Collect and output skb->cb when --filter-trace-tc

According to kernel verifier implementation[1], __sk_buff->cb[0:5] will be
mapped to sk_buff->cb[8:28]. We'll collect sk_buff->cb[8:28] in bpf then
cast u8[20] to u32[5] in userspace for output.

[1] https://elixir.bootlin.com/linux/v6.8/source/net/core/filter.c#L9593

Signed-off-by: gray <gray.liang@isovalent.com>

bpf/kprobe_pwru.c

@@ -88,6 +88,7 @@ struct event_t {
 	u64 param_second;
 	u64 param_third;
 	u32 cpu_id;
+	u8 cb[20];
 } __attribute__((packed));
 
 #define MAX_QUEUE_ENTRIES 10000
@@ -143,7 +144,8 @@ struct config {
 	u8 output_shinfo: 1;
 	u8 output_stack: 1;
 	u8 output_caller: 1;
-	u8 output_unused: 2;
+	u8 output_cb: 1;
+	u8 output_unused: 1;
 	u8 is_set: 1;
 	u8 track_skb: 1;
 	u8 track_skb_by_stackid: 1;
@@ -443,6 +445,10 @@ set_output(void *ctx, struct sk_buff *skb, struct event_t *event) {
 	if (cfg->output_stack) {
 		event->print_stack_id = bpf_get_stackid(ctx, &print_stack_map, BPF_F_FAST_STACK_CMP);
 	}
+
+	if (cfg->output_cb) {
+		bpf_probe_read_kernel(&event->cb, sizeof(event->cb), (void *)&skb->cb[8]);
+	}
 }
 
 static __noinline bool

internal/pwru/config.go

@@ -22,6 +22,7 @@ const (
 	OutputShinfoMask
 	OutputStackMask
 	OutputCallerMask
+	OutputCbMask
 )
 
 const (
@@ -69,6 +70,9 @@ func GetConfig(flags *Flags) (cfg FilterCfg, err error) {
 	if flags.OutputCaller {
 		cfg.OutputFlags |= OutputCallerMask
 	}
+	if flags.FilterTraceTc {
+		cfg.OutputFlags |= OutputCbMask
+	}
 	if flags.FilterTrackSkb {
 		cfg.FilterFlags |= TrackSkbMask
 	}

internal/pwru/output.go

@@ -5,6 +5,7 @@
 package pwru
 
 import (
+	"encoding/binary"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -142,6 +143,9 @@ func (o *output) PrintHeader() {
 	if o.flags.OutputMeta {
 		fmt.Fprintf(o.writer, " %-10s %-8s %16s %-6s %-5s %-5s", "NETNS", "MARK/x", centerAlignString("IFACE", 16), "PROTO", "MTU", "LEN")
 	}
+	if o.flags.FilterTraceTc {
+		fmt.Fprintf(o.writer, " %-56s", "__sk_buff->cb[]")
+	}
 	if o.flags.OutputTuple {
 		fmt.Fprintf(o.writer, " %s", "TUPLE")
 	}
@@ -330,6 +334,20 @@ func getMetaData(event *Event, o *output) (metaData string) {
 	return metaData
 }
 
+func getCb(event *Event) (cb string) {
+	var bpfCb [5]uint32
+
+	for i := 0; i < 5; i++ {
+		bpfCb[i] = binary.BigEndian.Uint32(event.Cb[i*4 : (i+1)*4])
+	}
+
+	res := []string{}
+	for _, val := range bpfCb {
+		res = append(res, fmt.Sprintf("0x%08X", val))
+	}
+	return fmt.Sprintf("[%s]", strings.Join(res, ","))
+}
+
 func getOutFuncName(o *output, event *Event, addr uint64) string {
 	var funcName string
 
@@ -412,6 +430,10 @@ func (o *output) Print(event *Event) {
 		fmt.Fprintf(o.writer, " %s", getMetaData(event, o))
 	}
 
+	if o.flags.FilterTraceTc {
+		fmt.Fprintf(o.writer, " %s", getCb(event))
+	}
+
 	if o.flags.OutputTuple {
 		fprintWithPadding(o.writer, getTupleData(event), &maxTupleLengthSeen)
 	}

internal/pwru/types.go

@@ -152,4 +152,5 @@ type Event struct {
 	ParamSecond   uint64
 	ParamThird    uint64
 	CPU           uint32
+	Cb            [20]uint8
 }