Skip to content

Commit

Permalink
refactor(skel): pass ctx around
Browse files Browse the repository at this point in the history
  • Loading branch information
@hparzych
hparzych committed Oct 31, 2023
1 parent c5167b4 commit a399576
Show file tree
Hide file tree
Showing 3 changed files with 50 additions and 41 deletions.
8 changes: 5 additions & 3 deletions libebpfdiscoveryskel/src/GlobalData.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,10 @@ __attribute__((always_inline)) inline static struct DiscoveryGlobalState* getGlo
return (struct DiscoveryGlobalState*)bpf_map_lookup_elem(&globalStateMap, &zero);
}

__attribute__((always_inline)) inline static void disableDiscoveryCollecting(struct DiscoveryGlobalState* discoveryGlobalStatePtr) {
__attribute__((always_inline)) inline static void disableDiscoveryCollecting(
struct pt_regs* ctx, struct DiscoveryGlobalState* discoveryGlobalStatePtr) {
DEBUG_PRINTLN("Discovery disabled.");
LOG_DEBUG(ctx, )
discoveryGlobalStatePtr->isCollectingDisabled = true;
}

Expand Down Expand Up @@ -69,11 +71,11 @@ struct {
} eventsToUserspaceQueueMap SEC(".maps");

__attribute__((always_inline)) inline static int pushEventToUserspace(
struct DiscoveryGlobalState* globalStatePtr, struct DiscoveryEvent* eventPtr) {
struct pt_regs* ctx, struct DiscoveryGlobalState* globalStatePtr, struct DiscoveryEvent* eventPtr) {
int result = bpf_map_push_elem(&eventsToUserspaceQueueMap, eventPtr, BPF_ANY);
if (result != 0) {
DEBUG_PRINTLN("Couldn't push a shared event. (pid: `%d`, fd: `%d`)", eventPtr->dataKey.pid, eventPtr->dataKey.fd);
disableDiscoveryCollecting(globalStatePtr);
disableDiscoveryCollecting(ctx, globalStatePtr);
return result;
}

Expand Down
35 changes: 21 additions & 14 deletions libebpfdiscoveryskel/src/Handlers.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@
#include <bpf/bpf_tracing.h>

__attribute__((always_inline)) inline static void handleAcceptIPv4Session(
const struct DiscoveryTrackedSessionKey trackedSessionKey, const struct AcceptArgs* acceptArgsPtr, int addrlen) {
struct pt_regs* ctx,
const struct DiscoveryTrackedSessionKey trackedSessionKey,
const struct AcceptArgs* acceptArgsPtr,
int addrlen) {
if (acceptArgsPtr->addrSize < sizeof(struct sockaddr_in) || addrlen != sizeof(struct sockaddr_in)) {
return;
}
Expand All @@ -35,7 +38,10 @@ __attribute__((always_inline)) inline static void handleAcceptIPv4Session(
}

__attribute__((always_inline)) inline static void handleAcceptIPv6Session(
const struct DiscoveryTrackedSessionKey trackedSessionKey, const struct AcceptArgs* acceptArgsPtr, int addrlen) {
struct pt_regs* ctx,
const struct DiscoveryTrackedSessionKey trackedSessionKey,
const struct AcceptArgs* acceptArgsPtr,
int addrlen) {
if (acceptArgsPtr->addrSize < sizeof(struct sockaddr_in6) || addrlen != sizeof(struct sockaddr_in6)) {
return;
}
Expand All @@ -51,7 +57,7 @@ __attribute__((always_inline)) inline static void handleAcceptIPv6Session(
bpf_map_update_elem(&trackedSessionsMap, &trackedSessionKey, &session, BPF_ANY);
}

