diff --git a/libebpfdiscoveryskel/src/GlobalData.h b/libebpfdiscoveryskel/src/GlobalData.h index c15c6598..48a606fc 100644 --- a/libebpfdiscoveryskel/src/GlobalData.h +++ b/libebpfdiscoveryskel/src/GlobalData.h @@ -22,8 +22,10 @@ __attribute__((always_inline)) inline static struct DiscoveryGlobalState* getGlo return (struct DiscoveryGlobalState*)bpf_map_lookup_elem(&globalStateMap, &zero); } -__attribute__((always_inline)) inline static void disableDiscoveryCollecting(struct DiscoveryGlobalState* discoveryGlobalStatePtr) { +__attribute__((always_inline)) inline static void disableDiscoveryCollecting( + struct pt_regs* ctx, struct DiscoveryGlobalState* discoveryGlobalStatePtr) { DEBUG_PRINTLN("Discovery disabled."); + LOG_DEBUG(ctx, ) discoveryGlobalStatePtr->isCollectingDisabled = true; } @@ -69,11 +71,11 @@ struct { } eventsToUserspaceQueueMap SEC(".maps"); __attribute__((always_inline)) inline static int pushEventToUserspace( - struct DiscoveryGlobalState* globalStatePtr, struct DiscoveryEvent* eventPtr) { + struct pt_regs* ctx, struct DiscoveryGlobalState* globalStatePtr, struct DiscoveryEvent* eventPtr) { int result = bpf_map_push_elem(&eventsToUserspaceQueueMap, eventPtr, BPF_ANY); if (result != 0) { DEBUG_PRINTLN("Couldn't push a shared event. (pid: `%d`, fd: `%d`)", eventPtr->dataKey.pid, eventPtr->dataKey.fd); - disableDiscoveryCollecting(globalStatePtr); + disableDiscoveryCollecting(ctx, globalStatePtr); return result; } diff --git a/libebpfdiscoveryskel/src/Handlers.h b/libebpfdiscoveryskel/src/Handlers.h index a7745567..e50950d3 100644 --- a/libebpfdiscoveryskel/src/Handlers.h +++ b/libebpfdiscoveryskel/src/Handlers.h @@ -18,7 +18,10 @@ #include __attribute__((always_inline)) inline static void handleAcceptIPv4Session( - const struct DiscoveryTrackedSessionKey trackedSessionKey, const struct AcceptArgs* acceptArgsPtr, int addrlen) { + struct pt_regs* ctx, + const struct DiscoveryTrackedSessionKey trackedSessionKey, + const struct AcceptArgs* acceptArgsPtr, + int addrlen) { if (acceptArgsPtr->addrSize < sizeof(struct sockaddr_in) || addrlen != sizeof(struct sockaddr_in)) { return; } @@ -35,7 +38,10 @@ __attribute__((always_inline)) inline static void handleAcceptIPv4Session( } __attribute__((always_inline)) inline static void handleAcceptIPv6Session( - const struct DiscoveryTrackedSessionKey trackedSessionKey, const struct AcceptArgs* acceptArgsPtr, int addrlen) { + struct pt_regs* ctx, + const struct DiscoveryTrackedSessionKey trackedSessionKey, + const struct AcceptArgs* acceptArgsPtr, + int addrlen) { if (acceptArgsPtr->addrSize < sizeof(struct sockaddr_in6) || addrlen != sizeof(struct sockaddr_in6)) { return; } @@ -51,7 +57,7 @@ __attribute__((always_inline)) inline static void handleAcceptIPv6Session( bpf_map_update_elem(&trackedSessionsMap, &trackedSessionKey, &session, BPF_ANY); } -__attribute__((always_inline)) inline static void handleAccept(struct AcceptArgs* acceptArgsPtr, int fd) { +__attribute__((always_inline)) inline static void handleAccept(struct pt_regs* ctx, struct AcceptArgs* acceptArgsPtr, int fd) { // Size of returned sockaddr struct int addrlen = 0; bpf_probe_read(&addrlen, sizeof(addrlen), (acceptArgsPtr->addrlen)); @@ -72,16 +78,16 @@ __attribute__((always_inline)) inline static void handleAccept(struct AcceptArgs switch (saFamily) { case AF_INET: - handleAcceptIPv4Session(trackedSessionKey, acceptArgsPtr, addrlen); + handleAcceptIPv4Session(ctx, trackedSessionKey, acceptArgsPtr, addrlen); break; case AF_INET6: - handleAcceptIPv6Session(trackedSessionKey, acceptArgsPtr, addrlen); + handleAcceptIPv6Session(ctx, trackedSessionKey, acceptArgsPtr, addrlen); break; } } __attribute__((always_inline)) inline static int sessionFillIPv4( - struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) { + struct pt_regs* ctx, struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) { struct sockaddr_in* sockipPtr = (struct sockaddr_in*)bpf_map_lookup_elem(&trackedSessionSockIPv4Map, sessionKeyPtr); if (sockipPtr == NULL) { DEBUG_PRINTLN("No IPv4 of tracked session. (id: %d)", sessionPtr->id); @@ -94,7 +100,7 @@ __attribute__((always_inline)) inline static int sessionFillIPv4( } __attribute__((always_inline)) inline static int sessionFillIPv6( - struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) { + struct pt_regs* ctx, struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) { struct sockaddr_in6* sockipPtr = (struct sockaddr_in6*)bpf_map_lookup_elem(&trackedSessionSockIPv6Map, sessionKeyPtr); if (sockipPtr == NULL) { DEBUG_PRINTLN("No IPv6 of tracked session. (id: %d)", sessionPtr->id); @@ -107,17 +113,18 @@ __attribute__((always_inline)) inline static int sessionFillIPv6( } __attribute__((always_inline)) inline static int sessionFillIP( - struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) { + struct pt_regs* ctx, struct DiscoveryTrackedSessionKey* sessionKeyPtr, struct DiscoverySession* sessionPtr) { if (discoverySessionFlagsIsIPv4(sessionPtr->meta.flags)) { - return sessionFillIPv4(sessionKeyPtr, sessionPtr); + return sessionFillIPv4(ctx, sessionKeyPtr, sessionPtr); } else if (discoverySessionFlagsIsIPv6(sessionPtr->meta.flags)) { - return sessionFillIPv6(sessionKeyPtr, sessionPtr); + return sessionFillIPv6(ctx, sessionKeyPtr, sessionPtr); } return -1; } __attribute__((always_inline)) inline static void handleRead( + struct pt_regs* ctx, struct DiscoveryGlobalState* globalStatePtr, struct DiscoveryAllSessionState* allSessionStatePtr, struct ReadArgs* readArgsPtr, @@ -153,7 +160,7 @@ __attribute__((always_inline)) inline static void handleRead( sessionPtr->id = allSessionStatePtr->sessionCounter; sessionPtr->meta.pid = event.dataKey.pid; allSessionStatePtr->sessionCounter++; - sessionFillIP((struct DiscoveryTrackedSessionKey*)&event.dataKey, sessionPtr); + sessionFillIP(ctx, (struct DiscoveryTrackedSessionKey*)&event.dataKey, sessionPtr); } else { event.dataKey.bufferSeq = sessionPtr->bufferCount; } @@ -177,7 +184,7 @@ __attribute__((always_inline)) inline static void handleRead( bpf_map_update_elem(&savedBuffersMap, &event.dataKey, savedBufferPtr, BPF_ANY); } - pushEventToUserspace(globalStatePtr, &event); + pushEventToUserspace(ctx, globalStatePtr, &event); if (discoveryEventFlagsIsNoMoreData(event.flags)) { deleteTrackedSession((struct DiscoveryTrackedSessionKey*)&event.dataKey, sessionPtr); @@ -188,7 +195,7 @@ __attribute__((always_inline)) inline static void handleRead( } __attribute__((always_inline)) inline static void handleClose( - struct DiscoveryGlobalState* globalStatePtr, struct DiscoveryAllSessionState* allSessionStatePtr, int fd) { + struct pt_regs* ctx, struct