150 lines
4.3 KiB
C
150 lines
4.3 KiB
C
#define BPF_NO_GLOBAL_DATA
|
|
//#define __TARGET_ARCH_x86
|
|
#include "vmlinux.h"
|
|
#include <string.h>
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <bpf/bpf_tracing.h>
|
|
#include <bpf/bpf_core_read.h>
|
|
#include "common.h"
|
|
|
|
char LICENSE[] SEC("license") = "Dual BSD/GPL";
|
|
|
|
|
|
struct ctx_receive_reset {
|
|
__u16 common_type; // unsigned short
|
|
__u8 common_flags; // unsigned char
|
|
__u8 common_count; // unsigned char
|
|
__s32 pid; // int
|
|
|
|
const void *skaddr;
|
|
__u16 sport;
|
|
__u16 dport;
|
|
__u16 family;
|
|
__u8 saddr[4];
|
|
__u8 daddr[4];
|
|
__u8 saddr_v6[16];
|
|
__u8 daddr_v6[16];
|
|
__u64 sock_cookie;
|
|
};
|
|
struct ctx_send_reset {
|
|
__u16 common_type; // unsigned short
|
|
__u8 common_flags; // unsigned char
|
|
__u8 common_count; // unsigned char
|
|
__s32 pid; // int
|
|
|
|
const void *skbaddr;
|
|
const void *skaddr;
|
|
__s32 state; // int
|
|
__u16 sport;
|
|
__u16 dport;
|
|
__u8 saddr[4];
|
|
__u8 daddr[4];
|
|
__u8 saddr_v6[16];
|
|
__u8 daddr_v6[16];
|
|
};
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_ARRAY);
|
|
__uint(max_entries, 4096);
|
|
__type(key, 1);
|
|
__type(value, __s32);
|
|
} tcp_stats_index SEC(".maps");
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_ARRAY);
|
|
__uint(max_entries, 4096);
|
|
__type(key, 4);
|
|
__type(value, struct reset);
|
|
} tcp_reset_stats SEC(".maps");
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_ARRAY);
|
|
__uint(max_entries, 1);
|
|
__type(key, __s32);
|
|
__type(value, __u16);
|
|
} filter_family SEC(".maps");
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_ARRAY);
|
|
__uint(max_entries, 1);
|
|
__type(key, __s32);
|
|
__type(value, __u16);
|
|
} filter_sport SEC(".maps");
|
|
|
|
// sudo tcpdump -i any 'tcp[13] & 4 != 0' -n -> filter TCP reset flags
|
|
|
|
/*
|
|
* This project do not trace any sniffing ports, because, the tracepoint tcp:tcp_send_reset
|
|
* works only for an establish socket, but, if you have a lot of TCP RST, you can have
|
|
* an issue with your system
|
|
*/
|
|
|
|
/*
|
|
* Identify all tracepoint available
|
|
* - cat /sys/kernel/tracing/available_events
|
|
* Enable an event:
|
|
* - echo 'tcp_receive_reset' >> /sys/kernel/tracing/set_event -> important to add the '>>'
|
|
* Docs: https://docs.kernel.org/trace/events.html
|
|
* https://events.linuxfoundation.org/wp-content/uploads/2022/10/elena-zannoni-tracing-tutorial-LF-2021.pdf
|
|
* https://docs.kernel.org/trace/tracepoints.html
|
|
* Why we need to detect RST:
|
|
* When we scan the port, the scanner send an SYN flag and if the port is block, we receive a RST flag:
|
|
* listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
|
|
10:48:28.531295 lo In IP localhost.43961 > localhost.tproxy: Flags [S], seq 2197047013, win 1024, options [mss 1460], length 0
|
|
10:48:28.531306 lo In IP localhost.tproxy > localhost.43961: Flags [R.], seq 0, ack 2197047014, win 0, length 0
|
|
* But we can also block all receive RST: iptables -I INPUT -p tcp --dport <port> -j REJECT --reject-with tcp-reset
|
|
*/
|
|
|
|
//SEC("tp/tcp_retransmit_synack")
|
|
//SEC("tracepoint/tcp/tcp_receive_reset")
|
|
SEC("tracepoint/tcp/tcp_send_reset")
|
|
int tcp_retransmit(struct ctx_send_reset *ctx){
|
|
struct reset s_reset = {};
|
|
int *index;
|
|
int keys = 0;
|
|
struct sock *sk;
|
|
__u16 family;
|
|
__s16 *f_family;
|
|
__u16 proto;
|
|
int err;
|
|
|
|
memset(&s_reset, 0, sizeof(struct reset));
|
|
|
|
// Get filter
|
|
sk = (struct sock*)ctx->skaddr;
|
|
f_family = bpf_map_lookup_elem(&filter_family, &keys);
|
|
if (!f_family)
|
|
return 0;
|
|
|
|
index = bpf_map_lookup_elem(&tcp_stats_index, &keys);
|
|
if (!index)
|
|
return 0;
|
|
|
|
|
|
// Get the family of the socket
|
|
bpf_probe_read_kernel(&family, sizeof(family), &sk->__sk_common.skc_family);
|
|
if (family != *f_family)
|
|
return 0;
|
|
|
|
// Get and update the index in the map
|
|
*index += 1;
|
|
|
|
// Proto type: here it's 6 (TCP)
|
|
bpf_probe_read_kernel(&proto, sizeof(proto), &sk->sk_protocol);
|
|
|
|
memcpy(s_reset.saddr, ctx->saddr, 4);
|
|
memcpy(s_reset.daddr, ctx->daddr, 4);
|
|
|
|
//bpf_probe_read_kernel(&s_reset.saddr, 4, &ctx->saddr);
|
|
//bpf_probe_read_kernel(&s_reset.daddr, 4, &ctx->daddr);
|
|
|
|
s_reset.sport = ctx->sport;
|
|
s_reset.dport = ctx->dport;
|
|
s_reset.family = family;
|
|
s_reset.proto = proto;
|
|
|
|
bpf_printk("BPF detected TCP send reset %d %d", s_reset.sport, s_reset.dport);
|
|
bpf_map_update_elem(&tcp_reset_stats, &keys, &s_reset, BPF_ANY);
|
|
return 0;
|
|
}
|