From 157577613a4d68e1387e4d7bdd14e1ae59be518d Mon Sep 17 00:00:00 2001 From: geoffrey Date: Mon, 20 Jan 2025 09:02:18 +0100 Subject: [PATCH] Update --- src/dns-trace.ebpf.c | 25 ++++++++++++++++++++----- src/dns-trace.ebpf.o | Bin 32368 -> 32568 bytes 2 files changed, 20 insertions(+), 5 deletions(-) diff --git a/src/dns-trace.ebpf.c b/src/dns-trace.ebpf.c index 037a62e..539bb70 100644 --- a/src/dns-trace.ebpf.c +++ b/src/dns-trace.ebpf.c @@ -216,7 +216,7 @@ static int dnsanswer(struct __sk_buff *skb, struct ethhdr eth, struct iphdr ip, uint16_t tid = 0; //struct dns_answer s_dnsanswer; //struct query_section s_query = {0}; - unsigned char buf[256] = {0}; + unsigned char buf[256] = {0}; // Max dns domain name length uint32_t offset = sizeof(struct ethhdr) + sizeof(struct iphdr) + sizeof(struct udphdr); __be16 udplen; // uint32_t offset2 = sizeof(struct ethhdr) + sizeof(struct iphdr); @@ -232,10 +232,14 @@ static int dnsanswer(struct __sk_buff *skb, struct ethhdr eth, struct iphdr ip, /* Get DNS header */ //bpf_skb_load_bytes(skb, offset, &dns, sizeof(struct dnshdr)); - if (udplen <= 0 || udplen > 256 || udplen < sizeof(struct dnshdr)) + if (udplen < 0) + return 0; + + if (udplen > 256 || udplen < sizeof(struct dnshdr)) udplen = sizeof(struct dnshdr); //return 0; + //if (udplen == offset || udplen < offset) // udplen = sizeof(struct dnshdr); @@ -245,6 +249,7 @@ static int dnsanswer(struct __sk_buff *skb, struct ethhdr eth, struct iphdr ip, //if (udplen > offset) // Works // return 0; if (udplen >= offset && udplen <= skb->len){ + } bpf_printk("ok"); if (udplen < offset) @@ -252,6 +257,10 @@ static int dnsanswer(struct __sk_buff *skb, struct ethhdr eth, struct iphdr ip, udplen = sizeof(struct dnshdr); //return 0; + if (udplen > offset) + udplen = sizeof(struct dnshdr); + + //__u32 plen = bpf_ntohs(udp.len) - 8; uint32_t plen = udplen & 0xff; bpf_printk("ok"); @@ -264,12 +273,12 @@ static int dnsanswer(struct __sk_buff *skb, struct ethhdr eth, struct iphdr ip, bpf_printk("%d %d %d", offset, udplen, udplen - 8); // bpf_printk("%d", offset + ntohs(udp.len) - 8); // -> we have 99 - if (offset + ntohs(udp.len) > skb->len) { + if (offset + udplen > skb->len) { bpf_printk("outbound"); //return 