New gadget: trace dns with uprobes

[alban]

New gadget: trace dns with uprobes

As an alternative to the trace dns gadget, this new gadget is using uprobe on getaddrinfo instead of socket filter.

How to use

export IG_EXPERIMENTAL=true
cd gadgets/trace_udns
sudo -E ig image build -t trace_udns --update-metadata .
sudo -E ig run trace_udns --verify-image=false

Example of output:

RUNTIME.CONTAINERNAME                     MNTNS_ID          PID                    TID           COMM             NAME                  OPERATION_STR        
mycontainer                               4026534326        2604799                2604799       wget             www.wikipedia.org.    getaddrinfo          

Testing done

Just the basic

Inspired from:

• https://github.com/libbpf/libbpf-bootstrap/blob/master/examples/rust/tracecon/src/bpf/tracecon.bpf.c
• https://www.brendangregg.com/blog/2016-02-08/linux-ebpf-bcc-uprobes.html

TODO:

• Add the IPs from the DNS answers
• Support other functions such as gethostbyname and gethostbyname2

[i-Pear]

weak suggestion: you can also use BPF_UPROBE, and the two macros are exactly the same.

[alban]

I continued my experiments in alban/trace-udns#1