mirrors/opensnitch
1
0
Fork 0
mirror of https://github.com/evilsocket/opensnitch.git synced 2025-03-04 08:34:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

added script to dump ebpf maps

Browse source
This commit is contained in:
Gustavo Iñiguez Goia 2023-04-24 17:55:05 +02:00
parent cbdb00b620
commit 2341b69fe7
Failed to generate hash of commit
1 changed files with 94 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

94
utils/scripts/debug-ebpf-maps.sh Normal file
View file

@ -0,0 +1,94 @@
#!/bin/sh
#
# OpenSnitch - 2023
# https://github.com/evilsocket/opensnitch
#
# Usage: bash debug-ebpf-maps.sh tcp (or tcpv6, udp, udpv6)
#
function print_map_proto
{
case "$1" in
12001)
echo "------------------------------ TCP ------------------------------"
;;
12002)
echo "------------------------------ TCPv6 ------------------------------"
;;
12003)
echo "------------------------------ UDP ------------------------------"
;;
12004)
echo "------------------------------ UDPv6 ------------------------------"
;;
esac
}
function dump_map
{
echo
print_map_proto $mid
bpftool map dump id $1 |awk '
BEGIN { total=0; }
{
split($0, line);
if (line[1] == "key:"){
is_key=1;
total++;
} else if (is_key == 1){
sport=strtonum("0x" line[2] line[1]);
dport=strtonum("0x" line[7] line[8]);
printf("%d:%d.%d.%d.%d -> %d.%d.%d.%d:%d\n",
sport,
strtonum("0x" line[3]),
strtonum("0x" line[4]),
strtonum("0x" line[5]),
strtonum("0x" line[6]),
strtonum("0x" line[9]),
strtonum("0x" line[10]),
strtonum("0x" line[11]),
strtonum("0x" line[12]),
dport);
is_key=0;
}
}
END { printf("Total: %d\n", total); }'
print_map_proto $mid
}
if [ -z $1 ]; then
echo
echo " Usage: bash debug-ebpf-maps.sh <proto> (tcp, tcpv6, udp or udpv6)"
echo
exit
fi
if ! command -v bpftool; then
echo
echo " [error] bpftool not found. Install it."
echo
exit
fi
mid=0
case "$1" in
tcp)
mid=$(bpftool map list | grep -B 1 12001 | grep hash | cut -d: -f1)
;;
tcpv6)
mid=$(bpftool map list | grep -B 1 12002 | grep hash | cut -d: -f1)
;;
udp)
mid=$(bpftool map list | grep -B 1 12003 | grep hash | cut -d: -f1)
;;
udpv6)
mid=$(bpftool map list | grep -B 1 12004 | grep hash | cut -d: -f1)
;;
esac
if [ $mid -eq 0 ]; then
echo
echo " [error] Invalid protocol ($1)"
echo
exit
fi
dump_map $mid