How to access a kernel variable using BPF?

Question

For example, to access the skb variable in function ip_rcv:

int ip_rcv(struct sk_buff *skb, struct net_device *dev,
           struct packet_type *pt, struct net_device *orig_dev)
{
...
}

I searched the Internet but cannot find any example.

Answer 1

The easiest way to intercept kernel functions with BPF is probably to use bcc. It offers an higher-level, Python API to load BPF programs in the kernel and interact with them:

#!/usr/bin/env python
from bcc import BPF

BPF(text="""
int kprobe__ip_rcv(struct pt_regs *ctx, struct sk_buff *skb) {
    bpf_trace_printk("skb=%p!\\n", skb);
    return 0;
}
""").trace_print()

Returns:

      <idle>-0     [007] d.s.  1441.065248: : skb=ffff906b2bd53400!
      <idle>-0     [007] d.s.  1442.267325: : skb=ffff906b76c5b700!
      <idle>-0     [007] d.s.  1442.993894: : skb=ffff906b42b76800!
      <idle>-0     [007] d.s.  1443.194334: : skb=ffff906be925d300!
      <idle>-0     [007] d.s.  1444.616469: : skb=ffff906b67e6a200!

For more information, see the tutorial on the bcc repository.

If you don't want to use bcc, you can find examples of BPF programs in the Linux kernel. In particular, I invite you to look into tracex1_kern/user.c.

Answer 2

You can also access it by attaching it to a raw socket such as the program below which tries to filter for and parse an HTTP packet. The C BPF program should look like:

int http_filter(struct __sk_buff *skb) {

u8 *cursor = 0;

struct ethernet_t *ethernet = cursor_advance(cursor, sizeof(*ethernet));
//filter IP packets (ethernet type = 0x0800)
if (!(ethernet->type == 0x0800)) {
    goto DROP;
}

struct ip_t *ip = cursor_advance(cursor, sizeof(*ip));
//filter TCP packets (ip next protocol = 0x06)
if (ip->nextp != IP_TCP) {
    goto DROP;
}

u32  tcp_header_length = 0;
u32  ip_header_length = 0;
u32  payload_offset = 0;
u32  payload_length = 0;
struct Key  key;
struct Leaf zero = {0};

    //calculate ip header length
    //value to multiply * 4
    //e.g. ip->hlen = 5 ; IP Header Length = 5 x 4 byte = 20 byte
    ip_header_length = ip->hlen << 2;    //SHL 2 -> *4 multiply

    //check ip header length against minimum
    if (ip_header_length < sizeof(*ip)) {
            goto DROP;
    }

    //shift cursor forward for dynamic ip header size
    void *_ = cursor_advance(cursor, (ip_header_length-sizeof(*ip)));

struct tcp_t *tcp = cursor_advance(cursor, sizeof(*tcp));

//retrieve ip src/dest and port src/dest of current packet
//and save it into struct Key
key.dst_ip = ip->dst;
key.src_ip = ip->src;
key.dst_port = tcp->dst_port;
key.src_port = tcp->src_port;

//calculate tcp header length
//value to multiply *4
//e.g. tcp->offset = 5 ; TCP Header Length = 5 x 4 byte = 20 byte
tcp_header_length = tcp->offset << 2; //SHL 2 -> *4 multiply

//calculate payload offset and length
payload_offset = ETH_HLEN + ip_header_length + tcp_header_length;
payload_length = ip->tlen - ip_header_length - tcp_header_length;

//http://stackoverflow.com/questions/25047905/http-request-minimum-size-in-bytes
//minimum length of http request is always geater than 7 bytes
//avoid invalid access memory
//include empty payload
if(payload_length < 7) {
    goto DROP;
}

//load first 7 byte of payload into p (payload_array)
//direct access to skb not allowed
unsigned long p[7];
int i = 0;
for (i = 0; i < 7; i++) {
    p[i] = load_byte(skb , payload_offset + i);
}

}

The Python script attaching the program should look like this: while 1: #retrieve raw packet from socket packet_str = os.read(socket_fd,4096)