chore: remove arch related kprobe

This commit is contained in:
mzz2017 2023-01-31 20:25:55 +08:00
parent c1e196c1c6
commit bfba33e231
4 changed files with 13 additions and 53 deletions

View File

@ -10,7 +10,13 @@ CLANG ?= clang
STRIP ?= llvm-strip
OUTPUT ?= dae
CFLAGS := -O2 -Wall -Werror $(CFLAGS)
GOARCH ?= amd64
GOARCH ?=
ifneq ($(GOARCH),)
TARGET ?= $(GOARCH)
else
TARGET ?= bpfel,bpfeb
endif
# Get version from .git.
date=$(shell git log -1 --format="%cd" --date=short | sed s/-//g)
@ -28,14 +34,14 @@ dae: ebpf
go build -o $(OUTPUT) -trimpath -ldflags "-s -w -X github.com/v2rayA/dae/cmd.Version=$(VERSION)" .
clean-ebpf:
rm -f component/control/bpf_bpfe*.go && \
rm -f component/control/bpf_bpfe*.o
rm -f component/control/bpf_bpf*.go && \
rm -f component/control/bpf_bpf*.o
# $BPF_CLANG is used in go:generate invocations.
ebpf: export BPF_CLANG := $(CLANG)
ebpf: export BPF_STRIP := $(STRIP)
ebpf: export BPF_CFLAGS := $(CFLAGS)
ebpf: export BPF_GOARCH := $(GOARCH)
ebpf: export BPF_TARGET := $(TARGET)
ebpf: clean-ebpf
unset GOOS && \
unset GOARCH && \

View File

@ -7,4 +7,4 @@ package control
// $BPF_CLANG and $BPF_CFLAGS are set by the Makefile.
//go:generate sh -c "bpftool btf dump file /sys/kernel/btf/vmlinux format c > kern/headers/vmlinux.h"
//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc $BPF_CLANG -strip $BPF_STRIP -cflags $BPF_CFLAGS -target $BPF_GOARCH bpf kern/tproxy.c -- -I./headers
//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc $BPF_CLANG -strip $BPF_STRIP -cflags $BPF_CFLAGS -target $BPF_TARGET bpf kern/tproxy.c -- -I./headers

View File

@ -1887,52 +1887,6 @@ int tproxy_wan_ingress(struct __sk_buff *skb) {
return TC_ACT_OK;
}
// Get sockfd bind addr.
SEC("kprobe/sys_bind")
int src_pid_mapper(struct pt_regs *ctx) {
struct sockaddr_in *in = (struct sockaddr_in *)PT_REGS_PARM2(ctx);
struct sockaddr_in6 *in6 = NULL;
__kernel_sa_family_t family = 0;
int ret = bpf_core_read_user(&family, sizeof(family), &in->sin_family);
if (ret) {
if (ret == -EFAULT) {
bpf_printk("sys_bind: Failed to read data from memory. Maybe data is in "
"swap space.",
ret);
} else {
bpf_printk("sys_bind: %d", ret);
}
return 0;
}
struct ip_port_proto src_key;
__builtin_memset(&src_key, 0, sizeof(src_key));
if (family == AF_INET6) {
in6 = (struct sockaddr_in6 *)in;
in = NULL;
bpf_core_read_user(src_key.ip, sizeof(src_key.ip), &in6->sin6_addr);
bpf_core_read_user(&src_key.port, sizeof(src_key.port), &in6->sin6_port);
} else if (family == AF_INET) {
bpf_core_read_user(&src_key.ip[3], sizeof(src_key.ip[3]), &in->sin_addr);
src_key.ip[2] = bpf_htonl(0x0000ffff);
bpf_core_read_user(&src_key.port, sizeof(src_key.port), &in->sin_port);
} else {
bpf_printk("family: %d", family);
return 0;
}
__u32 pid = bpf_get_current_pid_tgid() >> 32;
if ((ret = bpf_map_update_elem(&src_pid_map, &src_key, &pid, BPF_ANY))) {
bpf_printk("socket_pid_mapper: failed update map: %d", ret);
return 0;
}
bpf_printk("socket_pid_mapper: %pI6:%u -> %u", src_key.ip,
bpf_ntohs(src_key.port), pid);
return 0;
}
static int __always_inline build_key_by_sk(struct sock *sk,
struct ip_port_proto *src_key) {
@ -1990,7 +1944,7 @@ static int __always_inline update_map_elem_by_sk(struct sock *sk) {
struct pid_pname val;
__builtin_memset(&val, 0, sizeof(struct pid_pname));
val.pid = bpf_get_current_pid_tgid() >> 32;
// struct task_struct *t = (void *)bpf_get_current_task();
// struct task_struct *t = (void *)bpf_get_current_task();
if ((ret = bpf_get_current_comm(val.pname, sizeof(val.pname)))) {
return ret;
}

View File

@ -49,7 +49,7 @@ group {
routing {
# See routing.md for full examples.
ip(1.1.1.1) && port(53) -> my_group
pname(firefox) && domain(ip.sb) -> direct
pname(firefox) && domain(ip.sb) -> direct # pname like firefox not works yet [ FIXME ]
pname(curl) && domain(ip.sb) -> my_group
ip(geoip:private) -> direct