hulk inclusion
category: feature
bugzilla: NA
CVE: N/A
----------------------------------------------------
add sample sockmap code for redis
Signed-off-by: Liu Jian <liujian56(a)huawei.com>
---
tools/netacc/Makefile | 24 +++
tools/netacc/bpf_sockmap.h | 148 +++++++++++++++++++
tools/netacc/net-acc | 34 +++++
tools/netacc/redis_acc.c | 276 ++++++++++++++++++++++++++++++++++
tools/netacc/redissockmap.c | 287 ++++++++++++++++++++++++++++++++++++
5 files changed, 769 insertions(+)
create mode 100644 tools/netacc/Makefile
create mode 100644 tools/netacc/bpf_sockmap.h
create mode 100755 tools/netacc/net-acc
create mode 100644 tools/netacc/redis_acc.c
create mode 100644 tools/netacc/redissockmap.c
diff --git a/tools/netacc/Makefile b/tools/netacc/Makefile
new file mode 100644
index 000000000000..bf1db37414d8
--- /dev/null
+++ b/tools/netacc/Makefile
@@ -0,0 +1,24 @@
+# SPDX-License-Identifier: GPL-2.0
+
+INSTALL ?= install
+CLANG ?= clang
+CC ?= gcc
+BPFTOOL ?= bpftool
+TOPDIR = ../..
+MKFLAGS = -I$(TOPDIR)/tools/lib
+LDLIBBPF = -L$(TOPDIR)/tools/lib/bpf/ -l:libbpf.a
+
+all:
+ $(CLANG) -O2 -g -Wall -target bpf $(MKFLAGS) -c redissockmap.c -o redissockmap.o
+ $(BPFTOOL) gen skeleton redissockmap.o > redis_acc.skel.h
+ $(CC) -O2 -g -Wall $(MKFLAGS) redis_acc.c -o redis_acc $(LDLIBBPF) -lelf -lz
+
+clean:
+ rm -f redis_acc
+ rm -f redis_acc.skel.h
+ rm -f *.o
+
+install:
+ mkdir -p $(INSTALL_ROOT)/usr/sbin/tuned_acc/
+ $(INSTALL) -m 755 net-acc $(INSTALL_ROOT)/usr/sbin/
+ $(INSTALL) -m 755 redis_acc $(INSTALL_ROOT)/usr/sbin/tuned_acc/
diff --git a/tools/netacc/bpf_sockmap.h b/tools/netacc/bpf_sockmap.h
new file mode 100644
index 000000000000..8edcc6624593
--- /dev/null
+++ b/tools/netacc/bpf_sockmap.h
@@ -0,0 +1,148 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright(c) 2023 Huawei Technologies Co., Ltd
+ */
+
+#ifndef __BPF_SOCKMAP_H__
+#define __BPF_SOCKMAP_H__
+
+#include <stddef.h>
+#include <stdbool.h>
+#include <linux/types.h>
+#include <linux/bpf.h>
+
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_endian.h>
+
+#define LOG_DEBUG 0
+#define SOCKMAP_SIZE 100000
+
+#if LOG_DEBUG
+#define net_dbg bpf_printk
+#define net_err bpf_printk
+#else
+#define net_dbg(fmt, ...) do {} while (0)
+#define net_err bpf_printk
+#endif
+
+struct sock_key {
+ __u32 sip4;
+ __u32 dip4;
+ __u32 sport;
+ __u32 dport;
+} __attribute__((packed));
+
+struct {
+ __uint(type, BPF_MAP_TYPE_SOCKHASH);
+ __type(key, struct sock_key);
+ __type(value, int);
+ __uint(max_entries, SOCKMAP_SIZE);
+ __uint(map_flags, 0);
+} redissock_map SEC(".maps");
+
+struct sock_info {
+ __u64 redir_rx_cnt;
+ __u64 redir_tx_cnt;
+ int sk_flags;
+};
+
+struct {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __type(key, struct sock_key);
