ebpflow_code.ebpf

/*
 *
 * (C) 2018-22 - ntop.org
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 */


struct udp_info {
  struct taskInfo proc, father;
  char container_id[CONTAINER_ID_LEN];
};
BPF_HASH(udpinfo, u16, struct udp_info);

static void fill_ifname(eBPFevent *ev, struct sock *sk);

/* ******************************************* */

static void update_socket_hash(struct pt_regs *ctx, struct sock *sk) {
  u32 tid = (bpf_get_current_pid_tgid() >> 32) & 0xFFFFFFFF;
  struct sock_stats s = { .sk = sk, .ts = bpf_ktime_get_ns() };

  // stash the sock ptr for lookup on returns
  currsock.update(&tid, &s);
};

/* ******************************************* */

int trace_connect_entry(struct pt_regs *ctx, struct sock *sk) {
  update_socket_hash(ctx, sk);

  // bpf_override_return(ctx, -ENOMEM);
  return(0);
};

/* ******************************************* */

static void fill_father_task_info(struct taskInfo *task) {
  // Parent basic info ----- //
  struct task_struct *t = (struct task_struct *)bpf_get_current_task();
  struct task_struct *parent;
  struct cred *fcredential;

  // Grabbing father pointer
  // bpf_probe_read(&parent, sizeof(struct task_struct *), &t->real_parent);
  parent = t->real_parent;

  // Reading father credential
  // bpf_probe_read(&fcredential, sizeof(struct cred *), &parent->real_cred);
  fcredential = (struct cred *)(parent->real_cred);

  task->pid = (u32)parent->pid;
  task->uid = (u32)fcredential->uid.val;
  task->gid = (u32)fcredential->gid.val;

  if(task->pid == 0)
    task->task[0] = '\0';
  else
    bpf_probe_read(&task->task, sizeof(task->task), parent->comm);
}

/* ******************************************* */

static void fill_container_id(char *container_id) {
  struct task_struct *curr_task;
  struct css_set *css;
  struct cgroup_subsys_state *sbs;
  struct cgroup *cg;
  struct kernfs_node *knode, *pknode;
  char *name;
  int name_shift = 0;

  // Initializing to root cgroup
  memcpy(container_id, "/\0", 2);

  curr_task = (struct task_struct *) bpf_get_current_task();
  css = curr_task->cgroups;
  bpf_probe_read(&sbs, sizeof(void *), &css->subsys[0]);
  bpf_probe_read(&cg,  sizeof(void *), &sbs->cgroup);

#if LINUX_VERSION_CODE <= KERNEL_VERSION(3,15,0)
  bpf_probe_read(&name, sizeof(void *), &cg->name);
  // Docker name cgroup as follows: "docker-<containerid>"
  bpf_probe_read(container_id, CONTAINER_ID_LEN, name+sizeof(struct cgroup_name));
  container_id[CONTAINER_ID_LEN-1] = '\0';
#else
  // Reading fspath
  bpf_probe_read(&knode, sizeof(void *), &cg->kn);
  bpf_probe_read(&pknode, sizeof(void *), &knode->parent);

  if(pknode != NULL) {
    char *aus;

    bpf_probe_read(&aus, sizeof(void *), &knode->name);
    bpf_probe_read_str(container_id, CONTAINER_ID_LEN, aus);
  }
#endif
}

/* ******************************************* */

static void fill_task_info(char *container_id, struct taskInfo *task, struct taskInfo *father) {
  struct task_struct *curr_task = (struct task_struct *)bpf_get_current_task();
  u64 tgid = bpf_get_current_pid_tgid();
  u64 ugid = bpf_get_current_uid_gid();
  u32 pid = tgid & 0xFFFFFFFF, tid = (tgid >> 32) & 0xFFFFFFFF;
  u32 uid = ugid & 0xFFFFFFFF, gid = (ugid >> 32) & 0xFFFFFFFF;

  task->pid = pid;
  task->tid = tid;
  task->uid = uid;
  task->gid = gid;

