57 lines
1.2 KiB
C
57 lines
1.2 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
#include "vmlinux.h"
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <bpf/bpf_tracing.h>
|
|
#include <bpf/bpf_core_read.h>
|
|
#include "bpf_misc.h"
|
|
|
|
struct test_pro_bss {
|
|
struct sockaddr_in old;
|
|
__u32 test_pid;
|
|
};
|
|
|
|
struct test_pro_bss bss;
|
|
|
|
static int handle_sys_connect_common(struct sockaddr_in *uservaddr)
|
|
{
|
|
struct sockaddr_in new;
|
|
__u32 cur = bpf_get_current_pid_tgid() >> 32;
|
|
|
|
if (bss.test_pid && cur != bss.test_pid)
|
|
return 0;
|
|
|
|
bpf_probe_read_user(&bss.old, sizeof(bss.old), uservaddr);
|
|
__builtin_memset(&new, 0xab, sizeof(new));
|
|
bpf_probe_write_user(uservaddr, &new, sizeof(new));
|
|
|
|
return 0;
|
|
}
|
|
|
|
SEC("ksyscall/connect")
|
|
int BPF_KSYSCALL(handle_sys_connect, int fd, struct sockaddr_in *uservaddr,
|
|
int addrlen)
|
|
{
|
|
return handle_sys_connect_common(uservaddr);
|
|
}
|
|
|
|
#if defined(bpf_target_s390)
|
|
#ifndef SYS_CONNECT
|
|
#define SYS_CONNECT 3
|
|
#endif
|
|
|
|
SEC("ksyscall/socketcall")
|
|
int BPF_KSYSCALL(handle_sys_socketcall, int call, unsigned long *args)
|
|
{
|
|
if (call == SYS_CONNECT) {
|
|
struct sockaddr_in *uservaddr;
|
|
|
|
bpf_probe_read_user(&uservaddr, sizeof(uservaddr), &args[1]);
|
|
return handle_sys_connect_common(uservaddr);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
char _license[] SEC("license") = "GPL";
|