1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2020 Facebook */
5 #include <bpf/bpf_tracing.h>
6 #include <bpf/bpf_core_read.h>
7 #include <bpf/bpf_helpers.h>
11 __u32 last_notclose_state;
16 __uint(type, BPF_MAP_TYPE_SK_STORAGE);
17 __uint(map_flags, BPF_F_NO_PREALLOC);
19 __type(value, struct sk_stg);
20 } sk_stg_map SEC(".maps");
24 __uint(type, BPF_MAP_TYPE_SK_STORAGE);
25 __uint(map_flags, BPF_F_NO_PREALLOC);
28 } del_sk_stg_map SEC(".maps");
30 char task_comm[16] = "";
32 SEC("tp_btf/inet_sock_set_state")
33 int BPF_PROG(trace_inet_sock_set_state, struct sock *sk, int oldstate,
38 if (newstate == BPF_TCP_CLOSE)
41 stg = bpf_sk_storage_get(&sk_stg_map, sk, 0,
42 BPF_SK_STORAGE_GET_F_CREATE);
46 stg->last_notclose_state = newstate;
48 bpf_sk_storage_delete(&del_sk_stg_map, sk);
53 static void set_task_info(struct sock *sk)
55 struct task_struct *task;
58 stg = bpf_sk_storage_get(&sk_stg_map, sk, 0,
59 BPF_SK_STORAGE_GET_F_CREATE);
63 stg->pid = bpf_get_current_pid_tgid();
65 task = (struct task_struct *)bpf_get_current_task();
66 bpf_core_read_str(&stg->comm, sizeof(stg->comm), &task->comm);
67 bpf_core_read_str(&task_comm, sizeof(task_comm), &task->comm);
70 SEC("fentry/inet_csk_listen_start")
71 int BPF_PROG(trace_inet_csk_listen_start, struct sock *sk)
78 SEC("fentry/tcp_connect")
79 int BPF_PROG(trace_tcp_connect, struct sock *sk)
86 SEC("fexit/inet_csk_accept")
87 int BPF_PROG(inet_csk_accept, struct sock *sk, int flags, int *err, bool kern,
88 struct sock *accepted_sk)
90 set_task_info(accepted_sk);
95 SEC("tp_btf/tcp_retransmit_synack")
96 int BPF_PROG(tcp_retransmit_synack, struct sock* sk, struct request_sock* req)
99 bpf_sk_storage_get(&sk_stg_map, sk, 0, 0);
100 bpf_sk_storage_get(&sk_stg_map, req->sk, 0, 0);
104 SEC("tp_btf/tcp_bad_csum")
105 int BPF_PROG(tcp_bad_csum, struct sk_buff* skb)
107 bpf_sk_storage_get(&sk_stg_map, skb->sk, 0, 0);
111 char _license[] SEC("license") = "GPL";