DiscoveryGlobalState* globalStatePtr, struct DiscoveryAllSessionState* allSessionStatePtr, int fd) { struct DiscoveryTrackedSessionKey trackedSessionKey = {}; trackedSessionKey.pid = pidTgidToPid(bpf_get_current_pid_tgid()); @@ -203,5 +210,5 @@ __attribute__((always_inline)) inline static void handleClose( deleteTrackedSession(&trackedSessionKey, sessionPtr); struct DiscoveryEvent event = {.flags = DISCOVERY_EVENT_FLAGS_CLOSE}; - pushEventToUserspace(globalStatePtr, &event); + pushEventToUserspace(ctx, globalStatePtr, &event); } diff --git a/libebpfdiscoveryskel/src/SyscallProbes.h b/libebpfdiscoveryskel/src/SyscallProbes.h index 1e8fd457..2a185a0b 100644 --- a/libebpfdiscoveryskel/src/SyscallProbes.h +++ b/libebpfdiscoveryskel/src/SyscallProbes.h @@ -36,7 +36,7 @@ struct { * Syscall handlers */ -__attribute__((always_inline)) inline static int handleSysAcceptEntry(struct sockaddr* addr, socklen_t* addrlen) { +__attribute__((always_inline)) inline static int handleSysAcceptEntry(struct pt_regs* ctx, struct sockaddr* addr, socklen_t* addrlen) { if (addr == NULL || addrlen == NULL) { // We expect that for TCP/IP connections the addr argument is not null. return 0; @@ -69,7 +69,7 @@ __attribute__((always_inline)) inline static int handleSysAcceptEntry(struct soc return 0; } -__attribute__((always_inline)) inline static int handleSysAcceptExit(int fd) { +__attribute__((always_inline)) inline static int handleSysAcceptExit(struct pt_regs* ctx, int fd) { struct DiscoveryGlobalState* globalStatePtr = getGlobalState(); if (globalStatePtr == NULL || globalStatePtr->isCollectingDisabled) { return 0; @@ -93,13 +93,13 @@ __attribute__((always_inline)) inline static int handleSysAcceptExit(int fd) { return 0; } - handleAccept(acceptArgsPtr, fd); + handleAccept(ctx, acceptArgsPtr, fd); bpf_map_delete_elem(&runningAcceptArgsMap, &pidTgid); return 0; } -__attribute__((always_inline)) inline static int handleSysReadEntry(int fd, char* buf) { +__attribute__((always_inline)) inline static int handleSysReadEntry(struct pt_regs* ctx, int fd, char* buf) { if (buf == NULL) { return 0; } @@ -134,7 +134,7 @@ __attribute__((always_inline)) inline static int handleSysReadEntry(int fd, char return 0; } -__attribute__((always_inline)) inline static int handleSysReadExit(ssize_t bytesCount) { +__attribute__((always_inline)) inline static int handleSysReadExit(struct pt_regs* ctx, ssize_t bytesCount) { struct DiscoveryGlobalState* globalStatePtr = getGlobalState(); if (globalStatePtr == NULL || globalStatePtr->isCollectingDisabled) { return 0; @@ -153,13 +153,13 @@ __attribute__((always_inline)) inline static int handleSysReadExit(ssize_t bytes return 0; } - handleRead(globalStatePtr, allSessionStatePtr, readArgsPtr, bytesCount); + handleRead(ctx, globalStatePtr, allSessionStatePtr, readArgsPtr, bytesCount); bpf_map_delete_elem(&runningReadArgsMap, &pidTgid); return 0; } -__attribute__((always_inline)) inline static int handleSysCloseEntry(int fd) { +__attribute__((always_inline)) inline static int handleSysCloseEntry(struct pt_regs* ctx, int fd) { struct DiscoveryGlobalState* globalStatePtr = getGlobalState(); if (globalStatePtr == NULL || globalStatePtr->isCollectingDisabled) { return 0; @@ -170,27 +170,27 @@ __attribute__((always_inline)) inline static int handleSysCloseEntry(int