tree: add support for sk_rst_reason in common types

Signed-off-by: Antoine Tenart <[email protected]>

retis-events/src/events.rs

@@ -142,6 +142,9 @@ impl EventFmt for Event {
         if let Some(skb_drop) = self.0.get(&SectionId::SkbDrop) {
             write!(f, " {}", skb_drop.display(format))?;
         }
+        if let Some(rst) = self.0.get(&SectionId::SkResetReason) {
+            write!(f, " {}", rst.display(format))?;
+        }
 
         // If we have a stack trace, show it.
         if let Some(kernel) = self.get_section::<KernelEvent>(SectionId::Kernel) {
@@ -178,12 +181,14 @@ pub enum SectionId {
     Tracking = 4,
     SkbTracking = 5,
     SkbDrop = 6,
-    Skb = 7,
-    Ovs = 8,
-    Nft = 9,
-    Ct = 10,
+    SkResetReason = 7,
+    // Below this sections are handled in a generic way by the formatting logic.
+    Skb = 8,
+    Ovs = 9,
+    Nft = 10,
+    Ct = 11,
     // TODO: use std::mem::variant_count once in stable.
-    _MAX = 11,
+    _MAX = 12,
 }
 
 impl SectionId {
@@ -197,10 +202,11 @@ impl SectionId {
             4 => Tracking,
             5 => SkbTracking,
             6 => SkbDrop,
-            7 => Skb,
-            8 => Ovs,
-            9 => Nft,
-            10 => Ct,
+            7 => SkResetReason,
+            8 => Skb,
+            9 => Ovs,
+            10 => Nft,
+            11 => Ct,
             x => bail!("Can't construct a SectionId from {}", x),
         })
     }
@@ -215,6 +221,7 @@ impl SectionId {
             Tracking => "tracking",
             SkbTracking => "skb-tracking",
             SkbDrop => "skb-drop",
+            SkResetReason => "sk-reset-reason",
             Skb => "skb",
             Ovs => "ovs",
             Nft => "nft",

retis-events/src/lib.rs

@@ -25,6 +25,8 @@ pub mod nft;
 pub use nft::*;
 pub mod ovs;
 pub use ovs::*;
+pub mod sk_rst;
+pub use sk_rst::*;
 pub mod skb;
 pub use skb::*;
 pub mod skb_drop;

retis-events/src/sk_rst.rs

@@ -0,0 +1,18 @@
+use std::fmt;
+
+use super::*;
+use crate::event_section;
+
+/// Sk reset reason event section.
+#[event_section(SectionId::SkResetReason)]
+pub struct SkResetReasonEvent {
+    /// Reason why a socket sent a reset. Only reported from specific functions.
+    /// See `enum sk_rst_reason` in the kernel.
+    pub reset_reason: String,
+}
+
+impl EventFmt for SkResetReasonEvent {
+    fn event_fmt(&self, f: &mut fmt::Formatter, _: DisplayFormat) -> fmt::Result {
+        write!(f, "(rst reason {})", self.reset_reason)
+    }
+}

retis/src/core/probe/kernel/bpf/include/common_types.h

@@ -13,6 +13,7 @@ struct common_type_event {
 
 enum common_type_id {
 	SKB_DROP_REASON = 1,
+	SK_RST_REASON,
 };
 
 static __always_inline void handle_drop_reason(struct retis_context *ctx,
@@ -31,10 +32,27 @@ static __always_inline void handle_drop_reason(struct retis_context *ctx,
 	e->val = retis_get_skb_drop_reason(ctx);
 }
 
+static __always_inline void handle_rst_reason(struct retis_context *ctx,
+					      struct retis_raw_event *event)
+{
+	struct common_type_event *e;
+
+	if (!retis_arg_valid(ctx, sk_rst_reason))
+		return;
+
+	e = get_event_section(event, COMMON_TYPE, 1, sizeof(*e));
+	if (!e)
+		return;
+
+	e->type = SK_RST_REASON;
+	e->val = retis_get_sk_rst_reason(ctx);
+}
+
 static __always_inline void handle_common_types(struct retis_context *ctx,
 						struct retis_raw_event *event)
 {
 	handle_drop_reason(ctx, event);
+	handle_rst_reason(ctx, event);
 }
 
