eBPF 技術：核心級程式化的革命

sudo apt update
sudo apt install -y build-essential clang llvm libelf-dev zlib1g-dev linux-headers-$(uname -r)

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

SEC("tracepoint/syscalls/sys_enter_execve")
int hello_execve(void *ctx)
{
    char msg[] = "Hello, eBPF! Someone executed a program.\n";
    bpf_trace_printk(msg, sizeof(msg));
    return 0;
}

char LICENSE[] SEC("license") = "Dual BSD/GPL";

#!/usr/bin/python3
from bcc import BPF

# 載入 eBPF 程式
bpf_text = """
#include <linux/sched.h>

int hello_execve(void *ctx) {
    char msg[] = "Hello, eBPF! Someone executed a program.\\n";
    bpf_trace_printk(msg, sizeof(msg));
    return 0;
}
"""

# 編譯並載入 eBPF 程式
b = BPF(text=bpf_text)
b.attach_tracepoint(tp="syscalls:sys_enter_execve", fn_name="hello_execve")

# 輸出結果
print("eBPF program loaded! Tracing execve() calls... Press Ctrl+C to exit.")
try:
    b.trace_print()
except KeyboardInterrupt:
    pass

sudo python3 hello.py

eBPF program loaded! Tracing execve() calls... Press Ctrl+C to exit.
b'           <...>-1234    [001] d...1  1234.123456: bpf_trace_printk: Hello, eBPF! Someone executed a program.'

#!/usr/bin/python3
from bcc import BPF
import time

# 載入 eBPF 程式
bpf_text = """
#include <linux/sched.h>
#include <linux/string.h>

BPF_HASH(exec_counter, u32, u32);

int hello_execve(void *ctx) {
    u32 pid = bpf_get_current_pid_tgid();
    u32 count = 0;
    
    // 查詢或初始化計數器
    u32 *counter = exec_counter.lookup(&pid);
    if (counter) {
        count = *counter + 1;
    } else {
        count = 1;
    }
    exec_counter.update(&pid, &count);
    
    return 0;
}
"""

# 編譯並載入 eBPF 程式
b = BPF(text=bpf_text)
b.attach_tracepoint(tp="syscalls:sys_enter_execve", fn_name="hello_execve")

# 定期列印統計訊息
print("Counting execve() calls by PID... Press Ctrl+C to exit.")
try:
    while True:
        time.sleep(1)
        print("--- Execve counts per PID ---")
        for k, v in b["exec_counter"].items():
            print(f"PID {k.value}: {v.value} executions")
except KeyboardInterrupt:
    pass

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

SEC("kprobe/do_sys_open")
int kprobe_open(struct pt_regs *ctx)
{
    // 取得檔案名指標 (第二個引數)
    char *filename = (char *)PT_REGS_PARM2(ctx);
    
    // 列印檔案名
    bpf_trace_printk("Opening file: %s\\n", filename);
    
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <linux/sched.h>

struct sched_process_exec_args {
    __u64 pad;
    char *filename;
    int pid;
    int old_pid;
};

SEC("tracepoint/sched/sched_process_exec")
int trace_exec(struct sched_process_exec_args *ctx)
{
    char comm[16];
    int pid;
    
    // 取得程式 ID 和名稱
    pid = bpf_get_current_pid_tgid() >> 32;
    bpf_get_current_comm(&comm, sizeof(comm));
    
    bpf_trace_printk("Process %s (PID: %d) executed\\n", comm, pid);
    
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

SEC("uprobe/libc:malloc")
int trace_malloc(struct pt_regs *ctx)
{
    size_t size = PT_REGS_PARM1(ctx);
    bpf_trace_printk("malloc(%lu) called\\n", size);
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <linux/if_ether.h>
#include <linux/ip.h>

SEC("xdp")
int xdp_filter(struct xdp_md *ctx)
{
    void *data_end = (void *)(long)ctx->data_end;
    void *data = (void *)(long)ctx->data;
    
