Close tutorial documentation and qdisc gates

Author: Littlefisher619

README.md

@@ -89,7 +89,7 @@ Tracing:
 - [lesson 39-nginx](src/39-nginx/README.md) Using eBPF to Trace Nginx Requests
 - [lesson 40-mysql](src/40-mysql/README.md) Using eBPF to Trace MySQL Queries
 - [lesson 48-energy](src/48-energy/README.md) Energy Monitoring for Process-Level Power Analysis
-- [lesson 52-fsession-latency](src/52-fsession-latency/README.md) Tracing Slow vfs_read Calls with fsession
+- [lesson 52-fsession-latency](src/52-fsession-latency/README.md) Trace Slow `vfs_read` Calls with fsession
 
 
 Security:
@@ -100,8 +100,8 @@ Security:
 - [lesson 27-replace](src/27-replace/README.md) Transparent Text Replacement in File Reads
 - [lesson 28-detach](src/28-detach/README.md) Running eBPF After Application Exits: The Lifecycle of eBPF Programs
 - [lesson 34-syscall](src/34-syscall/README.md) Modifying System Call Arguments with eBPF
-- [lesson 51-tcp-quarantine](src/51-tcp-quarantine/README.md) Precisely Isolating Established TCP Connections
-- [lesson 54-exec-image-inspector](src/54-exec-image-inspector/README.md) Inspecting the Executable Image After exec
+- [lesson 51-tcp-quarantine](src/51-tcp-quarantine/README.md) Destroy One Established TCP Connection Safely
+- [lesson 54-exec-image-inspector](src/54-exec-image-inspector/README.md) Continuously Inspect Executable Images After exec
 
 
 Features:

README.zh.md

@@ -88,7 +88,7 @@ GPU:
 - [lesson 39-nginx](src/39-nginx/README.zh.md) 使用 eBPF 跟踪 Nginx 请求
 - [lesson 40-mysql](src/40-mysql/README.zh.md) 使用 eBPF 跟踪 MySQL 查询
 - [lesson 48-energy](src/48-energy/README.zh.md) eBPF 教程：进程级能源监控与功耗分析
-- [lesson 52-fsession-latency](src/52-fsession-latency/README.zh.md) eBPF 教程：使用 fsession 追踪慢速 vfs_read 调用
+- [lesson 52-fsession-latency](src/52-fsession-latency/README.zh.md) eBPF 教程第五十二篇：使用 fsession 追踪慢速 `vfs_read`
 
 
 安全:
@@ -99,8 +99,8 @@ GPU:
 - [lesson 27-replace](src/27-replace/README.zh.md) 替换任意程序读取或者写入的文本
 - [lesson 28-detach](src/28-detach/README.zh.md) 在应用程序退出后运行 eBPF 程序：eBPF 程序的生命周期
 - [lesson 34-syscall](src/34-syscall/README.zh.md) eBPF 开发实践：使用 eBPF 修改系统调用参数
-- [lesson 51-tcp-quarantine](src/51-tcp-quarantine/README.zh.md) eBPF 教程：精准隔离已建立的 TCP 连接
-- [lesson 54-exec-image-inspector](src/54-exec-image-inspector/README.zh.md) eBPF 教程：检查 exec 后实际安装的可执行镜像
+- [lesson 51-tcp-quarantine](src/51-tcp-quarantine/README.zh.md) eBPF 教程第五十一篇：安全销毁一条已建立的 TCP 连接
+- [lesson 54-exec-image-inspector](src/54-exec-image-inspector/README.zh.md) eBPF 教程第五十四篇：持续检查 exec 后的可执行镜像
 
 
 特性:

src/51-tcp-quarantine/README.md

@@ -139,6 +139,8 @@ cd bpf-developer-tutorial/src/51-tcp-quarantine
 make
 ```
 
+Add `--verbose` only when you need libbpf loader diagnostics; it does not change socket selection.
+
 First list the clients connected to the remote endpoint:
 
 ```console

src/51-tcp-quarantine/README.zh.md

@@ -139,6 +139,8 @@ cd bpf-developer-tutorial/src/51-tcp-quarantine
 make
 ```
 
+只有需要查看 libbpf 加载诊断时才加 `--verbose`；它不会改变 socket 选择范围。
+
 首先列出连接到目标远端的客户端：
 