__attribute__((always_inline)) inline static void handleAccept(struct AcceptArgs* acceptArgsPtr, int fd) {
__attribute__((always_inline)) inline static void handleAccept(struct pt_regs* ctx, struct AcceptArgs* acceptArgsPtr, int fd) {
// Size of returned sockaddr struct
int addrlen = 0;
bpf_probe_read(&addrlen, sizeof(addrlen), (acceptArgsPtr->addrlen));
Expand All @@ -72,16 +78,16 @@ __attribute__((always_inline)) inline static void handleAccept(struct AcceptArgs

switch (saFamily) {
case AF_INET:
handleAcceptIPv4Session(trackedSessionKey, acceptArgsPtr, addrlen);
handleAcceptIPv4Session(ctx, trackedSessionKey, acceptArgsPtr, addrlen);
break;
case AF_INET6:
handleAcceptIPv6Session(trackedSessionKey, acceptArgsPtr, addrlen);
handleAcceptIPv6Session(ctx, trackedSessionKey, acceptArgsPtr, addrlen);
break;
}
}

__attribute__((always_inline)) inline static int sessionFillIPv4(
struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) {
struct pt_regs* ctx, struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) {
struct sockaddr_in* sockipPtr = (struct sockaddr_in*)bpf_map_lookup_elem(&trackedSessionSockIPv4Map, sessionKeyPtr);
if (sockipPtr == NULL) {
DEBUG_PRINTLN("No IPv4 of tracked session. (id: %d)", sessionPtr->id);
Expand All @@ -94,7 +100,7 @@ __attribute__((always_inline)) inline static int sessionFillIPv4(
}

__attribute__((always_inline)) inline static int sessionFillIPv6(
struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) {
struct pt_regs* ctx, struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) {
struct sockaddr_in6* sockipPtr = (struct sockaddr_in6*)bpf_map_lookup_elem(&trackedSessionSockIPv6Map, sessionKeyPtr);
if (sockipPtr == NULL) {
DEBUG_PRINTLN("No IPv6 of tracked session. (id: %d)", sessionPtr->id);
Expand All @@ -107,17 +113,18 @@ __attribute__((always_inline)) inline static int sessionFillIPv6(
}

__attribute__((always_inline)) inline static int sessionFillIP(
struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) {
struct pt_regs* ctx, struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) {
if (discoverySessionFlagsIsIPv4(sessionPtr->meta.flags)) {
return sessionFillIPv4(sessionKeyPtr, sessionPtr);
return sessionFillIPv4(ctx, sessionKeyPtr, sessionPtr);
} else if (discoverySessionFlagsIsIPv6(sessionPtr->meta.flags)) {
return sessionFillIPv6(sessionKeyPtr, sessionPtr);
return sessionFillIPv6(ctx, sessionKeyPtr, sessionPtr);
}

return -1;
}

__attribute__((always_inline)) inline static void handleRead(
struct pt_regs* ctx,
struct DiscoveryGlobalState* globalStatePtr,
struct DiscoveryAllSessionState* allSessionStatePtr,
struct ReadArgs* readArgsPtr,
Expand Down Expand Up @@ -153,7 +160,7 @@ __attribute__((always_inline)) inline static void handleRead(
sessionPtr->id = allSessionStatePtr->sessionCounter;
sessionPtr->meta.pid = event.dataKey.pid;
allSessionStatePtr->sessionCounter++;
sessionFillIP((struct DiscoveryTrackedSessionKey*)&event.dataKey, sessionPtr);
sessionFillIP(ctx, (struct DiscoveryTrackedSessionKey*)&event.dataKey, sessionPtr);
} else {
event.dataKey.bufferSeq = sessionPtr->bufferCount;
}
Expand All @@ -177,7 +184,7 @@ __attribute__((always_inline)) inline static void handleRead(
bpf_map_update_elem(&savedBuffersMap, &event.dataKey, savedBufferPtr, BPF_ANY);
}

pushEventToUserspace(globalStatePtr, &event);
pushEventToUserspace(ctx, globalStatePtr, &event);

if (discoveryEventFlagsIsNoMoreData(event.flags)) {
deleteTrackedSession((struct DiscoveryTrackedSessionKey*)&event.dataKey, sessionPtr);
Expand All @@ -188,7 +195,7 @@ __attribute__((always_inline)) inline static void handleRead(
}

__attribute__((always_inline)) inline static void handleClose(
struct DiscoveryGlobalState* globalStatePtr, struct DiscoveryAllSessionState* allSessionStatePtr, int fd) {
struct pt_regs* ctx, struct DiscoveryGlobalState* globalStatePtr, struct DiscoveryAllSessionState* allSessionStatePtr, int fd) {
struct DiscoveryTrackedSessionKey trackedSessionKey = {};
trackedSessionKey.pid = pidTgidToPid(bpf_get_current_pid_tgid());

