From a060674d3ba1e28bd4fb294c7f9a870904685e86 Mon Sep 17 00:00:00 2001 From: Wangjunqi123 Date: Wed, 20 Nov 2024 13:35:11 +0800 Subject: [PATCH] agent/probes: define probe inet_csk_accept_exit --- agent/probes/network/src/tcp_netflow.bpf.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/agent/probes/network/src/tcp_netflow.bpf.c b/agent/probes/network/src/tcp_netflow.bpf.c index 8919ba6..7bc5c1a 100644 --- a/agent/probes/network/src/tcp_netflow.bpf.c +++ b/agent/probes/network/src/tcp_netflow.bpf.c @@ -171,4 +171,24 @@ int BPF_KPROBE(tcp_v4_connect, struct sock *sk, struct sockaddr *uaddr) { tcpmetrics.role = LINK_ROLE_CLIENT; bpf_map_update_elem(&tcp_link_map, &pid, &tcpmetrics, BPF_ANY); return 0; +} + +// 确认服务端socket +SEC("kprobe/inet_csk_accept") +int BPF_KRETPROBE(inet_csk_accept_exit, struct sock *ret) { + // ttcode + u8 comm[16], _comm[TARGET_NUM][16] = TARGET_PROC; + (void)bpf_get_current_comm(&comm, sizeof(comm)); + if (strcmp(comm, _comm[0]) == 1 && strcmp(comm, _comm[1]) == 1 && strcmp(comm, _comm[2]) == 1) { + return 0; + } + + u32 pid = bpf_get_current_pid_tgid() >> INT_LEN; + // ttcode + bpf_printk("(inet_csk_accept_exit) pid: %u", pid); + + struct tcp_metrics tcpmetrics = {0}; + tcpmetrics.role = LINK_ROLE_SERVER; + bpf_map_update_elem(&tcp_link_map, &pid, &tcpmetrics, BPF_ANY); + return 0; } \ No newline at end of file -- Gitee