  if(pid == 0)
    task->task[0] = '\0';
  else {
    bpf_get_current_comm(&task->task, sizeof(task->task));
    fill_father_task_info(father);
  }

  container_id[0] = '\0';
  fill_container_id(container_id);
}

/* ******************************************* */

static void swap_event_peers(eBPFevent *ev) {
  if(ev->ip_version == 4) {
    u32 tmp;
    u16 tmp16;

    tmp16 = ev->sport;
    ev->sport = ev->dport;
    ev->dport = tmp16;

    tmp = ev->addr.v4.daddr;
    ev->addr.v4.daddr = ev->addr.v4.saddr;
    ev->addr.v4.saddr = tmp;
  } else {
    u16 tmp16;
    unsigned __int128 tmp;

    tmp16 = ev->sport;
    ev->sport = ev->dport;
    ev->dport = tmp16;

    memcpy(&tmp, &ev->addr.v6.saddr, sizeof(tmp));
    memcpy(&ev->addr.v6.saddr, &ev->addr.v6.daddr, sizeof(ev->addr.v6.saddr));
    memcpy(&ev->addr.v6.daddr, &tmp, sizeof(ev->addr.v6.daddr));
  }
}

/* ******************************************* */

static int fill_event(struct pt_regs *ctx, eBPFevent *ev,
          struct sock *sk,
          void *msg,
          u64 begin_ts,
          u8 proto, u8 swap_peers) {
  u16 sport = 0, dport = 0;
  u16 family;
  u64 delta;
  u32 pid    = bpf_get_current_pid_tgid() & 0xFFFFFFFF;
  u32 saddr  = 0, daddr = 0;
  ktime_t kt = { bpf_ktime_get_ns() };

  ev->sent_packet = (swap_peers == 0) ? 1 : 0;

  bpf_probe_read(&family, sizeof(family), &sk->__sk_common.skc_family);
  if((family != AF_INET) && (family != AF_INET6)) return(-1);

  bpf_probe_read(&sport, sizeof(u16), &sk->__sk_common.skc_num);
  bpf_probe_read(&dport, sizeof(u16), &sk->__sk_common.skc_dport);

  if(msg) {
    struct sockaddr_in usin;

    bpf_probe_read(&usin, sizeof(usin), msg);
    family = usin.sin_family;

    if(usin.sin_family == AF_INET) {
      daddr = usin.sin_addr.s_addr;
      dport = usin.sin_port;
    }
  }

  if(begin_ts > 0) {
    delta = bpf_ktime_get_ns() - begin_ts;
    delta /= 1000;
  } else
    delta = 0;

  dport = ntohs(dport); /* This has to be done all the time */

  if((sport == 0) && (dport == 0))
    return(-1);

  ev->proc.pid = pid;

  if(family == AF_INET) {
    ev->ip_version = 4;

    if(saddr == 0)
      bpf_probe_read(&ev->addr.v4.saddr, sizeof(u32), &sk->__sk_common.skc_rcv_saddr);
    else
      ev->addr.v4.saddr = saddr;

    if(daddr == 0)
      bpf_probe_read(&ev->addr.v4.daddr, sizeof(u32), &sk->__sk_common.skc_daddr);
    else
      ev->addr.v4.daddr = daddr;
  } else /* (family == AF_INET6)  */ {
    ev->ip_version = 6;

    bpf_probe_read(&ev->addr.v6.saddr, sizeof(ev->addr.v6.saddr),
       sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
    bpf_probe_read(&ev->addr.v6.daddr, sizeof(ev->addr.v6.daddr), sk->__sk_common.skc_v6_daddr.in6_u.u6_addr32);

    if(/* Implement in a better way */
       (((ev->addr.v6.saddr) & 0xFFFFFFFF) == 0)
       && (((ev->addr.v6.saddr >> 32) & 0xFFFFFFFF) == 0)
       ) {
      ev->ip_version = 4;
      ev->proc.pid = pid;
      ev->addr.v4.saddr = ev->addr.v6.saddr >> 96;
      ev->sport = sport;
      ev->addr.v4.daddr = ev->addr.v6.daddr >> 96;
    }
  }