 ```console

src/53-egress-pacer/README.md

@@ -384,6 +384,7 @@ The `SEC(".struct_ops")` block at the end registers the callbacks as a `Qdisc_op
 #include <linux/pkt_sched.h>
 #include <net/if.h>
 #include <signal.h>
+#include <spawn.h>
 #include <stdbool.h>
 #include <stdint.h>
 #include <stdio.h>
@@ -396,6 +397,8 @@ The `SEC(".struct_ops")` block at the end registers the callbacks as a `Qdisc_op
 #include "egress_pacer.h"
 #include "egress_pacer.skel.h"
 
+extern char **environ;
+
 static volatile sig_atomic_t exiting;
 
 static struct env {
@@ -576,38 +579,137 @@ static int wait_for_duration(void)
 	return 0;
 }
 
+static const char *find_tc_binary(void)
+{
+	static const char *const candidates[] = {
+		"/usr/sbin/tc",
+		"/sbin/tc",
+	};
+	size_t index;
+
+	for (index = 0; index < sizeof(candidates) / sizeof(candidates[0]); index++) {
+		if (!access(candidates[index], X_OK))
+			return candidates[index];
+	}
+	return NULL;
+}
+
 static void print_current_qdisc(void)
 {
+	const char *tc_binary = find_tc_binary();
+	char *const arguments[] = {
+		(char *)"tc", (char *)"qdisc", (char *)"show", (char *)"dev",
+		(char *)env.interface, NULL,
+	};
+	posix_spawn_file_actions_t actions;
 	pid_t child;
 	pid_t waited;
+	int error;
 	int status;
 
 	fprintf(stderr, "current qdisc state:\n");
-	child = fork();
-	if (child < 0) {
-		fprintf(stderr, "failed to run tc: %s\n", strerror(errno));
-		return;
-	}
-	if (child == 0) {
-		if (dup2(STDERR_FILENO, STDOUT_FILENO) < 0)
-			_exit(127);
-		execlp("tc", "tc", "qdisc", "show", "dev", env.interface,
-		       (char *)NULL);
-		_exit(127);
+	if (!tc_binary) {
+		fprintf(stderr, "tc was not found in /usr/sbin or /sbin\n");
+		goto manual;
 	}
 
+	error = posix_spawn_file_actions_init(&actions);
+	if (error)
+		goto spawn_failed;
+	error = posix_spawn_file_actions_adddup2(&actions, STDERR_FILENO,
+						  STDOUT_FILENO);
+	if (!error)
+		error = posix_spawn(&child, tc_binary, &actions, NULL, arguments,
+				    environ);
+	posix_spawn_file_actions_destroy(&actions);
+	if (error)
+		goto spawn_failed;
+
 	do {
 		waited = waitpid(child, &status, 0);
 	} while (waited < 0 && errno == EINTR);
-	if (waited < 0 || !WIFEXITED(status) || WEXITSTATUS(status))
-		fprintf(stderr, "run manually: tc qdisc show dev %s\n",
+	if (waited >= 0 && WIFEXITED(status) && !WEXITSTATUS(status))
+		return;
+	if (waited < 0)
+		error = errno;
+	else
+		error = EIO;
+
+spawn_failed:
+	fprintf(stderr, "failed to run tc: %s\n", strerror(error));
+manual:
+	fprintf(stderr, "run manually: tc qdisc show dev %s\n", env.interface);
+}
+
+static int install_pacer(struct egress_pacer_bpf *skel,
+			 struct bpf_tc_hook *hook)
+{
+	int error;
+
+	error = egress_pacer_bpf__attach(skel);
+	if (error) {
+		if (error == -EEXIST) {
+			fprintf(stderr,
+				"bpf_pacer is already registered; a stale root qdisc may own it\n");
+			print_current_qdisc();
+			fprintf(stderr,
+				"if it is stale, recover with: sudo tc qdisc del dev %s root\n",
+				env.interface);
+		} else {
+			fprintf(stderr, "failed to register bpf_pacer qdisc: %s\n",
+				strerror(-error));
+		}
+		return error;
+	}
+
+	error = bpf_tc_hook_create(hook);
+	if (!error)
+		return 0;
+	if (error == -EEXIST) {
+		fprintf(stderr, "refusing to replace the existing root qdisc on %s\n",
 			env.interface);
+		print_current_qdisc();
+		fprintf(stderr,
+			"if it is stale, recover with: sudo tc qdisc del dev %s root\n",
+			env.interface);
+	} else {
+		fprintf(stderr, "failed to attach bpf_pacer to %s: %s\n",
+			env.interface, strerror(-error));
+	}
+	return error;
+}
+
+static int cleanup_pacer(struct egress_pacer_bpf *skel,
+			 struct bpf_tc_hook *hook, bool qdisc_created, int error)
+{
+	struct pacer_stats final_stats = {};
+	int cleanup_error;
+
+	if (qdisc_created) {
+		cleanup_error = bpf_tc_hook_destroy(hook);
+		if (cleanup_error) {
+			fprintf(stderr, "failed to remove bpf_pacer from %s: %s\n",
+				env.interface, strerror(-cleanup_error));
+			if (!error)
+				error = cleanup_error;
+		}
+	}
+	if (skel && skel->bss)
+		final_stats = skel->bss->stats;
+	if (qdisc_created) {
+		printf("SUMMARY enqueued=%llu dequeued=%llu policy_dropped=%llu "
+		       "cleanup_dropped=%llu bytes_dequeued=%llu max_qlen=%llu\n",
+		       final_stats.enqueued, final_stats.dequeued,
+		       final_stats.policy_dropped, final_stats.cleanup_dropped,
+		       final_stats.bytes_dequeued, final_stats.max_qlen);
+	}
+	egress_pacer_bpf__destroy(skel);
+	return error != 0;
 }
 