+ __type(value, struct sock_info);
+ __uint(max_entries, SOCKMAP_SIZE);
+ __uint(map_flags, 0);
+} sockflag_map SEC(".maps");
+
+static inline void sock_key2peerkey(struct sock_key *key, struct sock_key *peer_key)
+{
+ peer_key->sip4 = key->dip4;
+ peer_key->sport = key->dport;
+ peer_key->dip4 = key->sip4;
+ peer_key->dport = key->sport;
+}
+
+static inline void extract_key4_from_ops(struct bpf_sock_ops *ops, struct sock_key *key)
+{
+ key->dip4 = ops->remote_ip4;
+ key->sip4 = ops->local_ip4;
+
+ // local_port is in host byte order
+ // and remote_port is in network byte order
+ key->sport = ops->local_port;
+ key->dport = bpf_ntohl(ops->remote_port);
+}
+
+static inline void bpf_sock_ops_ipv4(struct bpf_sock_ops *skops)
+{
+ struct sock_key key = {};
+
+ extract_key4_from_ops(skops, &key);
+ bpf_sock_hash_update(skops, &redissock_map, &key, BPF_NOEXIST);
+}
+
+static inline void bpf_sockmap_ipv4_insert(struct bpf_sock_ops *skops)
+{
+ if (bpf_ntohl(skops->remote_port) == 22 || skops->local_port == 22)
+ return;
+
+ bpf_sock_ops_ipv4(skops);
+}
+
+static inline void bpf_sockmap_ipv4_cleanup(struct bpf_sock_ops *skops, __u64 *cnt)
+{
+ struct sock_info *p_skinfo = NULL;
+ struct sock_key key = {};
+
+ extract_key4_from_ops(skops, &key);
+ p_skinfo = bpf_map_lookup_elem(&sockflag_map, &key);
+ if (p_skinfo) {
+ if (cnt)
+ *cnt = p_skinfo->redir_tx_cnt;
+ bpf_map_delete_elem(&sockflag_map, &key);
+ }
+}
+
+static inline void extract_key4_from_msg(struct sk_msg_md *msg, struct sock_key *key)
+{
+ key->sip4 = msg->local_ip4;
+ key->dip4 = msg->remote_ip4;
+
+ // local_port is in host byte order
+ // and remote_port is in network byte order
+ key->sport = msg->local_port;
+ key->dport = bpf_ntohl(msg->remote_port);
+}
+
+SEC("sk_msg") int redis_redir(struct sk_msg_md *msg)
+{
+ struct sock_info *p_skinfo = NULL;
+ struct sock_info skinfo = {0};
+ struct sock_key peer_key = {};
+ struct sock_key key = {};
+ int ret, addinfo = 0;
+
+ extract_key4_from_msg(msg, &key);
+ sock_key2peerkey(&key, &peer_key);
+
+ p_skinfo = bpf_map_lookup_elem(&sockflag_map, &key);
+ if (p_skinfo != NULL && p_skinfo->sk_flags == 1)
+ return SK_PASS;
+
+ if (p_skinfo == NULL) {
+ addinfo = 1;
+ p_skinfo = &skinfo;
+ }
+
+ ret = bpf_msg_redirect_hash(msg, &redissock_map, &peer_key, BPF_F_INGRESS);
+ if (ret == SK_DROP) {
+ if (p_skinfo->sk_flags != 1)
+ p_skinfo->sk_flags = 1;
+ }
+
+ p_skinfo->redir_tx_cnt++;
+ if (addinfo)
+ bpf_map_update_elem(&sockflag_map, &key, p_skinfo, BPF_ANY);
+
+ return SK_PASS;
+}
+#endif
diff --git a/tools/netacc/net-acc b/tools/netacc/net-acc
new file mode 100755
index 000000000000..f3db4803ced3
--- /dev/null
+++ b/tools/netacc/net-acc
