77 lines
1.8 KiB
C
77 lines
1.8 KiB
C
#include "common.h"
|
|
|
|
enum filter_ret_code {
|
|
// 不处理当前连接
|
|
PASS = 0,
|
|
// 处理当前连接
|
|
STORE = 1,
|
|
};
|
|
|
|
|
|
char LICENSE[] SEC("license") = "Dual BSD/GPL";
|
|
|
|
static inline
|
|
void store_sock_ops(struct bpf_sock_ops *skops)
|
|
{
|
|
struct sock_key key = {
|
|
.dip = skops->remote_ip4,
|
|
.sip = skops->local_ip4,
|
|
.sport = bpf_htonl(skops->local_port), /* convert to network byte order */
|
|
.dport = skops->remote_port,
|
|
.family = skops->family,
|
|
};
|
|
|
|
int ret = bpf_sock_hash_update(skops, &sock_ops_map, &key, BPF_NOEXIST);
|
|
if (ret != 0) {
|
|
bpf_printk("sock_hash_update() failed, ret: %d\n", ret);
|
|
}
|
|
|
|
}
|
|
|
|
// 判断传入连接是否需要处理
|
|
static inline
|
|
__u8 sock_filter(struct bpf_sock_ops *skops)
|
|
{
|
|
if (skops->family != 2){ // AF_INET
|
|
return PASS;
|
|
}
|
|
/*
|
|
local traffic only, so check both local and remote IPs
|
|
*/
|
|
__u32 remote_ip = skops->remote_ip4;
|
|
__u32 local_ip = skops->local_ip4;
|
|
|
|
// 检查 remote_ip 是否在目标 map 中
|
|
if (!bpf_map_lookup_elem(&target_ip_map, &remote_ip)) {
|
|
return PASS;
|
|
}
|
|
|
|
// 如果是本地流量，大概率remote ip 和 local ip 是相同的，此时可以省去一次 map 查询
|
|
if (remote_ip == local_ip) {
|
|
return STORE;
|
|
}
|
|
|
|
// 检查 local_ip 是否在目标 map 中
|
|
if (!bpf_map_lookup_elem(&target_ip_map, &local_ip)) {
|
|
return PASS;
|
|
}
|
|
|
|
return STORE;
|
|
}
|
|
|
|
SEC("sockops")
|
|
int bpf_sockops_handler(struct bpf_sock_ops *skops)
|
|
{
|
|
// only interested in established events
|
|
if (skops->op != BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB &&
|
|
skops->op != BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB) {
|
|
return BPF_OK;
|
|
}
|
|
if (sock_filter(skops)){ // AF_INET
|
|
store_sock_ops(skops); // 将 socket 信息记录到到 sockmap
|
|
}
|
|
|
|
return BPF_OK;
|
|
}
|
|
|