mirror of
https://github.com/evilsocket/opensnitch.git
synced 2025-03-04 08:34:40 +01:00
9497cf8394
* Use ebpf program to find PID of new connections.
before running the branch you have to compile ebpf_prog/opensnitch.c
opensnitch.c is an eBPF program. Compilation requires getting kernel source.
cd opensnitch
wget https://github.com/torvalds/linux/archive/v5.8.tar.gz
tar -xf v5.8.tar.gz
patch linux-5.8/tools/lib/bpf/bpf_helpers.h < ebpf_prog/file.patch
cp ebpf_prog/opensnitch.c ebpf_prog/Makefile linux-5.8/samples/bpf
cd linux-5.8 && yes "" | make oldconfig && make prepare && make headers_install # (1 min)
cd samples/bpf && make
objdump -h opensnitch.o #you should see many section, number 1 should be called kprobe/tcp_v4_connect
llvm-strip -g opensnitch.o #remove debug info
sudo cp opensnitch.o /etc/opensnitchd
cd ../../../daemon
--opensnitchd expects to find opensnitch.o in /etc/opensnitchd/
--start opensnitchd with:
opensnitchd -rules-path /etc/opensnitchd/rules -process-monitor-method ebpf
Co-authored-by: themighty1 <you@example.com>
Co-authored-by: Gustavo Iñiguez Goia <gooffy1@gmail.com>
159 lines
5.2 KiB
Makefile
159 lines
5.2 KiB
Makefile
#taken from /samples/bpf/Makefile and removed all targets
|
|
|
|
# SPDX-License-Identifier: GPL-2.0
|
|
|
|
BPF_SAMPLES_PATH ?= $(abspath $(srctree)/$(src))
|
|
TOOLS_PATH := $(BPF_SAMPLES_PATH)/../../tools
|
|
|
|
# Libbpf dependencies
|
|
LIBBPF = $(TOOLS_PATH)/lib/bpf/libbpf.a
|
|
|
|
CGROUP_HELPERS := ../../tools/testing/selftests/bpf/cgroup_helpers.o
|
|
TRACE_HELPERS := ../../tools/testing/selftests/bpf/trace_helpers.o
|
|
|
|
always-y += opensnitch.o
|
|
|
|
ifeq ($(ARCH), arm)
|
|
# Strip all except -D__LINUX_ARM_ARCH__ option needed to handle linux
|
|
# headers when arm instruction set identification is requested.
|
|
ARM_ARCH_SELECTOR := $(filter -D__LINUX_ARM_ARCH__%, $(KBUILD_CFLAGS))
|
|
BPF_EXTRA_CFLAGS := $(ARM_ARCH_SELECTOR)
|
|
TPROGS_CFLAGS += $(ARM_ARCH_SELECTOR)
|
|
endif
|
|
|
|
TPROGS_CFLAGS += -Wall -O2
|
|
TPROGS_CFLAGS += -Wmissing-prototypes
|
|
TPROGS_CFLAGS += -Wstrict-prototypes
|
|
|
|
TPROGS_CFLAGS += -I$(objtree)/usr/include
|
|
TPROGS_CFLAGS += -I$(srctree)/tools/testing/selftests/bpf/
|
|
TPROGS_CFLAGS += -I$(srctree)/tools/lib/
|
|
TPROGS_CFLAGS += -I$(srctree)/tools/include
|
|
TPROGS_CFLAGS += -I$(srctree)/tools/perf
|
|
TPROGS_CFLAGS += -DHAVE_ATTR_TEST=0
|
|
|
|
ifdef SYSROOT
|
|
TPROGS_CFLAGS += --sysroot=$(SYSROOT)
|
|
TPROGS_LDFLAGS := -L$(SYSROOT)/usr/lib
|
|
endif
|
|
|
|
TPROGCFLAGS_bpf_load.o += -Wno-unused-variable
|
|
|
|
TPROGS_LDLIBS += $(LIBBPF) -lelf -lz
|
|
TPROGLDLIBS_tracex4 += -lrt
|
|
TPROGLDLIBS_trace_output += -lrt
|
|
TPROGLDLIBS_map_perf_test += -lrt
|
|
TPROGLDLIBS_test_overhead += -lrt
|
|
TPROGLDLIBS_xdpsock += -pthread
|
|
|
|
# Allows pointing LLC/CLANG to a LLVM backend with bpf support, redefine on cmdline:
|
|
# make M=samples/bpf/ LLC=~/git/llvm/build/bin/llc CLANG=~/git/llvm/build/bin/clang
|
|
LLC ?= llc
|
|
CLANG ?= clang
|
|
LLVM_OBJCOPY ?= llvm-objcopy
|
|
BTF_PAHOLE ?= pahole
|
|
|
|
# Detect that we're cross compiling and use the cross compiler
|
|
ifdef CROSS_COMPILE
|
|
CLANG_ARCH_ARGS = --target=$(notdir $(CROSS_COMPILE:%-=%))
|
|
endif
|
|
|
|
# Don't evaluate probes and warnings if we need to run make recursively
|
|
ifneq ($(src),)
|
|
HDR_PROBE := $(shell printf "\#include <linux/types.h>\n struct list_head { int a; }; int main() { return 0; }" | \
|
|
$(CC) $(TPROGS_CFLAGS) $(TPROGS_LDFLAGS) -x c - \
|
|
-o /dev/null 2>/dev/null && echo okay)
|
|
|
|
ifeq ($(HDR_PROBE),)
|
|
$(warning WARNING: Detected possible issues with include path.)
|
|
$(warning WARNING: Please install kernel headers locally (make headers_install).)