0; plen = sizeof(struct dnshdr); } - + // plen = 57; if(bpf_skb_load_bytes(skb, offset, &buf, plen) < 0){ bpf_printk("failed"); // bpf_ringbuf_discard(s_event, 0); @@ -333,11 +342,16 @@ static int dnsanswer(struct __sk_buff *skb, struct ethhdr eth, struct iphdr ip, return 0; } + +/* + * skb -> http://oldvger.kernel.org/~davem/skb_data.html + */ + SEC("socket") int detect_dns(struct __sk_buff *skb) { //void *data = (void *)(long)skb->data; //void *data_end = (void *)(long)skb->data_end; - //struct ethhdr *eth = data; + //struct ethhdr *eth2 = data; struct ethhdr eth = {0}; struct iphdr ip = {0}; struct udphdr udp = {0}; @@ -347,6 +361,7 @@ int detect_dns(struct __sk_buff *skb) { //if (data + sizeof(struct ethhdr) + sizeof(struct iphdr) + sizeof(struct udphdr) > data_end) // return 0; + if (skb->len < sizeof(struct ethhdr) + sizeof(struct iphdr) + sizeof(struct udphdr)) return 0; diff --git a/src/dns-trace.ebpf.o b/src/dns-trace.ebpf.o index acaba9441435510d4c20f35225ea16fcf4a9c4fc..0b7373e6957620619d1931e99a75f6ab7efd20ff 100644 GIT binary patch delta 8416 zcmb7}e{>Yp702J(*%@{=zjhM{`GI6Yeuw;6h{Py?#MnweD1oX(en`Lou|$$e0)YfJ zYO&Bmb>pKRPHan5=%KCWxEhpLt%-#mqosAV+R~%eZL2n(ipHa@v=!*RGj}$Vr~J`( zPWJmg_uhBkkD2#ob~FA3AG*jxg|4byeZ}p(r|+Q}-qH7F4Q~~hywZQX?Zxk;*_f<_yY`M!+oZ(n|LW_^B6m+Tio5>bO~$S z{f(pzr1hk=q*bH=(n3;$G>z0p>ajG~&&Y7z9C&yCIO!N^l=LiVgmjd2gmj2BOnRJj zfb=kFh;+ZH8QuN8WauJoClwj)^2Hv;d@%pvhpqLP0t?x4>C&Z>Qy7Z}(@B@5!}nPJ zeIOeAZSVhfkzU-;{#$P{qR8%|1wrC4ggv0;UG4_KKNF86qd~o4R2KiC|)7 zQGi<8Srq1$%(58K!oUP8k4%iis>OovYR|N(Jl`IP6^>H(5VZ>}B}=zwa9ot7 zOxKUo<`iB&lL#}Bpd3S4~w6K~@` zgIy1pW@0n{n}vA3GQNpF0&^@}ivWdh=IJoe!h0>W*_zH4%lA0=QqABN(@^xXxpL6> zK5=eVJs%a7Ik~(_tjQ_nE5yAyxy{Gij19pYitmETDXgr4%I~mJ36(!VrR-h&_!vG) zFT&{mgOzW?Zd2jn&B+65fQ9C3{KapAcMfpz(@?2~%Irl*4~WFv)WUO+Z98D8ADZsP z%3`P-fC`kNQ?SInm?k8a=3bYQ2?-X!y;gb(VisfN1Mx_1D{mA@d8sp_bP6;;%Mzt8 z;yR1BWgrT3EsfX2b$P|BtLQWxA{`;MPgi^QH_+B@Bn^`ekw$1woFxs!i#Z9Y8NHWD zADv>lFPFW`W4gO8)7hxyw)d{wcQnpyeK~i#>BciX***gun-E4VF60N&YvD3rX(DYQ z?Gg_!pC)D(c>RaTGC&$ePYG;4xD;4Iq(h`5q#n8|J`IPNez~xS;I~Yh!C2%=&8+kR zvw4PnLX6P~F-{7P9>_kpuJ9)+zkbkN*5*!5w~qHj+-7hKvFrq~Z|$!OiQZA(Xsc_Dvl{%z)B)`?ijXx$8R&)3?B&pnN0HwR!V= z(R$60W|;=(&VR$LJ_h}di1^x^;BIqdjC~4&EywNJqna;R$oSfma!