@@ -0,0 +1,34 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+function usage() {
+ echo ""
+ echo "Usage:"
+ echo " $0 [enable | disable]"
+ echo ""
+}
+
+function mount_cgp2() {
+ CGP2=`mount | grep cgroup2`
+ if [[ "$CGP2"X == "X" ]]; then
+ CGP2_PATCH=/sys/fs/cgroup/tunned-acc
+ mount -o rw,remount /sys/fs/cgroup
+ mkdir -p ${CGP2_PATCH}
+ mount -t cgroup2 -o nosuid,nodev,noexec none ${CGP2_PATCH}
+ mount -o ro,remount /sys/fs/cgroup
+ fi
+}
+
+CMD=$1
+
+if [[ "$CMD"X == "enableX" ]]; then
+ mount_cgp2
+ modprobe localip
+ /usr/sbin/tuned_acc/redis_acc enable
+elif [[ "$CMD"X == "disableX" ]]; then
+ /usr/sbin/tuned_acc/redis_acc disable
+ rmmod localip
+ exit 0
+else
+ usage;
+fi
diff --git a/tools/netacc/redis_acc.c b/tools/netacc/redis_acc.c
new file mode 100644
index 000000000000..ae81ec56ea7e
--- /dev/null
+++ b/tools/netacc/redis_acc.c
@@ -0,0 +1,276 @@
+#include <argp.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/resource.h>
+#include <time.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include <bpf/libbpf.h>
+#include <bpf/bpf.h>
+#include "redis_acc.skel.h"
+
+#ifndef ARRAY_SIZE
+#define ARRAY_SIZE(a) (sizeof(a) / sizeof(a[0]))
+#endif
+
+#define CG_PATH "/sys/fs/cgroup/tunned-acc"
+#define PIN_PATH "/sys/fs/bpf/redis/"
+
+static int bump_memlock_rlimit(void)
+{
+ struct rlimit rlim_new = {
+ .rlim_cur = RLIM_INFINITY,
+ .rlim_max = RLIM_INFINITY,
+ };
+
+ return setrlimit(RLIMIT_MEMLOCK, &rlim_new);
+}
+
+struct net_acc_prog_info {
+ const char *prog_name;
+ const char *pin_path;
+ void **prog;
+ int *fd;
+};
+
+struct net_acc_map_info {
+ const char *map_name;
+ char *pin_path;
+ void **map;
+ int *fd;
+};
+
+struct {
+ int redis_sockops_fd;
+ int redis_redir_fd;
+ int redissock_map_fd;
+} net_acc_fds;
+
+struct {
+ void *redis_sockops_obj;
+ void *redis_redir_obj;
+ void *redissock_map_obj;
+} net_acc_obj;
+
+static struct net_acc_prog_info prog_infos[] = {
+ {
+ .prog_name = "redis_sockops",
+ .pin_path = PIN_PATH"sockops",
+ .prog = &net_acc_obj.redis_sockops_obj,
+ .fd = &net_acc_fds.redis_sockops_fd,
+ },
+ {
+ .prog_name = "redis_redir",
+ .pin_path = PIN_PATH"sk_msg",
+ .prog = &net_acc_obj.redis_redir_obj,
+ .fd = &net_acc_fds.redis_redir_fd,
+ }
+};
+
+static struct net_acc_map_info map_infos[] = {
+ {
+ .map_name = "redissock_map",
+ .pin_path = PIN_PATH"redissock_map",
+ .map = &net_acc_obj.redissock_map_obj,
+ .fd = &net_acc_fds.redissock_map_fd,
+ }
+};
+
+int cg_fd = -1;
+struct redissockmap *skel;
+
+int net_acc_enabled(void)
+{
+ int map_fd;
+
+ map_fd = bpf_obj_get(map_infos[0].pin_path);
+ if (map_fd < 0)
+ return 0;
+
+ close(map_fd);
+ return 1;
+}
+
+int pin_prog_map(void)
+{
+ int i, mapj, progj;
+ int err = 0;
+
+ mapj = ARRAY_SIZE(map_infos);