|
|
endif
|
|
|
|
BTF_LLC_PROBE := $(shell $(LLC) -march=bpf -mattr=help 2>&1 | grep dwarfris)
|
|
BTF_PAHOLE_PROBE := $(shell $(BTF_PAHOLE) --help 2>&1 | grep BTF)
|
|
BTF_OBJCOPY_PROBE := $(shell $(LLVM_OBJCOPY) --help 2>&1 | grep -i 'usage.*llvm')
|
|
BTF_LLVM_PROBE := $(shell echo "int main() { return 0; }" | \
|
|
$(CLANG) -target bpf -O2 -g -c -x c - -o ./llvm_btf_verify.o; \
|
|
readelf -S ./llvm_btf_verify.o | grep BTF; \
|
|
/bin/rm -f ./llvm_btf_verify.o)
|
|
|
|
BPF_EXTRA_CFLAGS += -fno-stack-protector
|
|
ifneq ($(BTF_LLVM_PROBE),)
|
|
BPF_EXTRA_CFLAGS += -g
|
|
else
|
|
ifneq ($(and $(BTF_LLC_PROBE),$(BTF_PAHOLE_PROBE),$(BTF_OBJCOPY_PROBE)),)
|
|
BPF_EXTRA_CFLAGS += -g
|
|
LLC_FLAGS += -mattr=dwarfris
|
|
DWARF2BTF = y
|
|
endif
|
|
endif
|
|
endif
|
|
|
|
# Trick to allow make to be run from this directory
|
|
all:
|
|
$(MAKE) -C ../../ M=$(CURDIR) BPF_SAMPLES_PATH=$(CURDIR)
|
|
|
|
clean:
|
|
$(MAKE) -C ../../ M=$(CURDIR) clean
|
|
@find $(CURDIR) -type f -name '*~' -delete
|
|
|
|
$(LIBBPF): FORCE
|
|
# Fix up variables inherited from Kbuild that tools/ build system won't like
|
|
$(MAKE) -C $(dir $@) RM='rm -rf' EXTRA_CFLAGS="$(TPROGS_CFLAGS)" \
|
|
LDFLAGS=$(TPROGS_LDFLAGS) srctree=$(BPF_SAMPLES_PATH)/../../ O=
|
|
|
|
$(obj)/syscall_nrs.h: $(obj)/syscall_nrs.s FORCE
|
|
$(call filechk,offsets,__SYSCALL_NRS_H__)
|
|
|
|
targets += syscall_nrs.s
|
|
clean-files += syscall_nrs.h
|
|
|
|
FORCE:
|
|
|
|
|
|
# Verify LLVM compiler tools are available and bpf target is supported by llc
|
|
.PHONY: verify_cmds verify_target_bpf $(CLANG) $(LLC)
|
|
|
|
verify_cmds: $(CLANG) $(LLC)
|
|
@for TOOL in $^ ; do \
|
|
if ! (which -- "$${TOOL}" > /dev/null 2>&1); then \
|
|
echo "*** ERROR: Cannot find LLVM tool $${TOOL}" ;\
|
|
exit 1; \
|
|
else true; fi; \
|
|
done
|
|
|
|
verify_target_bpf: verify_cmds
|
|
@if ! (${LLC} -march=bpf -mattr=help > /dev/null 2>&1); then \
|
|
echo "*** ERROR: LLVM (${LLC}) does not support 'bpf' target" ;\
|
|
echo " NOTICE: LLVM version >= 3.7.1 required" ;\
|
|
exit 2; \
|
|
else true; fi
|
|
|
|
$(BPF_SAMPLES_PATH)/*.c: verify_target_bpf $(LIBBPF)
|
|
$(src)/*.c: verify_target_bpf $(LIBBPF)
|
|
|
|
$(obj)/tracex5_kern.o: $(obj)/syscall_nrs.h
|
|
$(obj)/hbm_out_kern.o: $(src)/hbm.h $(src)/hbm_kern.h
|
|
$(obj)/hbm.o: $(src)/hbm.h
|
|
$(obj)/hbm_edt_kern.o: $(src)/hbm.h $(src)/hbm_kern.h
|
|
|
|
-include $(BPF_SAMPLES_PATH)/Makefile.target
|
|
|
|
# asm/sysreg.h - inline assembly used by it is incompatible with llvm.
|
|
# But, there is no easy way to fix it, so just exclude it since it is
|
|
# useless for BPF samples.
|
|
$(obj)/%.o: $(src)/%.c
|
|
@echo " CLANG-bpf " $@
|
|
$(Q)$(CLANG) $(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(BPF_EXTRA_CFLAGS) \
|
|
-I$(obj) -I$(srctree)/tools/testing/selftests/bpf/ \
|
|
-I$(srctree)/tools/lib/ \
|
|
-D__KERNEL__ -D__BPF_TRACING__ -Wno-unused-value -Wno-pointer-sign \
|
|
-D__TARGET_ARCH_$(SRCARCH) -Wno-compare-distinct-pointer-types \
|
|
-Wno-gnu-variable-sized-type-not-at-end \
|
|
-Wno-address-of-packed-member -Wno-tautological-compare \
|
|
-Wno-unknown-warning-option $(CLANG_ARCH_ARGS) \
|
|
-I$(srctree)/samples/bpf/ -include asm_goto_workaround.h \
|
|
-O2 -emit-llvm -c $< -o -| $(LLC) -march=bpf $(LLC_FLAGS) -filetype=obj -o $@
|
|
ifeq ($(DWARF2BTF),y)
|
|
$(BTF_PAHOLE) -J $@
|
|
endif
|