_T3U`EE1E*Vy~ zmiT`3A5vL8@ngV=Csgw}hw;cda0~fW*jMUlm4%4w6c%I&qbfU0hE))tpHbOy;!bSv zuF4|Br-75lRd$y69gIJ(vN7V%G2W*!A9RibSPv_nkfyOT2kXEFai=>E0!lPiNQOh$ zpipB0;wOOhD>bq5+UNb%8jHY$Fz->g*%GQnc3lR)Agb%Kf)~J`{!n3fe`7!{tgm`r zG4FF^yWsuq^mjSA(9Q7fcgEu`h{c0HOgta*rw%D>%;F&14hH=ToW9lIAhOTRe8k6q zXXLsWzNcWqQQ+(nH!F0o4vgCj{pY~1R=dsZhMejFhS}k^bNX@neaeFq0l2X+pb{H= z&CPIMIvc>%ndA=;Z-aPWgPYYm*Z^*Dunycvd4lp`9}xpEk&~;8%xW6+w~PK;uutWpc0z-0p?zj{yh4kqLYCFa?|d&3Ox+@WgL} z#*adW4o(FgC$^W=1CM39L+rrkU>tx!%s>;P@KO?#0s;=k1XaX-(5WB7D}#eo;1&m8 z0gSJfIDmPexvz89>)`poAqT6#L45nf2Kzw+Z*dlOa1HQ?gH_-tG3wNKg^d$`f$UM( zdEzv9?xgw@<^je0$WwuR#MgmNo2mqv;V`63RahZ$E2vtcm|q1kfn93J9|Gk|HP%2J z2irI4pqt?vGsZ6k)!5LG zV4D*E8&r+B*_h-Xm;4N#qc}iwg034?adJ_%ZhzH!aqusTR`Z+x?BZ&QcdnYeKuuYo zCKjr?R;GwOhN^1HCoV%xxJA{oHRb!3<=H05r~@*M?YRzoWgEiX&eb2R1C z9?`eB&ieuH0GpwF(j(qpJUyr>)2mem4fiflRplZ#G$ps&*$3e1;4JV{2NcEJA5QznCMZkH)7$CTK@IT!c9vCS4@mY!WUm!-)=uXEv3Tu^ zF8G?7ysj?$S!mxt;TVN%4-Z%IDbcyEoDYd(>$3Qu_%(b!Bi>tA!=Dv-w=U<;4R+r8 zN<28ezBP-V5Sz9xhtH?X`Wsuzp{}-O1)qjAPf{0{@&x>iNF0^;BZ)tkShe18&6nXp z$Tvgc3S#Il$Z!C469$tPIT#1D!oe8dEOD!YF}_pcy%K*n#_-(22K_OE#g9rHb}$ZL z$idkD1&Lpg_HgP9mp=ohQ#<4$L`-8K&=$eAaRq#?GpD&9FllI;xN27*#opzKnjRR9F=%nVg}#N z>|(Bf#D>HH*F^u;3P=GB5;sZQE^)8KA&Cbh4hJQ}h{O?zqY{rx3=gVUF;_rhL*igS zGSo`kAaRq#?GpD&9FlloG6z|BvVo0A9FaIG@wmjyvCqvFkl2{SaQy?549xrnZ?7RH zXpsC(61Pj-D{)BT0Vm`A7j_zeMOmI3)3a&3OGWVc0ehk4PMmI4beD#0-8?u#33@5*x(WzqJBVK&`|L z5;sYVKbqJDJM5J>B=La7X8+a-NC6`fM1RTIhdN$bn3;qm$ zmOsZ?S@Wiiom%7mWjUI zSMh4`5_onAy}QQcxm7IbUI<|ax@-7h@ltnG+^bxTyXqBRt4GyYLms!p_aT&=C!Y9)?11gfOxym#Jma~e+%>Piy3@L!IQNY7^JCLTR6&F z2gOZ1?Y+u^?t@~DtKAr2te>&9#>3*ID{My5jlKLMOR%*($l2wL9kU8B*6nYbKufp3 zm1Hx?2+2m0SC9;m43Z3xEFtM5>9wWlXQUXn8s6<6Bbg?dA~{MjNpghbFv$eTILSeh zF_MQ!MoAv9q`%wWPl_&*og{_dU1w%7=EL!M)E=KK7?<{miHTzdV>zHY=Cb9>yKMVD z5FYrwe7nu)e+K+pKu$nMt2k$8(7xBUR~cWj8pt~1y~}@_H5|vhjP2acm}~n%@tS*1 zp=!6)^ID)87#7_z%v6Kh;efGuTesTP%r8la?fReiKC#GCSA37HblRE)eXJSU=h>H4 zorEkV&TdRo){Aj$Rgki+VqxA7jB&?7Jejv-rkBWxps|9>4`*VC|K-({sV;IQ5YaE% z@|RrpO{Z2T%BUgAi%La<&ztLW+l|thaJPsL^8GbVITs5ZcG{Vs_M*Ja&o+;81*AX5+~*x(a09b zmK#anvl{6XkBF;^%I7*A=%-%gu`X8VE3XO#X8HoND-JvQ1LD4-x!Ka-zgSdev{KK~ zIQer1iQ**Xxo~vpoS};1K39Gkd|>l4)(Afy8~W|Eyll?IOM!~qa$W=5eKs0-KztG? zz3E&oHg1Nk;#?*V$Fsz-WlgeqxsYr*lc7ij58)VJ&3^@A4(2fd zAJrJEb`69qT+5$=9Sc}u;f?