  ev->dport = dport;
  ev->sport = sport;
  ev->latency_usec = delta;
  ev->proto = proto;
  bpf_get_current_comm(&ev->proc.task, sizeof(ev->proc.task));
  ev->proc.pid = pid;

  fill_task_info((char*)ev->container_id, &ev->proc, &ev->father);

  if(swap_peers) swap_event_peers(ev);

  fill_ifname(ev, sk);

  ev->ktime = kt;
  return(0);
}

/* ******************************************* */

static int trace_connect_return(struct pt_regs *ctx) {
  int ret = PT_REGS_RC(ctx); // return value
  struct sock_stats *s;
  u32 tid = (bpf_get_current_pid_tgid() >> 32) & 0xFFFFFFFF;
  eBPFevent event = { .etype = eTCP_CONN, .ip_version = 4 };

  s = currsock.lookup(&tid);
  if(s == NULL)
    return(0); // missed entry


  fill_event(ctx, &event, s->sk, NULL, s->ts, IPPROTO_TCP, 0 /* don't swap */);
  ebpf_events.perf_submit(ctx, &event, sizeof(eBPFevent));

  currsock.delete(&tid);

  return(0);
}

/* ******************************************* */

int trace_connect_v4_return(struct pt_regs *ctx) {
  return trace_connect_return(ctx);
}

/* ******************************************* */

int trace_connect_v6_return(struct pt_regs *ctx) {
  return trace_connect_return(ctx);
}

/* ******************************************* */

int trace_tcp_accept(struct pt_regs *ctx) {
  struct sock *newsk = (struct sock *)PT_REGS_RC(ctx);

  if(newsk != NULL) {
    eBPFevent event = { .etype = eTCP_ACPT, .ip_version = 4 };

    fill_event(ctx, &event, newsk, NULL, 0, IPPROTO_TCP, 1 /* swap */);
    ebpf_events.perf_submit(ctx, &event, sizeof(eBPFevent));
  }

  return(0);
}

/* ******************************************* */

// Fired when the state changes and check if the state is CLOSE
int trace_tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state) {
  unsigned char old_state;
  eBPFevent event = {};

  if((state != TCP_CLOSE) && (state != EINPROGRESS))
    return 0;
  else {
    // Reading old state
    // bpf_probe_read(&old_state, sizeof(unsigned char), (unsigned char*) &sk->__sk_common.skc_state);
    old_state = sk->__sk_common.skc_state;
  }
  
  fill_event(ctx, &event, sk, NULL, 0, IPPROTO_TCP, 0);

  // Connection refused if we move from SYN_SENT to TCP_CLOSE
  if (((int)old_state == TCP_SYN_SENT) && (state == TCP_CLOSE))
    event.etype = eTCP_CONN_FAIL;
  else
    event.etype = eTCP_CLOSE;

  ebpf_events.perf_submit(ctx, &event, sizeof(eBPFevent));
  return 0;
}

/* ******************************************* */

int trace_tcp_retransmit_skb(struct pt_regs *ctx, struct sock *sk) {
  u32 tid = (bpf_get_current_pid_tgid() >> 32) & 0xFFFFFFFF;
  eBPFevent event = { .etype = eTCP_RETR, .retransmissions = 1 };
  
  fill_event(ctx, &event, sk, NULL, 0, IPPROTO_TCP, 0);  
  ebpf_events.perf_submit(ctx, &event, sizeof(eBPFevent));

  return 0;
}

/* *********************** UDP *************************** */
/* *********************** UDP *************************** */
/* *********************** UDP *************************** */

/* key is IPs+sport+dport, value = bpf_ktime_get_ns() */
#define BPF_LRU_HASH3(_name, _key_type, _leaf_type) BPF_TABLE("lru_hash", _key_type, _leaf_type, _name, 10240)
BPF_LRU_HASH3(udpmsglru, u64, u64);

/* ******************************************* */

static u8 is_cached_entry(eBPFevent *ev) {
  u64 hash_idx;
  u64 *when, now;

