1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
#!/usr/sbin/dtrace -s
/*
* This file and its contents are supplied under the terms of the
* Common Development and Distribution License ("CDDL"), version 1.0.
* You may only use this file in accordance with the terms of version
* 1.0 of the CDDL.
*
* A full copy of the text of the CDDL should have accompanied this
* source. A copy of the CDDL is also available via the Internet at
* http://www.illumos.org/license/CDDL.
*/
/*
* Copyright 2018 Nexenta Systems, Inc. All rights reserved.
*/
/*
* User-level dtrace for smbd
* Usage: dtrace -s smbd-pipesvc.d -p `pgrep smbd`
*/
#pragma D option flowindent
self int trace;
self int mask;
/*
* The pipesvc_worker() function is a good place to start tracing
* to watch RPC service actions. This worker handles all activity
* for a given named pipe instance, including the payload from all
* SMB read/write requests on this endpoint.
*/
pid$target:*smbd:pipesvc_worker:entry
{
self->trace++;
}
/*
* If traced and not masked, print entry/return
*/
pid$target:*smbd::entry,
pid$target:libmlsvc.so.1::entry,
pid$target:libmlrpc.so.2::entry,
pid$target:libsmbns.so.1::entry,
pid$target:libsmb.so.1::entry
/self->trace > 0 && self->mask == 0/
{
printf("\t0x%x", arg0);
printf("\t0x%x", arg1);
printf("\t0x%x", arg2);
printf("\t0x%x", arg3);
printf("\t0x%x", arg4);
printf("\t0x%x", arg5);
}
/*
* Mask (don't print) all function calls below these functions.
* These make many boring, repetitive function calls like
* smb_mbtowc, smb_msgbuf_has_space, ...
*
* Also, libmlrpc has rather deep call stacks, particularly under
* ndr_encode_decode_common(), so this stops traces below there.
* Remove that from the mask actions to see the details.
*/
pid$target::ht_findfirst:entry,
pid$target::ht_findnext:entry,
pid$target::ndr_encode_decode_common:entry,
pid$target::smb_msgbuf_decode:entry,
pid$target::smb_msgbuf_encode:entry,
pid$target::smb_strlwr:entry,
pid$target::smb_strupr:entry,
pid$target::smb_wcequiv_strlen:entry
{
self->mask++;
}
/*
* Now inverses of above, unwind order.
*/
pid$target::ht_findfirst:return,
pid$target::ht_findnext:return,
pid$target::ndr_encode_decode_common:return,
pid$target::smb_msgbuf_decode:return,
pid$target::smb_msgbuf_encode:return,
pid$target::smb_strlwr:return,
pid$target::smb_strupr:return,
pid$target::smb_wcequiv_strlen:return
{
self->mask--;
}
pid$target:*smbd::return,
pid$target:libmlsvc.so.1::return,
pid$target:libmlrpc.so.2::return,
pid$target:libsmbns.so.1::return,
pid$target:libsmb.so.1::return
/self->trace > 0 && self->mask == 0/
{
printf("\t0x%x", arg1);
}
/*
* This function in libmlrpc prints out lots of internal state.
* Comment it out if you don't want that noise.
*/
pid$target:libmlrpc.so.2:ndo_trace:entry
/self->trace > 0 && self->mask == 0/
{
printf("ndo_trace: %s", copyinstr(arg0));
}
pid$target:*smbd:pipesvc_worker:return
{
self->trace--;
}
|
