基于eBPF实现Workerman网络流量监控

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <bpf/bpf_helpers.h>

struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, __u32);
    __type(value, __u64);
    __uint(max_entries, 1024);
} connections SEC(".maps");

SEC("sockops")
int bpf_sockops(struct bpf_sock_ops *skops)
{
    __u32 saddr = skops->local_ip4;
    __u32 daddr = skops->remote_ip4;
    __u16 sport = skops->local_port;
    __u16 dport = skops->remote_port;
    __u32 key = saddr ^ daddr ^ sport ^ dport;
    __u64 *value;

    switch (skops->op) {
    case BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB:
        value = bpf_map_lookup_elem(&connections, &key);
        if (!value) {
            __u64 init = 1;
            bpf_map_update_elem(&connections, &key, &init, BPF_ANY);
        }
        break;
    case BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB:
        value = bpf_map_lookup_elem(&connections, &key);
        if (!value) {
            __u64 init = 1;
            bpf_map_update_elem(&connections, &key, &init, BPF_ANY);
        }
        break;
    case BPF_SOCK_OPS_TCP_LISTEN_CB:
        // 监听连接
        break;
    case BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB:
        // 被动连接建立
        break;
    case BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB:
        // 主动连接建立
        break;
    case BPF_SOCK_OPS_FIN_WAIT1_CB:
    case BPF_SOCK_OPS_FIN_WAIT2_CB:
    case BPF_SOCK_OPS_CLOSE_CB:
        bpf_map_delete_elem(&connections, &key);
        break;
    }
    return 0;
}

char _license[] SEC("license") = "GPL";