1 // SPDX-License-Identifier: GPL-2.0
2 // Copyright (c) 2021 Yaqi Chen
3 #include <vmlinux.h>
4 #include <bpf/bpf_helpers.h>
5 #include <bpf/bpf_core_read.h>
6 #include <bpf/bpf_tracing.h>
7 #include <bpf/bpf_endian.h>
8 #include "tcpsynbl.h"
9 #include "bits.bpf.h"
10 #include "maps.bpf.h"
11
12 #define MAX_ENTRIES 65536
13
14 struct {
15 __uint(type, BPF_MAP_TYPE_HASH);
16 __uint(max_entries, MAX_ENTRIES);
17 __type(key, u64);
18 __type(value, struct hist);
19 } hists SEC(".maps");
20
21 static struct hist zero;
22
do_entry(struct sock * sk)23 static int do_entry(struct sock *sk)
24 {
25 u64 max_backlog, backlog, slot;
26 struct hist *histp;
27
28 max_backlog = BPF_CORE_READ(sk, sk_max_ack_backlog);
29 backlog = BPF_CORE_READ(sk, sk_ack_backlog);
30 histp = bpf_map_lookup_or_try_init(&hists, &max_backlog, &zero);
31 if (!histp)
32 return 0;
33
34 slot = log2l(backlog);
35 if (slot >= MAX_SLOTS)
36 slot = MAX_SLOTS - 1;
37 __sync_fetch_and_add(&histp->slots[slot], 1);
38 return 0;
39 }
40
41
42 SEC("kprobe/tcp_v4_syn_recv_sock")
BPF_KPROBE(tcp_v4_syn_recv_kprobe,struct sock * sk)43 int BPF_KPROBE(tcp_v4_syn_recv_kprobe, struct sock *sk)
44 {
45 return do_entry(sk);
46 }
47
48 SEC("kprobe/tcp_v6_syn_recv_sock")
BPF_KPROBE(tcp_v6_syn_recv_kprobe,struct sock * sk)49 int BPF_KPROBE(tcp_v6_syn_recv_kprobe, struct sock *sk)
50 {
51 return do_entry(sk);
52 }
53
54 SEC("fentry/tcp_v4_syn_recv_sock")
BPF_PROG(tcp_v4_syn_recv,struct sock * sk)55 int BPF_PROG(tcp_v4_syn_recv, struct sock *sk)
56 {
57 return do_entry(sk);
58 }
59
60 SEC("fentry/tcp_v6_syn_recv_sock")
BPF_PROG(tcp_v6_syn_recv,struct sock * sk)61 int BPF_PROG(tcp_v6_syn_recv, struct sock *sk)
62 {
63 return do_entry(sk);
64 }
65
66 char LICENSE[] SEC("license") = "Dual BSD/GPL";
67