 #endif /* __CORE_PROBE_KERNEL_BPF_COMMON_TYPES__ */

retis/src/core/probe/kernel/bpf/include/retis_context.h

@@ -21,6 +21,7 @@ struct retis_probe_offsets {
 	s8 net;	 /* netns */
 	s8 nft_pktinfo;
 	s8 nft_traceinfo;
+	s8 sk_rst_reason;
 } __attribute__((packed));
 
 /* Common representation of the register values provided to the probes, as this
@@ -102,6 +103,8 @@ struct retis_context {
 	RETIS_GET(ctx, nft_pktinfo, struct nft_pktinfo *)
 #define retis_get_nft_traceinfo(ctx)	\
 	RETIS_GET(ctx, nft_traceinfo, struct nft_traceinfo *)
+#define retis_get_sk_rst_reason(ctx)	\
+	RETIS_GET(ctx, sk_rst_reason, u64)
 
 /* Returns the skb trying to get it first from the arguments (common case)
  * and if not found from the nft_pktinfo (useful for nft).

retis/src/core/probe/kernel/common_types.rs

@@ -10,6 +10,7 @@
 //! - `enum skb_drop_reason`
 //! - `enum mac80211_drop_reason`
 //! - `enum ovs_drop_reason`
+//! - `enum sk_rst_reason`
 
 use std::collections::HashMap;
 
@@ -41,13 +42,15 @@ struct RawCommonTypeEvent {
 #[derive(Eq, Hash, PartialEq)]
 enum TypeId {
     SkbDropReason = 1,
+    SkRstReason,
 }
 
 impl TypeId {
     fn from_u32(val: u32) -> Result<TypeId> {
         use TypeId::*;
         Ok(match val {
             1 => SkbDropReason,
+            2 => SkRstReason,
             x => bail!("Cannot convert {x} to TypeId"),
         })
     }
@@ -71,6 +74,12 @@ impl CommonTypeEventFactory {
         drop_reasons.extend(parse_enum("ovs_drop_reason", &[])?);
         types.insert(TypeId::SkbDropReason, drop_reasons);
 
+        // enum sk_rst_reason
+        types.insert(
+            TypeId::SkRstReason,
+            parse_enum("sk_rst_reason", &["SK_RST_REASON_"])?,
+        );
+
         Ok(Self { types })
     }
 }
@@ -111,6 +120,12 @@ impl RawEventSectionFactory for CommonTypeEventFactory {
                     },
                 })
             }
+            TypeId::SkRstReason => Box::new(SkResetReasonEvent {
+                reset_reason: match map.get(&raw.val) {
+                    Some(reason) => reason.clone(),
+                    None => raw.val.to_string(),
+                },
+            }),
         })
     }
 }

retis/src/core/probe/kernel/config.rs

@@ -15,6 +15,7 @@ pub(super) struct ProbeOffsets {
     pub(super) net: i8,
     pub(super) nft_pktinfo: i8,
     pub(super) nft_traceinfo: i8,
+    pub(super) sk_rst_reason: i8,
 }
 
 impl Default for ProbeOffsets {
@@ -27,6 +28,7 @@ impl Default for ProbeOffsets {
             net: -1,
             nft_pktinfo: -1,
             nft_traceinfo: -1,
+            sk_rst_reason: -1,
         }
     }
 }

retis/src/core/probe/kernel/inspect.rs

@@ -26,6 +26,9 @@ pub(super) fn inspect_symbol(symbol: &Symbol) -> Result<ProbeConfig> {
     if let Some(offset) = symbol.parameter_offset("struct nft_traceinfo *")? {
         cfg.offsets.nft_traceinfo = offset as i8;
     }
+    if let Some(offset) = symbol.parameter_offset("enum sk_rst_reason")? {
+        cfg.offsets.sk_rst_reason = offset as i8;
+    }
 
     Ok(cfg)
 }