+ for (i = 0; i < mapj; i++) {
+ if (*map_infos[i].map)
+ err = bpf_map__pin(*map_infos[i].map, map_infos[i].pin_path);
+ if (err) {
+ mapj = i;
+ goto err1;
+ }
+ }
+
+ progj = ARRAY_SIZE(prog_infos);
+ for (i = 0; i < progj; i++) {
+ if (*prog_infos[i].prog)
+ err = bpf_program__pin(*prog_infos[i].prog, prog_infos[i].pin_path);
+ if (err) {
+ progj = i;
+ goto err2;
+ }
+ }
+ return 0;
+err2:
+ for (i = 0; i < progj; i++) {
+ if (*prog_infos[i].prog)
+ bpf_program__unpin(*prog_infos[i].prog, prog_infos[i].pin_path);
+ }
+err1:
+ for (i = 0; i < mapj; i++) {
+ if (*map_infos[i].map)
+ bpf_map__unpin(*map_infos[i].map, map_infos[i].pin_path);
+ }
+ return 1;
+}
+
+int attach_manually(void)
+{
+ int err;
+
+ err = bpf_prog_attach(bpf_program__fd(skel->progs.redis_sockops), cg_fd, BPF_CGROUP_SOCK_OPS, 0);
+ if (err) {
+ fprintf(stderr, "failed to attach sockops programs\n");
+ return -1;
+ }
+
+ err = bpf_prog_attach(bpf_program__fd(skel->progs.redis_redir),
+ bpf_map__fd(skel->maps.redissock_map), BPF_SK_MSG_VERDICT, 0);
+ if (err) {
+ fprintf(stderr, "failed to attach msg_verdict programs\n");
+ goto cleanup1;
+ }
+
+ net_acc_obj.redis_sockops_obj = skel->progs.redis_sockops;
+ net_acc_obj.redis_redir_obj = skel->progs.redis_redir;
+ net_acc_obj.redissock_map_obj = skel->maps.redissock_map;
+ return 0;
+cleanup1:
+ bpf_prog_detach2(bpf_program__fd(skel->progs.redis_sockops), cg_fd, BPF_CGROUP_SOCK_OPS);
+ return -1;
+}
+
+void detach_manually(void)
+{
+ bpf_prog_detach2(bpf_program__fd(skel->progs.redis_redir),
+ bpf_map__fd(skel->maps.redissock_map), BPF_SK_MSG_VERDICT);
+ bpf_prog_detach2(bpf_program__fd(skel->progs.redis_sockops), cg_fd, BPF_CGROUP_SOCK_OPS);
+}
+
+int net_acc_enable(void)
+{
+ int err;
+
+ if (net_acc_enabled())
+ return 0;
+
+ err = bump_memlock_rlimit();
+ if (err) {
+ fprintf(stderr, "failed to increase rlimit: %d", err);
+ close(cg_fd);
+ return 1;
+ }
+
+ skel = redissockmap__open();
+ if (!skel) {
+ fprintf(stderr, "failed to open and/or load BPF object\n");
+ return 1;
+ }
+
+ err = redissockmap__load(skel);
+ if (err) {
+ fprintf(stderr, "failed to load BPF object: %d\n", err);
+ goto cleanup;
+ }
+
+ err = redissockmap__attach(skel);
+ if (err) {
+ fprintf(stderr, "failed to attach BPF programs\n");
+ goto cleanup;
+ }
+
+ err = attach_manually();
+ if (err) {
+ fprintf(stderr, "failed to attach BPF programs\n");
+ goto cleanup;
+ }
+
+ err = pin_prog_map();
+ if (err) {
+ fprintf(stderr, "failed to pin BPF programs and maps\n");
+ goto cleanup1;
+ }
+
+ return 0;
+
+cleanup1:
+ detach_manually();
+cleanup:
+ redissockmap__destroy(skel);
+ close(cg_fd);
+
+ return err != 0;
+}
+
+
+int net_acc_disable(void)
+{
+ int i;
+
+ if (!net_acc_enabled())
+ return 0;