Expand All @@ -203,5 +210,5 @@ __attribute__((always_inline)) inline static void handleClose(
deleteTrackedSession(&trackedSessionKey, sessionPtr);

struct DiscoveryEvent event = {.flags = DISCOVERY_EVENT_FLAGS_CLOSE};
pushEventToUserspace(globalStatePtr, &event);
pushEventToUserspace(ctx, globalStatePtr, &event);
}
48 changes: 24 additions & 24 deletions libebpfdiscoveryskel/src/SyscallProbes.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ struct {
* Syscall handlers
*/

__attribute__((always_inline)) inline static int handleSysAcceptEntry(struct sockaddr* addr, socklen_t* addrlen) {
__attribute__((always_inline)) inline static int handleSysAcceptEntry(struct pt_regs* ctx, struct sockaddr* addr, socklen_t* addrlen) {
if (addr == NULL || addrlen == NULL) {
// We expect that for TCP/IP connections the addr argument is not null.
return 0;
Expand Down Expand Up @@ -69,7 +69,7 @@ __attribute__((always_inline)) inline static int handleSysAcceptEntry(struct soc
return 0;
}

__attribute__((always_inline)) inline static int handleSysAcceptExit(int fd) {
__attribute__((always_inline)) inline static int handleSysAcceptExit(struct pt_regs* ctx, int fd) {
struct DiscoveryGlobalState* globalStatePtr = getGlobalState();
if (globalStatePtr == NULL || globalStatePtr->isCollectingDisabled) {
return 0;
Expand All @@ -93,13 +93,13 @@ __attribute__((always_inline)) inline static int handleSysAcceptExit(int fd) {
return 0;
}

handleAccept(acceptArgsPtr, fd);
handleAccept(ctx, acceptArgsPtr, fd);

bpf_map_delete_elem(&runningAcceptArgsMap, &pidTgid);
return 0;
}

__attribute__((always_inline)) inline static int handleSysReadEntry(int fd, char* buf) {
__attribute__((always_inline)) inline static int handleSysReadEntry(struct pt_regs* ctx, int fd, char* buf) {
if (buf == NULL) {
return 0;
}
Expand Down Expand Up @@ -134,7 +134,7 @@ __attribute__((always_inline)) inline static int handleSysReadEntry(int fd, char
return 0;
}

__attribute__((always_inline)) inline static int handleSysReadExit(ssize_t bytesCount) {
__attribute__((always_inline)) inline static int handleSysReadExit(struct pt_regs* ctx, ssize_t bytesCount) {
struct DiscoveryGlobalState* globalStatePtr = getGlobalState();
if (globalStatePtr == NULL || globalStatePtr->isCollectingDisabled) {
return 0;
Expand All @@ -153,13 +153,13 @@ __attribute__((always_inline)) inline static int handleSysReadExit(ssize_t bytes
return 0;
}

handleRead(globalStatePtr, allSessionStatePtr, readArgsPtr, bytesCount);
handleRead(ctx, globalStatePtr, allSessionStatePtr, readArgsPtr, bytesCount);
bpf_map_delete_elem(&runningReadArgsMap, &pidTgid);

return 0;
}

__attribute__((always_inline)) inline static int handleSysCloseEntry(int fd) {
__attribute__((always_inline)) inline static int handleSysCloseEntry(struct pt_regs* ctx, int fd) {
struct DiscoveryGlobalState* globalStatePtr = getGlobalState();
if (globalStatePtr == NULL || globalStatePtr->isCollectingDisabled) {
return 0;
Expand All @@ -170,27 +170,27 @@ __attribute__((always_inline)) inline static int handleSysCloseEntry(int fd) {
return 0;
};

handleClose(globalStatePtr, allSessionStatePtr, fd);
handleClose(ctx, globalStatePtr, allSessionStatePtr, fd);
return 0;
}

