.. | .. |
---|
8 | 8 | #include <linux/netdevice.h> |
---|
9 | 9 | #include <uapi/linux/bpf.h> |
---|
10 | 10 | #include <linux/version.h> |
---|
11 | | -#include "bpf_helpers.h" |
---|
| 11 | +#include <bpf/bpf_helpers.h> |
---|
| 12 | +#include <bpf/bpf_tracing.h> |
---|
| 13 | +#include <bpf/bpf_core_read.h> |
---|
| 14 | +#include "trace_common.h" |
---|
12 | 15 | |
---|
13 | | -struct bpf_map_def SEC("maps") dnat_map = { |
---|
14 | | - .type = BPF_MAP_TYPE_HASH, |
---|
15 | | - .key_size = sizeof(struct sockaddr_in), |
---|
16 | | - .value_size = sizeof(struct sockaddr_in), |
---|
17 | | - .max_entries = 256, |
---|
18 | | -}; |
---|
| 16 | +struct { |
---|
| 17 | + __uint(type, BPF_MAP_TYPE_HASH); |
---|
| 18 | + __type(key, struct sockaddr_in); |
---|
| 19 | + __type(value, struct sockaddr_in); |
---|
| 20 | + __uint(max_entries, 256); |
---|
| 21 | +} dnat_map SEC(".maps"); |
---|
19 | 22 | |
---|
20 | 23 | /* kprobe is NOT a stable ABI |
---|
21 | 24 | * kernel functions can be removed, renamed or completely change semantics. |
---|
.. | .. |
---|
25 | 28 | * This example sits on a syscall, and the syscall ABI is relatively stable |
---|
26 | 29 | * of course, across platforms, and over time, the ABI may change. |
---|
27 | 30 | */ |
---|
28 | | -SEC("kprobe/sys_connect") |
---|
| 31 | +SEC("kprobe/" SYSCALL(sys_connect)) |
---|
29 | 32 | int bpf_prog1(struct pt_regs *ctx) |
---|
30 | 33 | { |
---|
| 34 | + struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1_CORE(ctx); |
---|
| 35 | + void *sockaddr_arg = (void *)PT_REGS_PARM2_CORE(real_regs); |
---|
| 36 | + int sockaddr_len = (int)PT_REGS_PARM3_CORE(real_regs); |
---|
31 | 37 | struct sockaddr_in new_addr, orig_addr = {}; |
---|
32 | 38 | struct sockaddr_in *mapped_addr; |
---|
33 | | - void *sockaddr_arg = (void *)PT_REGS_PARM2(ctx); |
---|
34 | | - int sockaddr_len = (int)PT_REGS_PARM3(ctx); |
---|
35 | 39 | |
---|
36 | 40 | if (sockaddr_len > sizeof(orig_addr)) |
---|
37 | 41 | return 0; |
---|
38 | 42 | |
---|
39 | | - if (bpf_probe_read(&orig_addr, sizeof(orig_addr), sockaddr_arg) != 0) |
---|
| 43 | + if (bpf_probe_read_user(&orig_addr, sizeof(orig_addr), sockaddr_arg) != 0) |
---|
40 | 44 | return 0; |
---|
41 | 45 | |
---|
42 | 46 | mapped_addr = bpf_map_lookup_elem(&dnat_map, &orig_addr); |
---|