trace_listen_backlog_capped.py not working out of the box on Ubuntu 18.04

[slovdahl]

Hi!

Thank you for a very interesting and insightful blog post!

I tried running the trace_listen_backlog_capped.py script on an Ubuntu 18.04 box, but I'm getting some errors that I really don't understand:

$ sudo python3 trace_listen_backlog_capped.py 
/virtual/main.c:18:47: error: cannot take the address of an rvalue of type 'struct net *'
    bpf_probe_read(&ret, sizeof(ret), (void *)&(({ typeof(struct net *const) _val; memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->sk_net.net); _val; })));
                                              ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/virtual/main.c:74:85: error: cannot take the address of an rvalue of type 'typeof(__be32)' (aka 'unsigned int')
    bpf_probe_read(&event_data.listen_addr, sizeof(event_data.listen_addr), (void *)&({ typeof(__be32) _val; memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&sk->sk_rcv_saddr); _val; }));
                                                                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/virtual/main.c:75:85: error: cannot take the address of an rvalue of type 'typeof(__be16)' (aka 'unsigned short')
    bpf_probe_read(&event_data.listen_port, sizeof(event_data.listen_port), (void *)&({ typeof(__be16) _val; memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&inet->inet_sport); _val; }));
                                                                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3 errors generated.
Traceback (most recent call last):
  File "trace_listen_backlog_capped.py", line 85, in <module>
    bpf = BPF(text=bpf_source)
  File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 301, in __init__
    raise Exception("Failed to compile BPF module %s" % src_file)
Exception: Failed to compile BPF module 

Do you have any idea what's causing these? I've manually installed all the packages that the Vagrantfile also installs.

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 18.04.3 LTS
Release:	18.04
Codename:	bionic
$ uname -a
Linux ubuntu1804 4.15.0-76-generic #86-Ubuntu SMP Fri Jan 17 17:24:28 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

[theojulienne]

👋 It looks like you have a version of bcc that's smart enough to do the bpf_probe_read implicitly - you might be able to replace:

    struct net *ret;
    // was: read_pnet(&sk->sk_net)->net
    bpf_probe_read(&ret, sizeof(ret), (void *)&(sk->sk_net.net));

With:

    struct net *ret = sk->sk_net.net;

And similar for the other calls. Hopefully that will be rewritten to the same.