diff --git a/bpf/kprobe_pwru.c b/bpf/kprobe_pwru.c index 99fc10c9..60b5ba72 100644 --- a/bpf/kprobe_pwru.c +++ b/bpf/kprobe_pwru.c @@ -79,7 +79,7 @@ struct event_t { u32 type; u64 addr; u64 caller_addr; - u64 skb_addr; + u64 skb_head; u64 ts; typeof(print_skb_id) print_skb_id; typeof(print_shinfo_id) print_shinfo_id; @@ -103,7 +103,7 @@ struct { __type(key, __u64); __type(value, bool); __uint(max_entries, MAX_TRACK_SIZE); -} skb_addresses SEC(".maps"); +} skb_heads SEC(".maps"); struct { __uint(type, BPF_MAP_TYPE_HASH); @@ -426,14 +426,14 @@ set_output(void *ctx, struct sk_buff *skb, struct event_t *event) { static __noinline bool handle_everything(struct sk_buff *skb, void *ctx, struct event_t *event, u64 *_stackid) { u8 tracked_by; - u64 skb_addr = (u64) BPF_CORE_READ(skb, head); + u64 skb_head = (u64) BPF_CORE_READ(skb, head); u64 stackid; if (cfg->track_skb_by_stackid) stackid = _stackid ? *_stackid : get_stackid(ctx); if (cfg->is_set) { - if (cfg->track_skb && bpf_map_lookup_elem(&skb_addresses, &skb_addr)) { + if (cfg->track_skb && bpf_map_lookup_elem(&skb_heads, &skb_head)) { tracked_by = _stackid ? TRACKED_BY_STACKID : TRACKED_BY_SKB; goto cont; } @@ -455,7 +455,7 @@ handle_everything(struct sk_buff *skb, void *ctx, struct event_t *event, u64 *_s } if (cfg->track_skb && tracked_by == TRACKED_BY_FILTER) { - bpf_map_update_elem(&skb_addresses, &skb_addr, &TRUE, BPF_ANY); + bpf_map_update_elem(&skb_heads, &skb_head, &TRUE, BPF_ANY); } if (cfg->track_skb_by_stackid && tracked_by != TRACKED_BY_STACKID) { @@ -481,7 +481,7 @@ kprobe_skb(struct sk_buff *skb, struct pt_regs *ctx, bool has_get_func_ip, u64 * if (!handle_everything(skb, ctx, &event, _stackid)) return BPF_OK; - event.skb_addr = (u64) BPF_CORE_READ(skb, head); + event.skb_head = (u64) BPF_CORE_READ(skb, head); event.addr = has_get_func_ip ? bpf_get_func_ip(ctx) : PT_REGS_IP(ctx); event.param_second = PT_REGS_PARM2(ctx); if (CFG.output_caller) @@ -531,14 +531,14 @@ int kprobe_skb_by_stackid(struct pt_regs *ctx) { SEC("kprobe/skb_lifetime_termination") int kprobe_skb_lifetime_termination(struct pt_regs *ctx) { struct sk_buff *skb = (typeof(skb)) PT_REGS_PARM1(ctx); - u64 skb_addr = (u64) BPF_CORE_READ(skb, head); + u64 skb_head = (u64) BPF_CORE_READ(skb, head); - bpf_map_delete_elem(&skb_addresses, &skb_addr); + bpf_map_delete_elem(&skb_heads, &skb_head); if (cfg->track_skb_by_stackid) { u64 stackid = get_stackid(ctx); bpf_map_delete_elem(&stackid_skb, &stackid); - bpf_map_delete_elem(&skb_stackid, &skb_addr); + bpf_map_delete_elem(&skb_stackid, &skb_head); } return BPF_OK; @@ -548,8 +548,8 @@ static __always_inline int track_skb_clone(struct sk_buff *old, struct sk_buff *new) { u64 skb_addr_old = (u64) BPF_CORE_READ(old, head); u64 skb_addr_new = (u64) BPF_CORE_READ(new, head); - if (bpf_map_lookup_elem(&skb_addresses, &skb_addr_old)) - bpf_map_update_elem(&skb_addresses, &skb_addr_new, &TRUE, BPF_ANY); + if (bpf_map_lookup_elem(&skb_heads, &skb_addr_old)) + bpf_map_update_elem(&skb_heads, &skb_addr_new, &TRUE, BPF_ANY); return BPF_OK; } @@ -577,7 +577,7 @@ int BPF_PROG(fentry_tc, struct sk_buff *skb) { if (!handle_everything(skb, ctx, &event, NULL)) return BPF_OK; - event.skb_addr = (u64) BPF_CORE_READ(skb, head); + event.skb_head = (u64) BPF_CORE_READ(skb, head); event.addr = BPF_PROG_ADDR; event.type = EVENT_TYPE_TC; bpf_map_push_elem(&events, &event, BPF_EXIST); @@ -663,16 +663,16 @@ set_xdp_output(void *ctx, struct xdp_buff *xdp, struct event_t *event) { SEC("fentry/xdp") int BPF_PROG(fentry_xdp, struct xdp_buff *xdp) { - u64 skb_addr = (u64) BPF_CORE_READ(xdp, data_hard_start); + u64 skb_head = (u64) BPF_CORE_READ(xdp, data_hard_start); struct event_t event = {}; if (cfg->is_set) { if (cfg->track_skb) { - if (!bpf_map_lookup_elem(&skb_addresses, &skb_addr)) { + if (!bpf_map_lookup_elem(&skb_heads, &skb_head)) { if (!filter_xdp(xdp)) return BPF_OK; - bpf_map_update_elem(&skb_addresses, &skb_addr, &TRUE, BPF_ANY); + bpf_map_update_elem(&skb_heads, &skb_head, &TRUE, BPF_ANY); } } else if (!filter_xdp(xdp)) { @@ -685,7 +685,7 @@ int BPF_PROG(fentry_xdp, struct xdp_buff *xdp) { event.pid = bpf_get_current_pid_tgid() >> 32; event.ts = bpf_ktime_get_ns(); event.cpu_id = bpf_get_smp_processor_id(); - event.skb_addr = (u64) skb_addr; + event.skb_head = (u64) skb_head; event.addr = BPF_PROG_ADDR; event.type = EVENT_TYPE_XDP; bpf_map_push_elem(&events, &event, BPF_EXIST); @@ -698,7 +698,7 @@ int kprobe_veth_convert_skb_to_xdp_buff(struct pt_regs *ctx) { struct sk_buff **skb = (struct sk_buff **)PT_REGS_PARM3(ctx); u64 skb_addr; bpf_probe_read_kernel(&skb_addr, sizeof(skb_addr), (void *)skb); - if (bpf_map_lookup_elem(&skb_addresses, &skb_addr)) { + if (bpf_map_lookup_elem(&skb_heads, &skb_addr)) { u64 pid_tgid = bpf_get_current_pid_tgid(); bpf_map_update_elem(&veth_skbs, &pid_tgid, &skb, BPF_ANY); } @@ -712,7 +712,7 @@ int kretprobe_veth_convert_skb_to_xdp_buff(struct pt_regs *ctx) { if (skb && *skb) { u64 skb_addr; bpf_probe_read_kernel(&skb_addr, sizeof(skb_addr), (void *)*skb); - bpf_map_update_elem(&skb_addresses, &skb_addr, &TRUE, BPF_ANY); + bpf_map_update_elem(&skb_heads, &skb_addr, &TRUE, BPF_ANY); bpf_map_delete_elem(&veth_skbs, &pid_tgid); } return BPF_OK; diff --git a/internal/pwru/output.go b/internal/pwru/output.go index 7b70b99b..b284b5a8 100644 --- a/internal/pwru/output.go +++ b/internal/pwru/output.go @@ -159,7 +159,7 @@ func (o *output) PrintJson(event *Event) { d := &jsonPrinter{} // add the data to the struct - d.Skb = fmt.Sprintf("%#x", event.SAddr) + d.Skb = fmt.Sprintf("%#x", event.SkbHead) d.Cpu = event.CPU d.Process = getExecName(int(event.PID)) d.Func = getOutFuncName(o, event, event.Addr) @@ -167,7 +167,7 @@ func (o *output) PrintJson(event *Event) { d.CallerFunc = o.addr2name.findNearestSym(event.CallerAddr) } - o.lastSeenSkb[event.SAddr] = event.Timestamp + o.lastSeenSkb[event.SkbHead] = event.Timestamp // add the timestamp to the struct if it is not set to none if o.flags.OutputTS != "none" { @@ -228,7 +228,7 @@ func getAbsoluteTs() string { func getRelativeTs(event *Event, o *output) uint64 { ts := event.Timestamp - if last, found := o.lastSeenSkb[event.SAddr]; found { + if last, found := o.lastSeenSkb[event.SkbHead]; found { ts = ts - last } else { ts = 0 @@ -396,12 +396,12 @@ func (o *output) Print(event *Event) { outFuncName := getOutFuncName(o, event, addr) - fmt.Fprintf(o.writer, "%-18s %-3s %-16s", fmt.Sprintf("%#x", event.SAddr), + fmt.Fprintf(o.writer, "%-18s %-3s %-16s", fmt.Sprintf("%#x", event.SkbHead), fmt.Sprintf("%d", event.CPU), fmt.Sprintf("%s", execName)) if o.flags.OutputTS != "none" { fmt.Fprintf(o.writer, " %-16d", ts) } - o.lastSeenSkb[event.SAddr] = event.Timestamp + o.lastSeenSkb[event.SkbHead] = event.Timestamp if o.flags.OutputMeta { fmt.Fprintf(o.writer, " %s", getMetaData(event, o)) diff --git a/internal/pwru/types.go b/internal/pwru/types.go index 414ece52..740d7fc3 100644 --- a/internal/pwru/types.go +++ b/internal/pwru/types.go @@ -143,7 +143,7 @@ type Event struct { Type uint32 Addr uint64 CallerAddr uint64 - SAddr uint64 + SkbHead uint64 Timestamp uint64 PrintSkbId uint64 PrintShinfoId uint64