still cleaning up test code

elastic · Sep 10, 2024 · 5477112 · 5477112
1 parent 40fa09a
commit 5477112
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 7 deletions.
diff --git a/GPL/Events/Helpers.h b/GPL/Events/Helpers.h
@@ -370,7 +370,7 @@ static int get_iovec_nr_segs_or_max(struct iov_iter *from)
 struct udp_ctx {
     // struct sock *sk;
     // struct msghdr *hdr;
-    struct sk_buf *skb;
+    struct sk_buff *skb;
 } __attribute__((packed));
 
 // scratchspace map for fetching the arguments from a kretprobe

diff --git a/GPL/Events/Network/Probe.bpf.c b/GPL/Events/Network/Probe.bpf.c
@@ -255,14 +255,14 @@ int BPF_PROG(fexit__skb_consume_udp, struct sock *sk, struct sk_buff *skb, int l
 }
 
 SEC("kprobe/ip_send_skb")
-int BPF_KPROBE(kprobe__ip_send_skb, struct net *net, struct sk_buff *skb)
+int BPF_KPROBE(kprobe__ip_send_udp, struct net *net, struct sk_buff *skb)
 {
     long len = BPF_CORE_READ(skb, len);
     return handle_consume(skb, len, EBPF_EVENT_NETWORK_UDP_SENDMSG);
 }
 
 SEC("kprobe/skb_consume_udp")
-int BPF_KPROBE(kprobe__skb_consume_skb, struct net *net, struct sk_buff *skb)
+int BPF_KPROBE(kprobe__skb_consume_udp, struct net *net, struct sk_buff *skb)
 {
     // return handle_consume(skb, len, EBPF_EVENT_NETWORK_UDP_SENDMSG);
     struct udp_ctx kctx;
@@ -282,10 +282,12 @@ int BPF_KPROBE(kprobe__skb_consume_skb, struct net *net, struct sk_buff *skb)
         bpf_printk("error updating context map in udp_recvmsg: %d", update_err);
         return 0;
     }
+
+    return 0;
 }
 
 SEC("kretprobe/skb_consume_udp")
-int BPF_KRETPROBE(kretprobe__skb_consume_skb, int ret)
+int BPF_KRETPROBE(kretprobe__skb_consume_udp, int ret)
 {
     u64 pid_tid = bpf_get_current_pid_tgid();
     void *vctx  = bpf_map_lookup_elem(&pkt_ctx, &pid_tid);
@@ -294,6 +296,7 @@ int BPF_KRETPROBE(kretprobe__skb_consume_skb, int ret)
     long read_err = bpf_probe_read(&kctx, sizeof(kctx), vctx);
     if (read_err != 0) {
         bpf_printk("error reading back context in skb_consume_skb: %d", read_err);
+        return 0;
     }
 
     return handle_consume(kctx.skb, ret, EBPF_EVENT_NETWORK_UDP_RECVMSG);

diff --git a/non-GPL/Events/Lib/EbpfEvents.c b/non-GPL/Events/Lib/EbpfEvents.c
@@ -386,9 +386,9 @@ static inline int probe_set_autoload(struct btf *btf, struct EventProbe_bpf *obj
         err = err ?: bpf_program__set_autoload(obj->progs.kretprobe__vfs_write, false);
         err = err ?: bpf_program__set_autoload(obj->progs.kprobe__chown_common, false);
         err = err ?: bpf_program__set_autoload(obj->progs.kretprobe__chown_common, false);
-        err = err ?: bpf_program__set_autoload(obj->progs.kprobe__ip_send_skb, false);
-        err = err ?: bpf_program__set_autoload(obj->progs.kprobe__skb_consume_skb, false);
-        err = err ?: bpf_program__set_autoload(obj->progs.kretprobe__skb_consume_skb, false);
+        err = err ?: bpf_program__set_autoload(obj->progs.kprobe__ip_send_udp, false);
+        err = err ?: bpf_program__set_autoload(obj->progs.kprobe__skb_consume_udp, false);
+        err = err ?: bpf_program__set_autoload(obj->progs.kretprobe__skb_consume_udp, false);
     } else {
         err = err ?: bpf_program__set_autoload(obj->progs.fentry__do_unlinkat, false);
         err = err ?: bpf_program__set_autoload(obj->progs.fentry__mnt_want_write, false);