Skip to content

Commit

Permalink
expand MAX_DATA_SIZE to 1500 bytes
Browse files Browse the repository at this point in the history
  • Loading branch information
jschwinger233 committed Mar 11, 2023
1 parent 712ae8b commit 105f01e
Show file tree
Hide file tree
Showing 7 changed files with 2,969 additions and 15,075 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,4 +35,4 @@ Please be aware that every capture will dump two files, one is `pcap` file which

1. There are some bugs of transforming cbpf to ebpf, and now the tool will break for `skbdump -i lo arp`. To workaround the issue you can use the equivalent filter expression such as `skbdump -i lo ether proto arp`.
3. Some complicated filter expression doesn't work as expected, such as `'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'`.
2. Currently the tool only supports capturing packets with maximum 1024 bytes.
2. Currently the tool only supports capturing packets with maximum 1500 bytes.
23 changes: 21 additions & 2 deletions internal/bpf/bpf.go
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
package bpf

import (
"fmt"
"reflect"
"strings"

"github.com/cilium/ebpf"
Expand Down Expand Up @@ -33,7 +35,7 @@ func setFilter(spec *ebpf.CollectionSpec, exp string) (err error) {
}

ebpfFilter = append(ebpfFilter,
asm.Mov.Imm(asm.R0, 0).WithSymbol("result"), // TC_ACT_OK
asm.Mov.Imm(asm.R0, 0).WithSymbol("result"), // r0 = TC_ACT_OK
asm.JNE.Imm(asm.R4, 0, "continue"), // if r4 != 0 (match): jump to continue
asm.Return().WithSymbol("return"), // else return TC_ACT_OK
asm.Mov.Imm(asm.R0, 0).WithSymbol("continue"),
Expand All @@ -48,6 +50,19 @@ func setFilter(spec *ebpf.CollectionSpec, exp string) (err error) {
return
}

func initTailcallMap(objs *SkbdumpObjects) (err error) {
r := reflect.ValueOf(objs)
for i := 1; i <= 1500; i++ {
tailFunc := reflect.Indirect(r).FieldByName(fmt.Sprintf("TailSkbData%d", i)).Interface().(*ebpf.Program)
key := uint32(i)
value := int32(tailFunc.FD())
if err = errors.WithStack(objs.SkbDataCall.Put(&key, &value)); err != nil {
return
}
}
return
}

func LoadBpfObjects(filterExp string) (_ *SkbdumpObjects, err error) {
objs := &SkbdumpObjects{}
spec, err := LoadSkbdump()
Expand All @@ -59,5 +74,9 @@ func LoadBpfObjects(filterExp string) (_ *SkbdumpObjects, err error) {
return nil, errors.WithStack(err)
}

return objs, errors.WithStack(spec.LoadAndAssign(objs, nil))
if err = errors.WithStack(spec.LoadAndAssign(objs, nil)); err != nil {
return
}

return objs, errors.WithStack(initTailcallMap(objs))
}
2 changes: 1 addition & 1 deletion internal/bpf/headers/skbdump.h
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
#endif

#ifndef MAX_DATA_SIZE
#define MAX_DATA_SIZE 1024
#define MAX_DATA_SIZE 1500
#endif

#ifndef ETH_P_IP
Expand Down
Loading

0 comments on commit 105f01e

Please sign in to comment.