1 // SPDX-License-Identifier: GPL-2.0 2 #include "vmlinux.h" 3 #include <bpf/bpf_helpers.h> 4 #include <bpf/bpf_tracing.h> 5 #include <bpf/bpf_core_read.h> 6 #include "bpf_misc.h" 7 8 struct test_pro_bss { 9 struct sockaddr_in old; 10 __u32 test_pid; 11 }; 12 13 struct test_pro_bss bss; 14 15 static int handle_sys_connect_common(struct sockaddr_in *uservaddr) 16 { 17 struct sockaddr_in new; 18 __u32 cur = bpf_get_current_pid_tgid() >> 32; 19 20 if (bss.test_pid && cur != bss.test_pid) 21 return 0; 22 23 bpf_probe_read_user(&bss.old, sizeof(bss.old), uservaddr); 24 __builtin_memset(&new, 0xab, sizeof(new)); 25 bpf_probe_write_user(uservaddr, &new, sizeof(new)); 26 27 return 0; 28 } 29 30 SEC("ksyscall/connect") 31 int BPF_KSYSCALL(handle_sys_connect, int fd, struct sockaddr_in *uservaddr, 32 int addrlen) 33 { 34 return handle_sys_connect_common(uservaddr); 35 } 36 37 #if defined(bpf_target_s390) 38 #ifndef SYS_CONNECT 39 #define SYS_CONNECT 3 40 #endif 41 42 SEC("ksyscall/socketcall") 43 int BPF_KSYSCALL(handle_sys_socketcall, int call, unsigned long *args) 44 { 45 if (call == SYS_CONNECT) { 46 struct sockaddr_in *uservaddr; 47 48 bpf_probe_read_user(&uservaddr, sizeof(uservaddr), &args[1]); 49 return handle_sys_connect_common(uservaddr); 50 } 51 52 return 0; 53 } 54 #endif 55 56 char _license[] SEC("license") = "GPL"; 57