+
+ for (i = 0; i < ARRAY_SIZE(map_infos); i++) {
+ if (map_infos[i].fd) {
+ *map_infos[i].fd = bpf_obj_get(map_infos[i].pin_path);
+ unlink(map_infos[i].pin_path);
+ }
+ }
+
+ for (i = 0; i < ARRAY_SIZE(prog_infos); i++) {
+ if (prog_infos[i].fd) {
+ *prog_infos[i].fd = bpf_obj_get(prog_infos[i].pin_path);
+ unlink(prog_infos[i].pin_path);
+ }
+ }
+
+ bpf_prog_detach2(net_acc_fds.redis_redir_fd,
+ net_acc_fds.redissock_map_fd, BPF_SK_MSG_VERDICT);
+ bpf_prog_detach2(net_acc_fds.redis_sockops_fd, cg_fd, BPF_CGROUP_SOCK_OPS);
+
+ close(net_acc_fds.redis_redir_fd);
+ close(net_acc_fds.redis_redir_fd);
+ close(net_acc_fds.redis_redir_fd);
+ rmdir(PIN_PATH);
+ return 0;
+}
+
+int main(int argc, char **argv)
+{
+ int ret = 1;
+
+ if (argc != 2)
+ return 1;
+
+ cg_fd = open(CG_PATH, O_DIRECTORY, O_RDONLY);
+ if (cg_fd < 0) {
+ fprintf(stderr, "ERROR: (%i) open cgroup2 path failed: %s\n", cg_fd, CG_PATH);
+ return 1;
+ }
+
+ if (strncmp(argv[1], "enable", 6) == 0)
+ ret = net_acc_enable();
+ else if (strncmp(argv[1], "disable", 7) == 0)
+ ret = net_acc_disable();
+
+ close(cg_fd);
+ return ret;
+}
diff --git a/tools/netacc/redissockmap.c b/tools/netacc/redissockmap.c
new file mode 100644
index 000000000000..b23df1aa3e6c
--- /dev/null
+++ b/tools/netacc/redissockmap.c
@@ -0,0 +1,287 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 2023 Huawei Technologies Co., Ltd
+ */
+
+#include "bpf_sockmap.h"
+
+#define REDIS_BIND_MAP_SIZE 100
+#define BLOCKLIST_SIZE 1000
+
+#define ENABLE_BLOCKLIST 0
+#define SHORT_THR 10
+#define BLOCK_THR 10000
+
+struct local_ip {
+ __u32 ip4;
+};
+
+struct ipaddr_port {
+ __u32 ip4;
+ __u32 port;
+} __attribute__((packed));
+
+#if ENABLE_BLOCKLIST
+struct {
+ __uint(type, BPF_MAP_TYPE_LRU_HASH);
+ __type(key, struct ipaddr_port);
+ __type(value, int);
+ __uint(max_entries, BLOCKLIST_SIZE);
+ __uint(map_flags, 0);
+} blocklist_map SEC(".maps");
+#endif
+
+struct {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __type(key, struct ipaddr_port);
+ __type(value, int);
+ __uint(max_entries, REDIS_BIND_MAP_SIZE);
+ __uint(map_flags, 0);
+} redis_bind_map SEC(".maps");
+
+
+static inline void extract_ipaddrport_from_ops(struct bpf_sock_ops *skops,
+ struct ipaddr_port *key1, struct ipaddr_port *key2)
+{
+ key1->ip4 = skops->remote_ip4;
+ // remote_port is in network byte order
+ key1->port = bpf_ntohl(skops->remote_port);
+
+ key2->ip4 = skops->local_ip4;
+ // local_port is in host byte order
+ key2->port = skops->local_port;
+}
+
+static inline int __is_redis_sock(struct ipaddr_port *key)
+{
+ int *pv = NULL;
+
+ pv = bpf_map_lookup_elem(&redis_bind_map, key);
+ if (pv)
+ return 1;
+
+ return 0;
+}
+
+static inline int is_redis_sock(struct ipaddr_port *key1, struct ipaddr_port *key2,