    // 確保我們可以安全讀取乙太網頭部
    struct ethhdr *eth = data;
    if (data + sizeof(*eth) > data_end)
        return XDP_PASS;
    
    // 只關注 IPv4 封包
    if (eth->h_proto != __constant_htons(ETH_P_IP))
        return XDP_PASS;
    
    // 取得 IP 頭部
    struct iphdr *iph = data + sizeof(*eth);
    if ((void*)iph + sizeof(*iph) > data_end)
        return XDP_PASS;
    
    // 丟棄來自特定 IP 的封包 (範例: 192.168.1.100)
    if (iph->saddr == __constant_htonl(0xC0A80164))
        return XDP_DROP;
    
    return XDP_PASS;
}

char LICENSE[] SEC("license") = "GPL";

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <linux/lsm_hook_defs.h>

SEC("lsm/file_open")
int BPF_PROG(file_open, struct file *file)
{
    char comm[16];
    bpf_get_current_comm(&comm, sizeof(comm));
    
    // 記錄哪個程式開啟了檔案
    bpf_trace_printk("Process %s opened a file\\n", comm);
    
    // 允許操作繼續
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

ldh [12]
jeq #ETHERTYPE_IP, L1, L2
L1: ret #TRUE
L2: ret #0

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>

SEC("socket")
int socket_filter(struct __sk_buff *skb) {
    // 檢查是否為IPv4封包
    if (skb->protocol != htons(ETH_P_IP))
        return 0;
    
    // 取得IP標頭
    struct iphdr *ip = (struct iphdr *)(skb->data + ETH_HLEN);
    if (ip->protocol != IPPROTO_TCP)
        return 0;
    
    // 是TCP封包，接受它
    return -1;
}

char _license[] SEC("license") = "GPL";

#include <linux/bpf.h>
#include <linux/ptrace.h>
#include <linux/sched.h>
#include <linux/fs.h>

struct event {
    u32 pid;
    u8 filename[256];
};

BPF_PERF_OUTPUT(events);

SEC("tracepoint/syscalls/sys_enter_open")
int trace_open(struct syscall_trace_enter *ctx) {
    struct event event = {};
    
    // 取得當前程式ID
    event.pid = bpf_get_current_pid_tgid() >> 32;
    
    // 取得檔案名稱
    bpf_probe_read_user_str(event.filename, sizeof(event.filename), (void *)ctx->args[0]);
    
    // 送出事件到使用者空間
    events.perf_submit(ctx, &event, sizeof(event));
    
    return 0;
}

char _license[] SEC("license") = "GPL";

#include <linux/bpf.h>
#include <linux/ptrace.h>

struct key_t {
    u32 pid;
    char function[64];
};

struct data_t {
    u64 count;
    u64 total_ns;
};

BPF_HASH(start, u32, u64);
BPF_HASH(stats, struct key_t, struct data_t);

SEC("kprobe/some_kernel_function")
int entry(struct pt_regs *ctx) {
    u32 pid = bpf_get_current_pid_tgid() >> 32;
    u64 ts = bpf_ktime_get_ns();
    
    start.update(&pid, &ts);
    return 0;
}

SEC("kretprobe/some_kernel_function")
int return(struct pt_regs *ctx) {
    u32 pid = bpf_get_current_pid_tgid() >> 32;
    u64 *tsp = start.lookup(&pid);
    
    if (tsp == 0)
        return 0;
    
    u64 delta = bpf_ktime_get_ns() - *tsp;
    
    struct key_t key = {};
    key.pid = pid;
    bpf_get_current_comm(&key.function, sizeof(key.function));
    
    struct data_t *data = stats.lookup(&key);
    if (data == 0) {
        struct data_t new_data = {1, delta};
        stats.update(&key, &new_data);
    } else {
        data->count++;
        data->total_ns += delta;
        stats.update(&key, data);
    }
    