  /* NOTE: implemented asymmetric hash to make sure we see both flow directions */
  if(ev->ip_version == 4)
    hash_idx = ev->addr.v4.saddr + ev->addr.v4.daddr + ev->sport + ev->dport + ev->proc.pid;
  else
    hash_idx = ev->addr.v6.saddr + ev->addr.v6.daddr + ev->sport + ev->dport + ev->proc.pid;

  when = udpmsglru.lookup(&hash_idx);
  now = bpf_ktime_get_ns();

  if(when == NULL) {
    /* not found so not cached */

    udpmsglru.update(&hash_idx, &now);
    return(0);
  } else {
    u64 diff = now - *when;

    if(diff > 1000000000 /* 1 sec */) {
      /* or it was cached more than one second ago */
      udpmsglru.update(&hash_idx, &now);
      return(0);
    }

    return(1);
  }

  return(0);
}

/* ******************************************* */
/* ******************************************* */

/* https://blog.yadutaf.fr/2017/07/28/tracing-a-packet-journey-using-linux-tracepoints-perf-ebpf/ */

#define ETHERTYPE_IP            0x0800          /* IP */
#define ETHERTYPE_IPV6          0x86DD          /* IP protocol version 6 */
#define ETHERTYPE_VLAN          0x8100          /* IEEE 802.1Q VLAN tagging */

#define MAC_HEADER_SIZE 14;
#define member_address(source_struct, source_member)      \
  ({                  \
    void* __ret;              \
    __ret = (void*) (((char*)source_struct) + offsetof(typeof(*source_struct), source_member)); \
    __ret;                \
  })
#define member_read(destination, source_struct, source_member)    \
  do{                 \
    bpf_probe_read(             \
       destination,           \
       sizeof(source_struct->source_member),    \
       member_address(source_struct, source_member)   \
                );  \
  } while(0)

static inline int udp_packet_trace(void *ctx, struct sk_buff* skb, u_int8_t sent_packet) {
  // Compute MAC header address
  char* head;
  u16 mac_header;
  eBPFevent event = { .etype = eUDP_SEND, .sent_packet = sent_packet };
  u8 offset, l4proto, ip_version;
  char* ip_header_address;
  struct udphdr *udphdr;
  u16 eth_proto;
  struct net_device *dev;

  member_read(&head,       skb, head);
  member_read(&mac_header, skb, mac_header);

  head = head + mac_header;

  bpf_probe_read(&eth_proto, sizeof(u16), &head[12]);

  // Compute IP Header address
  ip_header_address = head + MAC_HEADER_SIZE;

  // Load IP protocol version
  bpf_probe_read(&ip_version, sizeof(u8), ip_header_address);
  event.ip_version = ip_version >> 4 & 0xf;

  /* TODO; ADD VLAN support */

  if(eth_proto == htons(ETHERTYPE_IP)) {
    struct iphdr iphdr;

    event.ip_version = 4;
    bpf_probe_read(&iphdr, sizeof(iphdr), ip_header_address);

    // Load protocol and address
    offset = iphdr.ihl * 4;

    l4proto = iphdr.protocol;

    // Discard non UDP traffic
    if(l4proto != IPPROTO_UDP) return 0;

    event.addr.v4.saddr = iphdr.saddr;
    event.addr.v4.daddr = iphdr.daddr;
    udphdr = (struct udphdr*)(&ip_header_address[offset]);
    bpf_probe_read(&event.sport, sizeof(u16), &udphdr->source);
    bpf_probe_read(&event.dport, sizeof(u16), &udphdr->dest);
    event.sport = htons(event.sport);
    event.dport = htons(event.dport);
  } else if(eth_proto == htons(ETHERTYPE_IPV6)) {
    // Assume no option header --> fixed size header
    struct ipv6hdr* ipv6hdr = (struct ipv6hdr*)ip_header_address;

    event.ip_version = 6;
    bpf_probe_read(&l4proto, sizeof(ipv6hdr->nexthdr),
       (char*)ipv6hdr + offsetof(struct ipv6hdr, nexthdr));