+ struct ipaddr_port *key10, struct ipaddr_port *key20)
+{
+ net_dbg("is_redis, ip1:0x%x, port1:0x%x\n", key1->ip4, key1->port);
+ net_dbg("is_redis, ip2:0x%x, port2:0x%x\n", key2->ip4, key2->port);
+
+ if (__is_redis_sock(key1))
+ return 1;
+
+ if (__is_redis_sock(key2))
+ return 1;
+
+ if (__is_redis_sock(key10))
+ return 1;
+
+ if (__is_redis_sock(key20))
+ return 1;
+
+ return 0;
+}
+
+static inline int is_localip_sock(struct bpf_sock_ops *skops)
+{
+ struct local_ip remoteip;
+
+ net_dbg("is_localip, ip1:0x%x, ip2:0x%x\n",
+ skops->local_ip4, skops->remote_ip4);
+
+ // skops->local_ip4 must be the local IP address
+ remoteip.ip4 = skops->remote_ip4;
+
+ if ((remoteip.ip4 & 0xff) == 0x7f)
+ return 1;
+
+ if (!bpf_is_local_ipaddr(remoteip.ip4))
+ return 0;
+
+ return 1;
+}
+
+#if ENABLE_BLOCKLIST
+static inline int __is_in_block_list(struct ipaddr_port *key)
+{
+ int *pv = NULL;
+
+ pv = bpf_map_lookup_elem(&blocklist_map, key);
+ if (pv && *pv > BLOCK_THR)
+ return 1;
+
+ return 0;
+}
+
+static inline int is_in_block_list(struct ipaddr_port *key1, struct ipaddr_port *key2,
+ struct ipaddr_port *key10, struct ipaddr_port *key20)
+{
+
+ if (__is_in_block_list(key1))
+ return 1;
+ if (__is_in_block_list(key2))
+ return 1;
+ if (__is_in_block_list(key10))
+ return 1;
+ if (__is_in_block_list(key20))
+ return 1;
+
+ return 0;
+}
+
+static inline int __add_task2block_list(struct ipaddr_port *block)
+{
+ int *pv = NULL;
+ int value = 1;
+
+ pv = bpf_map_lookup_elem(&blocklist_map, block);
+ if (pv == NULL) {
+ bpf_map_update_elem(&blocklist_map, block, &value, BPF_NOEXIST);
+ return 0;
+ }
+
+ if (*pv > BLOCK_THR)
+ return 0;
+
+ *pv += 1;
+ return 0;
+}
+
+static inline int add_task2block_list(struct bpf_sock_ops *skops)
+{
+ struct ipaddr_port block1;
+ struct ipaddr_port block2;
+
+ extract_ipaddrport_from_ops(skops, &block1, &block2);
+
+ if (__is_redis_sock(&block1))
+ return __add_task2block_list(&block1);
+
+ if (__is_redis_sock(&block2))
+ return __add_task2block_list(&block2);
+
+ block1.ip4 = 0;
+ if (__is_redis_sock(&block1))
+ return __add_task2block_list(&block1);
+
+ block2.ip4 = 0;
+ if (__is_redis_sock(&block2))
+ return __add_task2block_list(&block2);
+
+ return 0;
+}
+#else
+static inline int add_task2block_list(struct bpf_sock_ops *skops)
+{
+ return 0;
+}
+static inline int is_in_block_list(struct ipaddr_port *key1, struct ipaddr_port *key2,
+ struct ipaddr_port *key10, struct ipaddr_port *key20)
+{
+ return 0;
+}
+#endif
+
+static inline int is_redis_loopback_tcp(struct bpf_sock_ops *skops)
+{
+ struct ipaddr_port key10;
+ struct ipaddr_port key20;
+ struct ipaddr_port key1;
+ struct ipaddr_port key2;
+
+ if (!is_localip_sock(skops))