__attribute__((always_inline)) inline static int handleSysRecvEntry(int fd, char* buf, int flags) {
__attribute__((always_inline)) inline static int handleSysRecvEntry(struct pt_regs* ctx, int fd, char* buf, int flags) {
if (flags & MSG_PEEK) {
return 0;
}

if (flags & MSG_TRUNC || flags & MSG_OOB) {
// We drop handling the session when these flags are used
handleSysCloseEntry(fd);
handleSysCloseEntry(ctx, fd);
return 0;
}

handleSysReadEntry(fd, buf);
handleSysReadEntry(ctx, fd, buf);
return 0;
}

__attribute__((always_inline)) inline static int handleSysRecvExit(ssize_t bytesCount) {
return handleSysReadExit(bytesCount);
__attribute__((always_inline)) inline static int handleSysRecvExit(struct pt_regs* ctx, ssize_t bytesCount) {
return handleSysReadExit(ctx, bytesCount);
}

/*
Expand All @@ -199,55 +199,55 @@ __attribute__((always_inline)) inline static int handleSysRecvExit(ssize_t bytes

SEC("kprobe/" SYS_PREFIX "sys_accept")
int BPF_KPROBE_SYSCALL(kprobeSysAccept, int sockfd, struct sockaddr* addr, socklen_t* addrlen) {
return handleSysAcceptEntry(addr, addrlen);
return handleSysAcceptEntry(ctx, addr, addrlen);
}

SEC("kretprobe/" SYS_PREFIX "sys_accept")
int BPF_KRETPROBE(kretprobeSysAccept, int fd) {
return handleSysAcceptExit(fd);
return handleSysAcceptExit(ctx, fd);
}

SEC("kprobe/" SYS_PREFIX "sys_accept4")
int BPF_KPROBE_SYSCALL(kprobeSysAccept4, int sockfd, struct sockaddr* addr, socklen_t* addrlen, int flags) {
return handleSysAcceptEntry(addr, addrlen);
return handleSysAcceptEntry(ctx, addr, addrlen);
}

SEC("kretprobe/" SYS_PREFIX "sys_accept4")
int BPF_KRETPROBE(kretprobeSysAccept4, int fd) {
return handleSysAcceptExit(fd);
return handleSysAcceptExit(ctx, fd);
}

SEC("kprobe/" SYS_PREFIX "sys_read")
int BPF_KPROBE_SYSCALL(kprobeSysRead, int fd, void* buf, size_t count) {
return handleSysReadEntry(fd, (char*)buf);
return handleSysReadEntry(ctx, fd, (char*)buf);
}

SEC("kretprobe/" SYS_PREFIX "sys_read")
int BPF_KRETPROBE(kretprobeSysRead, ssize_t bytesCount) {
return handleSysReadExit(bytesCount);
return handleSysReadExit(ctx, bytesCount);
}

SEC("kprobe/" SYS_PREFIX "sys_recv")
int BPF_KPROBE_SYSCALL(kprobeSysRecv, int fd, void* buf, size_t len, int flags) {
return handleSysRecvEntry(fd, (char*)buf, flags);
return handleSysRecvEntry(ctx, fd, (char*)buf, flags);
}

SEC("kretprobe/" SYS_PREFIX "sys_recv")
int BPF_KRETPROBE(kretprobeSysRecv, ssize_t bytesCount) {
return handleSysRecvExit(bytesCount);
return handleSysRecvExit(ctx, bytesCount);
}

SEC("kprobe/" SYS_PREFIX "sys_recvfrom")
int BPF_KPROBE_SYSCALL(kprobeSysRecvfrom, int fd, void* buf, size_t len, int flags, struct sockaddr* src_addr, socklen_t* addrlen) {
return handleSysRecvEntry(fd, (char*)buf, flags);
return handleSysRecvEntry(ctx, fd, (char*)buf, flags);
}

SEC("kretprobe/" SYS_PREFIX "sys_recvfrom")
int BPF_KRETPROBE(kretprobeSysRecvfrom, ssize_t bytesCount) {
return handleSysRecvExit(bytesCount);
return handleSysRecvExit(ctx, bytesCount);
}

SEC("kprobe/" SYS_PREFIX "sys_close")
int BPF_KPROBE_SYSCALL(kprobeSysClose, int fd) {
return handleSysCloseEntry(fd);
return handleSysCloseEntry(ctx, fd);
}

0 comments on commit a399576

Please sign in to comment.