 	    struct sock **skpp;
@@ -83,6 +86,8 @@ def poll_args(self):
         event.daddr = daddr;
         event.dport = dport;
         event.pid = pid;
+        event.uid = bpf_get_current_uid_gid();
+        event.gid = bpf_get_current_uid_gid() >> 32;
         bpf_get_current_comm(&event.comm, sizeof(event.comm));
 	    // output
 	    buffer.ringbuf_output(&event, sizeof(event), 0);
@@ -114,17 +119,8 @@ def init_tracer(config):
     tracer = TcpconnectTracer()
     tracer.attach(b)
 
-    def inet_ntoa(addr):
-        dq = b""
-        for i in range(0, 4):
-            dq = dq + str(addr & 0xFF).encode()
-            if i != 3:
-                dq = dq + b"."
-            addr = addr >> 8
-        return dq
-
     def print_callback(data: NamedTuple):
-        print(f"[{data.comm} ({data.pid})] TCP_CONNECT SADDR:{inet_ntoa(data.saddr)} DADDR: {inet_ntoa(data.daddr)} DPORT:{data.dport}")  # type: ignore
+        print(f"[{data.comm} ({data.pid}) {data.uid} {data.gid}] TCP_CONNECT SADDR:{data.saddr} DADDR: {data.daddr} DPORT:{data.dport}")  # type: ignore
 
     tracer.set_callback(b, print_callback)
     poller = tracer.get_poller(b)