    start.delete(&pid);
    return 0;
}

char _license[] SEC("license") = "GPL";

sudo apt-get update
sudo apt-get install -y build-essential clang llvm libelf-dev linux-headers-$(uname -r)

sudo apt-get install -y libbpf-dev bpfcc-tools

TARGET = my_ebpf_program

BPF_PROG = ${TARGET}.bpf.c
BPF_OBJ = ${TARGET}.bpf.o
USER_PROG = ${TARGET}.c
USER_OBJ = ${TARGET}.o
BINARY = ${TARGET}

CLANG = clang
CFLAGS = -g -O2 -Wall

all: ${BINARY}

${BPF_OBJ}: ${BPF_PROG}
	${CLANG} -target bpf -D__TARGET_ARCH_x86 -I/usr/include/bpf -g -O2 -c $< -o $@

${USER_OBJ}: ${USER_PROG}
	${CC} ${CFLAGS} -c $< -o $@

${BINARY}: ${USER_OBJ} ${BPF_OBJ}
	${CC} ${CFLAGS} ${USER_OBJ} -lbpf -lelf -o $@

clean:
	rm -f ${BPF_OBJ} ${USER_OBJ} ${BINARY}

// hello.bpf.c
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

SEC("tracepoint/syscalls/sys_enter_execve")
int hello(void *ctx) {
    char msg[] = "Hello, eBPF!";
    bpf_trace_printk(msg, sizeof(msg));
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

// hello.c
#include <stdio.h>
#include <unistd.h>
#include <bpf/bpf.h>
#include <bpf/libbpf.h>

int main() {
    struct bpf_object *obj;
    int prog_fd;
    
    obj = bpf_object__open_file("hello.bpf.o", NULL);
    if (!obj) {
        printf("Failed to open BPF object\n");
        return 1;
    }
    
    if (bpf_object__load(obj)) {
        printf("Failed to load BPF object\n");
        return 1;
    }
    
    struct bpf_program *prog = bpf_object__find_program_by_name(obj, "hello");
    if (!prog) {
        printf("Failed to find BPF program\n");
        return 1;
    }
    
    prog_fd = bpf_program__fd(prog);
    
    printf("eBPF program loaded successfully! Run 'sudo cat /sys/kernel/debug/tracing/trace_pipe' to see output\n");
    
    // 保持程式執行
    while (1) {
        sleep(1);
    }
    
    return 0;
}

make
sudo ./hello

sudo cat /sys/kernel/debug/tracing/trace_pipe

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>

struct conn_key {
    u32 saddr;
    u32 daddr;
    u16 sport;
    u16 dport;
};

struct conn_info {
    u64 rx_packets;
    u64 rx_bytes;
    u64 tx_packets;
    u64 tx_bytes;
    u8 state;
};

BPF_HASH(connections, struct conn_key, struct conn_info, 10240);

SEC("socket")
int socket_stats(struct __sk_buff *skb) {
    u8 *cursor = 0;
    
    struct ethhdr *ethernet = (struct ethhdr *)cursor_advance(cursor, sizeof(*ethernet));
    if (ethernet->h_proto != htons(ETH_P_IP))
        return 0;
    
    struct iphdr *ip = (struct iphdr *)cursor_advance(cursor, sizeof(*ip));
    if (ip->protocol != IPPROTO_TCP)
        return 0;
    
    struct tcphdr *tcp = (struct tcphdr *)cursor_advance(cursor, sizeof(*tcp));
    
    struct conn_key key = {};
    key.saddr = ip->saddr;
    key.daddr = ip->daddr;
    key.sport = tcp->source;
    key.dport = tcp->dest;
    
    struct conn_info *info = connections.lookup(&key);
    if (!info) {
        struct conn_info new_info = {};
        if (tcp->syn && !tcp->ack) {
            new_info.state = 1; // SYN_SENT
        }
        connections.update(&key, &new_info);
    } else {
        // 更新連線狀態
        if (tcp->syn && tcp->ack && info->state == 1) {
            info->state = 2; // SYN_RECEIVED
        } else if (tcp->ack && !tcp->syn && !tcp->fin && info->state == 2) {
            info->state = 3; // ESTABLISHED
        } else if (tcp->fin && info->state == 3) {
            info->state = 4; // FIN_WAIT
        } else if (tcp->fin && tcp->ack && info->state == 4) {
            info->state = 5; // LAST_ACK
        } else if (tcp->ack && info->state == 5) {
            info->state = 6; // CLOSED
        }
        
