diff --git a/ebpf_prog/opensnitch-dns.c b/ebpf_prog/opensnitch-dns.c index f080b7ee96..890b2d893f 100644 --- a/ebpf_prog/opensnitch-dns.c +++ b/ebpf_prog/opensnitch-dns.c @@ -1,4 +1,24 @@ -#define KBUILD_MODNAME "dummy" +/* Copyright (C) 2022 calesanz +// 2023-2024 Gustavo IƱiguez Goya +// +// This file is part of OpenSnitch. +// +// OpenSnitch is free software: you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation, either version 3 of the License, or +// (at your option) any later version. +// +// OpenSnitch is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with OpenSnitch. If not, see . +*/ + + +#define KBUILD_MODNAME "opensnitch-dns" #include #include @@ -51,7 +71,7 @@ struct addrinfo_args_cache { // define temporary array for data struct bpf_map_def SEC("maps/addrinfo_args_hash") addrinfo_args_hash = { .type = BPF_MAP_TYPE_HASH, - .max_entries = MAPSIZE, + .max_entries = 256, // max entries at any time .key_size = sizeof(u32), .value_size = sizeof(struct addrinfo_args_cache), }; @@ -61,7 +81,7 @@ struct bpf_map_def SEC("maps/events") events = { .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY, .key_size = sizeof(u32), .value_size = sizeof(u32), - .max_entries = MAPSIZE, + .max_entries = 256, // max cpus }; /** @@ -170,7 +190,7 @@ int ret_addrinfo(struct pt_regs *ctx) { struct addrinfo *res; bpf_probe_read(&res, sizeof(res), res_p); if (res == NULL) { - return 0; + goto out; } bpf_probe_read(&data.addr_type, sizeof(data.addr_type), &res->ai_family); @@ -186,7 +206,7 @@ int ret_addrinfo(struct pt_regs *ctx) { bpf_probe_read_user(&data.ip, sizeof(data.ip), &ipv6->sin6_addr); } else { - return 1; + goto out; } bpf_probe_read_kernel_str(&data.host, sizeof(data.host), @@ -198,9 +218,15 @@ int ret_addrinfo(struct pt_regs *ctx) { struct addrinfo * next; bpf_probe_read(&next, sizeof(next), &res->ai_next); + if (next == NULL){ + goto out; + } res_p = &next; } +out: + bpf_map_delete_elem(&addrinfo_args_hash, &tid); + return 0; }