diff --git a/GPL/Events/Helpers.h b/GPL/Events/Helpers.h index 12f90a85..f4fb7cff 100644 --- a/GPL/Events/Helpers.h +++ b/GPL/Events/Helpers.h @@ -370,7 +370,7 @@ static int get_iovec_nr_segs_or_max(struct iov_iter *from) struct udp_ctx { // struct sock *sk; // struct msghdr *hdr; - struct sk_buf *skb; + struct sk_buff *skb; } __attribute__((packed)); // scratchspace map for fetching the arguments from a kretprobe diff --git a/GPL/Events/Network/Probe.bpf.c b/GPL/Events/Network/Probe.bpf.c index 18bc0bd6..d64e4e55 100644 --- a/GPL/Events/Network/Probe.bpf.c +++ b/GPL/Events/Network/Probe.bpf.c @@ -255,14 +255,14 @@ int BPF_PROG(fexit__skb_consume_udp, struct sock *sk, struct sk_buff *skb, int l } SEC("kprobe/ip_send_skb") -int BPF_KPROBE(kprobe__ip_send_skb, struct net *net, struct sk_buff *skb) +int BPF_KPROBE(kprobe__ip_send_udp, struct net *net, struct sk_buff *skb) { long len = BPF_CORE_READ(skb, len); return handle_consume(skb, len, EBPF_EVENT_NETWORK_UDP_SENDMSG); } SEC("kprobe/skb_consume_udp") -int BPF_KPROBE(kprobe__skb_consume_skb, struct net *net, struct sk_buff *skb) +int BPF_KPROBE(kprobe__skb_consume_udp, struct net *net, struct sk_buff *skb) { // return handle_consume(skb, len, EBPF_EVENT_NETWORK_UDP_SENDMSG); struct udp_ctx kctx; @@ -282,10 +282,12 @@ int BPF_KPROBE(kprobe__skb_consume_skb, struct net *net, struct sk_buff *skb) bpf_printk("error updating context map in udp_recvmsg: %d", update_err); return 0; } + + return 0; } SEC("kretprobe/skb_consume_udp") -int BPF_KRETPROBE(kretprobe__skb_consume_skb, int ret) +int BPF_KRETPROBE(kretprobe__skb_consume_udp, int ret) { u64 pid_tid = bpf_get_current_pid_tgid(); void *vctx = bpf_map_lookup_elem(&pkt_ctx, &pid_tid); @@ -294,6 +296,7 @@ int BPF_KRETPROBE(kretprobe__skb_consume_skb, int ret) long read_err = bpf_probe_read(&kctx, sizeof(kctx), vctx); if (read_err != 0) { bpf_printk("error reading back context in skb_consume_skb: %d", read_err); + return 0; } return handle_consume(kctx.skb, ret, EBPF_EVENT_NETWORK_UDP_RECVMSG); diff --git a/non-GPL/Events/Lib/EbpfEvents.c b/non-GPL/Events/Lib/EbpfEvents.c index 15c09b7a..0b20f2ee 100644 --- a/non-GPL/Events/Lib/EbpfEvents.c +++ b/non-GPL/Events/Lib/EbpfEvents.c @@ -386,9 +386,9 @@ static inline int probe_set_autoload(struct btf *btf, struct EventProbe_bpf *obj err = err ?: bpf_program__set_autoload(obj->progs.kretprobe__vfs_write, false); err = err ?: bpf_program__set_autoload(obj->progs.kprobe__chown_common, false); err = err ?: bpf_program__set_autoload(obj->progs.kretprobe__chown_common, false); - err = err ?: bpf_program__set_autoload(obj->progs.kprobe__ip_send_skb, false); - err = err ?: bpf_program__set_autoload(obj->progs.kprobe__skb_consume_skb, false); - err = err ?: bpf_program__set_autoload(obj->progs.kretprobe__skb_consume_skb, false); + err = err ?: bpf_program__set_autoload(obj->progs.kprobe__ip_send_udp, false); + err = err ?: bpf_program__set_autoload(obj->progs.kprobe__skb_consume_udp, false); + err = err ?: bpf_program__set_autoload(obj->progs.kretprobe__skb_consume_udp, false); } else { err = err ?: bpf_program__set_autoload(obj->progs.fentry__do_unlinkat, false); err = err ?: bpf_program__set_autoload(obj->progs.fentry__mnt_want_write, false);