        // 更新統計資料
        if (ip->saddr == key.saddr) {
            info->tx_packets++;
            info->tx_bytes += skb->len;
        } else {
            info->rx_packets++;
            info->rx_bytes += skb->len;
        }
        
        connections.update(&key, info);
    }
    
    return 0;
}

char _license[] SEC("license") = "GPL";

#include <linux/bpf.h>
#include <linux/ptrace.h>
#include <linux/sched.h>

struct event_t {
    u32 pid;
    u32 uid;
    char comm[16];
    char syscall[32];
    char path[256];
};

BPF_PERF_OUTPUT(events);
BPF_HASH(suspicious_paths, const char *, u8, 1024);

static int init_suspicious_paths() {
    const char *paths[] = {
        "/etc/passwd",
        "/etc/shadow",
        "/etc/ssh/sshd_config",
        "/var/log/auth.log"
    };
    
    u8 val = 1;
    for (int i = 0; i < sizeof(paths)/sizeof(paths[0]); i++) {
        suspicious_paths.update(&paths[i], &val);
    }
    
    return 0;
}

SEC("tracepoint/syscalls/sys_enter_open")
int trace_open(struct syscall_trace_enter *ctx) {
    struct event_t event = {};
    const char *path = (const char *)ctx->args[0];
    u8 *is_suspicious;
    
    // 檢查路徑是否在可疑列表中
    is_suspicious = suspicious_paths.lookup(&path);
    if (!is_suspicious)
        return 0;
    
    // 收集事件資訊
    event.pid = bpf_get_current_pid_tgid() >> 32;
    event.uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
    bpf_get_current_comm(&event.comm, sizeof(event.comm));
    __builtin_memcpy(event.syscall, "open", 5);
    bpf_probe_read_user_str(event.path, sizeof(event.path), (void *)path);
    
    // 送出事件到使用者空間
    events.perf_submit(ctx, &event, sizeof(event));
    
    return 0;
}

char _license[] SEC("license") = "GPL";

#include <linux/bpf.h>
#include <linux/ptrace.h>
#include <linux/sched.h>

#define STACK_STORAGE_SIZE 16384

struct key_t {
    u32 pid;
    u64 kernel_ip;
    u64 kernel_ret_ip;
    int user_stack_id;
    int kernel_stack_id;
    char name[TASK_COMM_LEN];
};

BPF_HASH(counts, struct key_t);
BPF_STACK_TRACE(stack_traces, STACK_STORAGE_SIZE);

SEC("perf_event")
int on_cpu(struct bpf_perf_event_data *ctx) {
    u64 id = bpf_get_current_pid_tgid();
    u32 pid = id >> 32;
    u32 tgid = id;
    
    if (pid == 0)
        return 0;
    
    struct key_t key = {};
    key.pid = tgid;
    key.kernel_ip = PT_REGS_IP(&ctx->regs);
    key.kernel_ret_ip = 0;
    
    // 取得使用者和核心堆積積疊
    key.user_stack_id = stack_traces.get_stackid(&ctx->regs, BPF_F_USER_STACK);
    key.kernel_stack_id = stack_traces.get_stackid(&ctx->regs, 0);
    
    if (key.user_stack_id >= 0) {
        u64 *val, zero = 0;
        val = counts.lookup_or_init(&key, &zero);
        (*val)++;
    }
    
    return 0;
}

char _license[] SEC("license") = "GPL";