+ return 0;
+ net_dbg("this is localip\n");
+
+ extract_ipaddrport_from_ops(skops, &key1, &key2);
+ key10.ip4 = 0;
+ key10.port = key1.port;
+ key20.ip4 = 0;
+ key20.port = key2.port;
+
+ if (!is_redis_sock(&key1, &key2, &key10, &key20))
+ return 0;
+ net_dbg("this is redis sock\n");
+
+ if (is_in_block_list(&key1, &key2, &key10, &key20))
+ return 0;
+
+ net_dbg("the sock is redis loopback sock\n");
+ return 1;
+}
+
+static inline int update_redis_info(struct bpf_sock_ops *skops)
+{
+ struct ipaddr_port key;
+ int value = 1;
+ char comm[16] = {0};
+
+ bpf_get_current_comm(comm, sizeof(comm));
+ if (comm[0] != 'r' || comm[1] != 'e' || comm[2] != 'd' || comm[3] != 'i' ||
+ comm[4] != 's' || comm[5] != '-' || comm[6] != 's' || comm[7] != 'e' ||
+ comm[8] != 'r' || comm[9] != 'v' || comm[10] != 'e' || comm[11] != 'r')
+ return 0;
+
+ key.ip4 = skops->local_ip4;
+ key.port = skops->local_port; // host order
+
+ bpf_map_update_elem(&redis_bind_map, &key, &value, BPF_NOEXIST);
+ net_dbg("%s, update redisinfo: sip:0x%x, sport:%d\n", comm, key.ip4, key.port);
+ return 1;
+}
+
+static inline void clean_redis_info(struct bpf_sock_ops *skops)
+{
+ struct ipaddr_port key;
+
+ key.ip4 = skops->local_ip4;
+ key.port = skops->local_port; // host order
+ net_dbg("clean redisinfo, 0x%x:%d\n", key.ip4, key.port);
+ bpf_map_delete_elem(&redis_bind_map, &key);
+}
+
+SEC("sockops") int redis_sockops(struct bpf_sock_ops *skops)
+{
+ switch (skops->op) {
+ case BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB:
+ case BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB:
+ if (skops->family == 2) {// AF_INET
+ if (is_redis_loopback_tcp(skops)) {
+ net_dbg("bpf_sockops, sockmap, op:%d, sk:%p\n",
+ skops->op, skops->sk);
+ bpf_sock_ops_cb_flags_set(skops, BPF_SOCK_OPS_STATE_CB_FLAG);
+ bpf_sockmap_ipv4_insert(skops);
+ } else {
+ bpf_sock_ops_cb_flags_set(skops, 0);
+ }
+ }
+ break;
+ case BPF_SOCK_OPS_STATE_CB:
+ if (skops->family == 2 && skops->args[0] == BPF_TCP_LISTEN &&
+ skops->args[1] == BPF_TCP_CLOSE) {
+ clean_redis_info(skops);
+ } else if (skops->family == 2 && (skops->args[1] == BPF_TCP_CLOSE ||
+ skops->args[1] == BPF_TCP_CLOSE_WAIT ||
+ skops->args[1] == BPF_TCP_FIN_WAIT1)) {
+ __u64 tx_cnt = SHORT_THR;
+
+ bpf_sockmap_ipv4_cleanup(skops, &tx_cnt);
+ net_dbg("sockops sk:%p, state:%d, tx_cnt:%llu\n",
+ skops->sk, skops->args[1], tx_cnt);
+ if (tx_cnt < SHORT_THR)
+ add_task2block_list(skops);
+ }
+ break;
+ case BPF_SOCK_OPS_TCP_LISTEN_CB:
+ if (skops->family == 2 && update_redis_info(skops))
+ bpf_sock_ops_cb_flags_set(skops, BPF_SOCK_OPS_STATE_CB_FLAG);
+ break;
+ default:
+ break;
+ }
+ return 1;
+}
+
+char _license[] SEC("license") = "GPL";
+int _version SEC("version") = 1;
--
2.34.1