fd) { return 0; }; - handleClose(globalStatePtr, allSessionStatePtr, fd); + handleClose(ctx, globalStatePtr, allSessionStatePtr, fd); return 0; } -__attribute__((always_inline)) inline static int handleSysRecvEntry(int fd, char* buf, int flags) { +__attribute__((always_inline)) inline static int handleSysRecvEntry(struct pt_regs* ctx, int fd, char* buf, int flags) { if (flags & MSG_PEEK) { return 0; } if (flags & MSG_TRUNC || flags & MSG_OOB) { // We drop handling the session when these flags are used - handleSysCloseEntry(fd); + handleSysCloseEntry(ctx, fd); return 0; } - handleSysReadEntry(fd, buf); + handleSysReadEntry(ctx, fd, buf); return 0; } -__attribute__((always_inline)) inline static int handleSysRecvExit(ssize_t bytesCount) { - return handleSysReadExit(bytesCount); +__attribute__((always_inline)) inline static int handleSysRecvExit(struct pt_regs* ctx, ssize_t bytesCount) { + return handleSysReadExit(ctx, bytesCount); } /* @@ -199,55 +199,55 @@ __attribute__((always_inline)) inline static int handleSysRecvExit(ssize_t bytes SEC("kprobe/" SYS_PREFIX "sys_accept") int BPF_KPROBE_SYSCALL(kprobeSysAccept, int sockfd, struct sockaddr* addr, socklen_t* addrlen) { - return handleSysAcceptEntry(addr, addrlen); + return handleSysAcceptEntry(ctx, addr, addrlen); } SEC("kretprobe/" SYS_PREFIX "sys_accept") int BPF_KRETPROBE(kretprobeSysAccept, int fd) { - return handleSysAcceptExit(fd); + return handleSysAcceptExit(ctx, fd); } SEC("kprobe/" SYS_PREFIX "sys_accept4") int BPF_KPROBE_SYSCALL(kprobeSysAccept4, int sockfd, struct sockaddr* addr, socklen_t* addrlen, int flags) { - return handleSysAcceptEntry(addr, addrlen); + return handleSysAcceptEntry(ctx, addr, addrlen); } SEC("kretprobe/" SYS_PREFIX "sys_accept4") int BPF_KRETPROBE(kretprobeSysAccept4, int fd) { - return handleSysAcceptExit(fd); + return handleSysAcceptExit(ctx, fd); } SEC("kprobe/" SYS_PREFIX "sys_read") int BPF_KPROBE_SYSCALL(kprobeSysRead, int fd, void* buf, size_t count) { - return handleSysReadEntry(fd, (char*)buf); + return handleSysReadEntry(ctx, fd, (char*)buf); } SEC("kretprobe/" SYS_PREFIX "sys_read") int BPF_KRETPROBE(kretprobeSysRead, ssize_t bytesCount) { - return handleSysReadExit(bytesCount); + return handleSysReadExit(ctx, bytesCount); } SEC("kprobe/" SYS_PREFIX "sys_recv") int BPF_KPROBE_SYSCALL(kprobeSysRecv, int fd, void* buf, size_t len, int flags) { - return handleSysRecvEntry(fd, (char*)buf, flags); + return handleSysRecvEntry(ctx, fd, (char*)buf, flags); } SEC("kretprobe/" SYS_PREFIX "sys_recv") int BPF_KRETPROBE(kretprobeSysRecv, ssize_t bytesCount) { - return handleSysRecvExit(bytesCount); + return handleSysRecvExit(ctx, bytesCount); } SEC("kprobe/" SYS_PREFIX "sys_recvfrom") int BPF_KPROBE_SYSCALL(kprobeSysRecvfrom, int fd, void* buf, size_t len, int flags, struct sockaddr* src_addr, socklen_t* addrlen) { - return handleSysRecvEntry(fd, (char*)buf, flags); + return handleSysRecvEntry(ctx, fd, (char*)buf, flags); } SEC("kretprobe/" SYS_PREFIX "sys_recvfrom") int BPF_KRETPROBE(kretprobeSysRecvfrom, ssize_t bytesCount) { - return handleSysRecvExit(bytesCount); + return handleSysRecvExit(ctx, bytesCount); } SEC("kprobe/" SYS_PREFIX "sys_close") int BPF_KPROBE_SYSCALL(kprobeSysClose, int fd) { - return handleSysCloseEntry(fd); + return handleSysCloseEntry(ctx, fd); }