Added new kprobe to the filesystem ebpf section. Now receiving read events, and storing them in a map for later use, along with a reference to the user-space memory buffer

src/ebpf/include/bpf/bpf_defs.h

@@ -1,9 +0,0 @@
-#ifndef __BPF_DEFS_H
-#define __BPF_DEFS_H
-
-/*#define PT_REGS_PARM1(x) ((x)->rdi)
-#define PT_REGS_PARM2(x) ((x)->rsi)
-#define PT_REGS_PARM3(x) ((x)->rdx)
-#define PT_REGS_PARM4(x) ((x)->rcx)*/
-
-#endif

src/ebpf/include/bpf/fs.h

@@ -1,7 +1,7 @@
 #ifndef __FS_H
 #define __FS_H
 
-#include "newnewvmlinux.h"
+#include "headervmlinux.h"
 /*#include <stdio.h>
 #include <linux/types.h>
 #include <unistd.h>
@@ -14,18 +14,32 @@
 #include <bpf/bpf_core_read.h>
 
 #include "../../../common/constants.h"
-#include "../../../common/map_defs.h"
+#include "../../../common/map_common.h"
 #include "../data/ring_buffer.h"
-#include "bpf_defs.h"
-
-#define FS_MAX_SEGMENT_LENGTH 32
+#include "map_defs.h"
+#include "../utils/strings.h"
 
 
-SEC("kprobe/vfs_open") 
-int kprobe__64_sys_read(struct pt_regs *ctx){
-    //struct path *path = (struct path *)PT_REGS_PARM1(ctx);
-    return 0;//fa_access_path(path);
+static __always_inline int handle_sys_read(struct pt_regs *ctx, int fd, char* buf){
+    __u64 pid_tgid = bpf_get_current_pid_tgid();
+    __u32 pid = pid_tgid >> 32;
+    struct fs_open_data data = {
+        .buf = buf,
+        .fd = fd,
+        .pid = pid
+    };
+    bpf_map_update_elem(&fs_open, &pid_tgid, &data, BPF_ANY);
+    bpf_printk("PID: %u, FS:%u\n", pid, fd);
+    return 0;
 }
 
+SEC("kprobe/ksys_read") 
+int kprobe__64_sys_read(struct pt_regs *ctx) { 
+    struct pt_regs *rctx = ctx; 
+    if (!rctx) return 0; 
+    int fd = (int) PT_REGS_PARM1(ctx); 
+    char *buf = (char *) PT_REGS_PARM2(ctx); 
+    return handle_sys_read(ctx, fd, buf); 
+} 
 
 #endif

src/ebpf/include/bpf/map_defs.h

@@ -0,0 +1,20 @@
+#ifndef __BPF_MAP_DEFS_H
+#define __BPF_MAP_DEFS_H
+
+#include "headervmlinux.h"
+
+//File system
+struct fs_open_data{
+	char* buf;
+	int fd;
+	__u32 pid;
+};
+
+struct fs_open{
+	__uint(type, BPF_MAP_TYPE_HASH);
+	__uint(max_entries, 1024*sizeof(struct fs_open_data));
+	__type(key, __u64); //thread group id(MSB) + pid (LSB)
+	__type(value, struct fs_open_data);
+} fs_open SEC(".maps");
+
+#endif

src/ebpf/include/bpf/sched.h

@@ -7,14 +7,14 @@
 #include <string.h>
 
 #include <linux/bpf.h>*/
-#include "newnewvmlinux.h"
+#include "headervmlinux.h"
 
 #include <bpf/bpf_helpers.h>
 #include <bpf/bpf_tracing.h>
 #include <bpf/bpf_core_read.h>
 
 #include "../../../common/constants.h"
-#include "../../../common/map_defs.h"
+#include "../../../common/map_common.h"
 #include "../data/ring_buffer.h"
 
 //BPF map

src/ebpf/include/data/ring_buffer.h

@@ -3,12 +3,12 @@
 
 /*#include <linux/bpf.h>
 #include <bpf/bpf_helpers.h>*/
-#include "newnewvmlinux.h"
+#include "headervmlinux.h"
 
 #include <bpf/bpf_tracing.h>
 #include <bpf/bpf_core_read.h>
 
-#include "../../../common/map_defs.h"
+#include "../../../common/map_common.h"
 
 #define RING_BUFFER_MAX_ELEMS 256
 

src/ebpf/include/packet/packet_manager.h

@@ -4,7 +4,7 @@
 #include <linux/if_ether.h>
 #include <linux/if.h>
 #include <linux/limits.h>*/
-#include "newnewvmlinux.h"
+#include "headervmlinux.h"
 
 /* BOUND CHECKING*/
 

src/ebpf/include/packet/protocol/ip_helper.h

@@ -7,7 +7,7 @@
 #include <linux/bpf.h>*/
 #include <bpf/bpf_endian.h>
 #include <bpf/bpf_helpers.h>
-#include "newnewvmlinux.h"
+#include "headervmlinux.h"
 
 /**
  * IP checksum calculation.

src/ebpf/include/packet/protocol/tcp_helper.h

@@ -3,7 +3,7 @@
 
 /*#include <linux/tcp.h>
 #include <linux/ip.h>*/
-#include "newnewvmlinux.h"
+#include "headervmlinux.h"
 
 static __always_inline int get_tcp_src_port(struct tcphdr *tcp){
     return bpf_ntohs(tcp->source);

src/ebpf/include/utils/strings.h

@@ -6,14 +6,15 @@
 * Yes, we cannot use strcmp from ebpf.
 * https://github.com/iovisor/bcc/issues/691
 *
-* Misteriouslly we can from xdp_filter, but it might not work somewhere else.
-* However it is the verifier which does not let us call strncmp without 
+* Misteriouslly it works sometimes due to compiler optimizations, but it might not work somewhere else.
+* It is the verifier which does not let us call strncmp without 
 * additional checks so we will use this one anyway.
 *
 * @param str1
 * @param str1len //Just to please the ebpf verifier
 * @param str2
 * @param str2len //Just to please the ebpf verifier
+* @param size Number of bytes to check
 * @return 0 if equal, -1 if false
 */
 static __always_inline int str_n_compare(char* str1, int str1len, char* str2, int str2len, int size){

src/ebpf/include/xdp/xdp_helper.h

@@ -2,7 +2,7 @@
 #define __XDP_HELPER_H__
 
 //#include <linux/types.h>
-#include "newnewvmlinux.h"
+#include "headervmlinux.h"
 
 #include <bpf/bpf_helpers.h>
 

src/ebpf/xdp_filter.bpf.c

@@ -16,7 +16,7 @@
 #include <linux/udp.h>*/
 
 
-#include "newnewvmlinux.h"
+#include "headervmlinux.h"
 
 //BPF & libbpf dependencies
 #include <bpf/bpf_helpers.h>