 int main(int argc, char **argv)
 {
 	struct egress_pacer_bpf *skel = NULL;
-	struct pacer_stats final_stats = {};
 	struct bpf_tc_hook hook = {
 		.sz = sizeof(hook),
 		.attach_point = BPF_TC_QDISC,
@@ -617,7 +719,6 @@ int main(int argc, char **argv)
 	};
 	bool qdisc_created = false;
 	unsigned int ifindex;
-	int cleanup_err;
 	int err;
 
 	err = parse_args(argc, argv);
@@ -655,38 +756,9 @@ int main(int argc, char **argv)
 		goto cleanup;
 	}
 
-	err = egress_pacer_bpf__attach(skel);
-	if (err) {
-		if (err == -EEXIST) {
-			fprintf(stderr,
-				"bpf_pacer is already registered; a stale root qdisc may own it\n");
-			print_current_qdisc();
-			fprintf(stderr,
-				"if it is stale, recover with: sudo tc qdisc del dev %s root\n",
-				env.interface);
-		} else {
-			fprintf(stderr, "failed to register bpf_pacer qdisc: %s\n",
-				strerror(-err));
-		}
-		goto cleanup;
-	}
-
-	err = bpf_tc_hook_create(&hook);
-	if (err) {
-		if (err == -EEXIST) {
-			fprintf(stderr,
-				"refusing to replace the existing root qdisc on %s\n",
-				env.interface);
-			print_current_qdisc();
-			fprintf(stderr,
-				"if it is stale, recover with: sudo tc qdisc del dev %s root\n",
-				env.interface);
-		} else {
-			fprintf(stderr, "failed to attach bpf_pacer to %s: %s\n",
-				env.interface, strerror(-err));
-		}
+	err = install_pacer(skel, &hook);
+	if (err)
 		goto cleanup;
-	}
 	qdisc_created = true;
 
 	printf("READY interface=%s rate_kbps=%llu queue_limit=%u duration=%u\n",
@@ -696,26 +768,7 @@ int main(int argc, char **argv)
 	err = wait_for_duration();
 
 cleanup:
-	if (qdisc_created) {
-		cleanup_err = bpf_tc_hook_destroy(&hook);
-		if (cleanup_err) {
-			fprintf(stderr, "failed to remove bpf_pacer from %s: %s\n",
-				env.interface, strerror(-cleanup_err));
-			if (!err)
-				err = cleanup_err;
-		}
-	}
-	if (skel && skel->bss)
-		final_stats = skel->bss->stats;
-	if (qdisc_created) {
-		printf("SUMMARY enqueued=%llu dequeued=%llu policy_dropped=%llu "
-		       "cleanup_dropped=%llu bytes_dequeued=%llu max_qlen=%llu\n",
-		       final_stats.enqueued, final_stats.dequeued,
-		       final_stats.policy_dropped, final_stats.cleanup_dropped,
-		       final_stats.bytes_dequeued, final_stats.max_qlen);
-	}
-	egress_pacer_bpf__destroy(skel);
-	return err != 0;
+	return cleanup_pacer(skel, &hook, qdisc_created, err);
 }
 ```