    // Discard non UDP traffic
    if(l4proto != IPPROTO_UDP) return 0;

    bpf_probe_read(&event.addr.v6.saddr, sizeof(ipv6hdr->saddr),
       (char*)ipv6hdr + offsetof(struct ipv6hdr, saddr));
    bpf_probe_read(&event.addr.v6.daddr, sizeof(ipv6hdr->daddr),
       (char*)ipv6hdr + offsetof(struct ipv6hdr, daddr));
    offset = sizeof(*ipv6hdr);
    udphdr = (struct udphdr*)(&ip_header_address[offset]);
    bpf_probe_read(&event.sport, sizeof(u16), &udphdr->source);
    bpf_probe_read(&event.dport, sizeof(u16), &udphdr->dest);
    event.sport = htons(event.sport);
    event.dport = htons(event.dport);
  } else {
#if 0
    event.ip_version = 6;
    event.sport = ntohs(eth_proto);
    ebpf_events.perf_submit(ctx, &event, sizeof(eBPFevent));
#endif
    return(0);
  }

  event.proto = IPPROTO_UDP;
  event.latency_usec = 0;

  if(sent_packet)
    fill_task_info((char*)event.container_id, &event.proc, &event.father);
  else {
    event.container_id[0] = '\0';
    memset(&event.proc, 0, sizeof(event.proc));
    memset(&event.father, 0, sizeof(event.father));
  }

  member_read(&dev, skb, dev);
  bpf_probe_read(&event.ifname, IFNAMSIZ, dev->name);

  if(!is_cached_entry(&event))
    ebpf_events.perf_submit(ctx, &event, sizeof(eBPFevent));

  return 0;
}

/* ******************************************* */

static void fill_ifname(eBPFevent *ev, struct sock *sk) {
  struct net_device *dev;
  struct dst_entry *dst;

  member_read(&dst, sk, sk_dst_cache);
  member_read(&dev, dst, dev);
  bpf_probe_read(&ev->ifname, IFNAMSIZ, dev->name);
}

/* ******************************************* */

/**
 * Attach to Kernel Tracepoints
 */
/*
  cat /sys/kernel/debug/tracing/events/net/netif_rx/format

  field:unsigned short common_type;offset:0;size:2;signed:0;
  field:unsigned char common_flags;offset:2;size:1;signed:0;
  field:unsigned char common_preempt_count;offset:3;size:1;signed:0;
  field:int common_pid;offset:4;size:4;signed:1;

  field:void * skbaddr;offset:8;size:8;signed:0;
  field:unsigned int len;offset:16;size:4;signed:0;
  field:__data_loc char[] name;offset:20;size:4;signed:1;

*/
struct netif_rx_read_args {
  u64 __unused__;
  void * skbaddr;
  u_int16_t len;
  char name[];
};

/*
  cat /sys/kernel/debug/tracing/events/syscalls/sys_enter_bind/format

  field:int __syscall_nr;offset:8;size:4;signed:1;
  field:int fd;offset:16;size:8;signed:0;
  field:struct sockaddr * umyaddr;offset:24;size:8;signed:0;
  field:int addrlen;offset:32;size:8;signed:0;
*/
struct sys_bind_args {
  u64 __unused__;
  int __syscall_nr;
  int fd;
  struct sockaddr *umyaddr;
  int addrlen;
};

/*
 * When a packet is received the skb has not yet hit the system and thus
 * we don't know (yet) the process that will handle it
 */
int trace_netif_rx_entry(struct netif_rx_read_args *args) {
  return udp_packet_trace(args, (struct sk_buff*)(args->skbaddr), 0);
}

int trace_netif_tx_entry(struct netif_rx_read_args *args) {
  return udp_packet_trace(args, (struct sk_buff*)(args->skbaddr), 1);
}

int trace_receive_v4(struct pt_regs *ctx, struct sock *sk) {
  eBPFevent event = { .etype = eUDP_RECV, .ip_version = 4 };

  if(fill_event(ctx, &event, sk, NULL, bpf_ktime_get_ns(), IPPROTO_UDP, 0 /* don't swap */) == 0)
    ebpf_events.perf_submit(ctx, &event, sizeof(eBPFevent));

  return(0);
}