diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 943737c..69b185f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,6 +26,7 @@ jobs: - uprobe - uretprobe - sock_ops + - socket_filter - sk_msg - xdp - classifier diff --git a/cargo-generate.toml b/cargo-generate.toml index d2b6b99..7601e04 100644 --- a/cargo-generate.toml +++ b/cargo-generate.toml @@ -13,6 +13,7 @@ choices = [ "uprobe", "uretprobe", "sock_ops", + "socket_filter", "sk_msg", "xdp", "classifier", diff --git a/{{project-name}}-ebpf/src/main.rs b/{{project-name}}-ebpf/src/main.rs index 154461b..637ed3a 100644 --- a/{{project-name}}-ebpf/src/main.rs +++ b/{{project-name}}-ebpf/src/main.rs @@ -274,6 +274,16 @@ unsafe fn try_{{tracepoint_name}}(ctx: BtfTracePointContext) -> Result info!(&ctx, "tracepoint {{tracepoint_name}} called"); Ok(0) } +{%- when "socket_filter" %} +use aya_bpf::{ + macros::socket_filter, + programs::SkBuffContext, +}; + +#[socket_filter(name="{{crate_name}}")] +pub fn {{crate_name}}(_ctx: SkBuffContext) -> i64 { + return 0 +} {%- endcase %} #[panic_handler] diff --git a/{{project-name}}/src/main.rs b/{{project-name}}/src/main.rs index ba8eae3..31155a3 100644 --- a/{{project-name}}/src/main.rs +++ b/{{project-name}}/src/main.rs @@ -27,6 +27,10 @@ use aya::programs::TracePoint; use aya::{programs::Lsm, Btf}; {%- when "tp_btf" -%} use aya::{programs::BtfTracePoint, Btf}; +{%- when "socket_filter" -%} +use std::net::TcpStream; +use std::os::unix::io::AsRawFd; +use aya::programs::SocketFilter; {%- endcase %} use aya_log::BpfLogger; use clap::Parser; @@ -136,6 +140,11 @@ async fn main() -> Result<(), anyhow::Error> { let program: &mut BtfTracePoint = bpf.program_mut("{{tracepoint_name}}").unwrap().try_into()?; program.load("{{tracepoint_name}}", &btf)?; program.attach()?; + {%- when "socket_filter" -%} + let client = TcpStream::connect("127.0.0.1:1234")?; + let prog: &mut SocketFilter = bpf.program_mut("{{crate_name}}").unwrap().try_into()?; + prog.load()?; + prog.attach(client.as_raw_fd())?; {%- endcase %} info!("Waiting for Ctrl-C...");