$sHsWE&cng0FR#k8#0wmtbOQEm9{WdymcW0e#dj@RN zEa&x>V(x3!=s;mp1S=!_IdOaCZ0-{eRo3tZaiVgz`2g&h1oWY12V_oSCIXqiV5Sl> z??7h3NBB4mkNKZK>(66mGwdiG`nj+Qs2K*DZz!l40qa8Gn#Uot3^MapAelgGkT$`i zRvSpNcF4?s7sBtV#M}kQ^f-HvxI6n?P*J9>v z@%PysB_TZMAw}Sav0bm>Dy>V1tyMEz=XB9mRkO}V$6}P^A(GB9>7~sZBpD)kfMk^9 zAnl4cNw45@rkA!}B6>nB1nZ?@H;b)cZN5ZJG0W=gX|>*jI00oZWsQi>=ad&XM_p#C zVOzx&)uGZZ7;Q{(l1Y-IVs-WO(r;+Vnnvr~ARVM#Bx588Nsf^m7Zt(jrI+$bSk{DE zhPXt04()JGfnhoYMo5lgKZXtkf35Sfq40v8?!wcyB@cHQtQU4RM+`5TRrNKf0rRn| z)%bvfebIBRtTkyxLs^Ue?GbtPwMDmX3j}xH+}Ux}=nKo(sTr?$FP#e9Nuh55Z#M_Qp!H%Zkm|7f^E@ZoR8@>*j*o z0$lW6odrRSdVjXsben4kY;wFumEcbq$ z9U?^wI2ci#4HECh0x(nf_QDEY0WN%2XQRaLqyLLKOB0_(|2Lrn;EVoSVEA(1(^-kc z25^9Qx4Q})U!Ww8{@h-cGVwh;ewWg4q@CQu!VDhQ^YR;7j5|_ys%C&z(c?lUN`eeYyby|k7EN$+zh77^8X0A%*}Am zV0p(5Gcw7ZAa;AfKj3D#r@r9k#RB7sLkWxw23!UOe6?;CkT?h&l-K~qBNP2^1Aimr zX8pu4?N&NKd=Tv3tKDo6*@Oa)B0&x(F+c=H0D6W2KR}MTScKRKh$kf4Ih>pN5f{UA z7}-g99?SLwaV_{8u}S+Bjm6K9pWyA2e}*&4_)MLtZ>-H@L-qic)-hcJcg0~ zi2kp*7#{qxKfD0UNe+1SqQlovAo~boctXns@C|`H4PHiif-$@-AzuTW^9o~WiFIJS zXQBNjkTYO^b`l>1S@|Ag(QKH1bQl6f&InXU4#?AhM~IyvO%Y>-SV3B1Y`{42+aU8& zPzv61+oFOhD-UgEUJPhBoR*ztN=C`{U-fEFo0UI4|)<)b8(ulel zO0=V#1KcU`T;MK=ji?FxloZyghqEns$4fJJ=)#9qF`lH_PhKJ z&;_*qUa@KAbW@+|Y19oZyVaxpq|b_fjt6?Qu9ZREr|n(f(e{JZ(9ZLKm4iy}hS(5T zyI@zf-vv(Rd!ruhURR){qV9*Ybl>%Q5Nb989&kU?d$;a|hPjq`R%)lAjN#E9a0NWt zXIMs@TX{a~9&Lf1uRSErUsvXR3p}QHw5P<(Rl%Xis$`zAA7&E24I`pr!*sJ54kS5+ z$(mO5)ufNYu98zZ>2X`jDc`9@(N9=TnsshKwkA`ij|$*0{AEb5S*zgZ9I5>Dt%jvWQn%`Q=vSAMu@QOz_PUj`!4S0It zK3ycf+W4#szS)m%YN~hvN;oy4KeE#x?C!H->gGCrOkA_MoF5gpz%wECZ4UDn#H*Wc z;KzriZh1Wi4FB9-&WD8FaRWTpc3^&YM;$z$=qNXzgD^*_GZ=CRez>hLIh<1XGlkD8 zOczk=u6h*Wl-U>33@;{z_$I>!G+k6!yh37Z&}xa%|7L|dBu4+;3il~|Z-(Keg9Uz( zQP}*r!f}bQ0SSq*{0W6$SNLBFpLQ7Pw;C|+D2Tmzkb#6#fE5-k4b&iYXV}&m$0W|Bo=i(wgBJFJ4 zCvl071CK}y_Z3zPKU{xS!U`MhY=)Z^Zd15Z;eLgq3da&5Y)U3L=bB} z9IO#gxJ}_sh5HqbDjd7Wrq#muMTLD1D4bL{rSO=-nM;y00?wt0IFMl&e`^FX3Y!}h zZdSNW;ZBA76^<$#a~S6z8xVIC#KQ_F6;3HUrZAK4p%~w%aDW)=w?{y6XjE9f?_UNq{q_hb4$fy8UQnKgUkN%w!XqCWu!hclhkwr#`~`ko9KQ4Gf<@nE ztD2fZTNaXBES~5puUL4wtzG;rTP|8mUL+Tb|8^}A^Y-3ir1oGYgy) zBnEoI#_9QXWVd*yXQ?Z_LlpKl7+-{K<*-=SyVNMzX;V}@+`H73SRqdJHn;}&h{C=G vBelY|y(-rAEp?6T5fAh=xJLJgQ+*A=!Ru^WtiYByFnG~{Kjc`+8NmMo-7!dL