diff --git a/ebpf_prog/opensnitch-dns.c b/ebpf_prog/opensnitch-dns.c
index f080b7ee96..890b2d893f 100644
--- a/ebpf_prog/opensnitch-dns.c
+++ b/ebpf_prog/opensnitch-dns.c
@@ -1,4 +1,24 @@
-#define KBUILD_MODNAME "dummy"
+/* Copyright (C) 2022 calesanz
+// 2023-2024 Gustavo IƱiguez Goya
+//
+// This file is part of OpenSnitch.
+//
+// OpenSnitch is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// OpenSnitch is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with OpenSnitch. If not, see .
+*/
+
+
+#define KBUILD_MODNAME "opensnitch-dns"
#include
#include
@@ -51,7 +71,7 @@ struct addrinfo_args_cache {
// define temporary array for data
struct bpf_map_def SEC("maps/addrinfo_args_hash") addrinfo_args_hash = {
.type = BPF_MAP_TYPE_HASH,
- .max_entries = MAPSIZE,
+ .max_entries = 256, // max entries at any time
.key_size = sizeof(u32),
.value_size = sizeof(struct addrinfo_args_cache),
};
@@ -61,7 +81,7 @@ struct bpf_map_def SEC("maps/events") events = {
.type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
.key_size = sizeof(u32),
.value_size = sizeof(u32),
- .max_entries = MAPSIZE,
+ .max_entries = 256, // max cpus
};
/**
@@ -170,7 +190,7 @@ int ret_addrinfo(struct pt_regs *ctx) {
struct addrinfo *res;
bpf_probe_read(&res, sizeof(res), res_p);
if (res == NULL) {
- return 0;
+ goto out;
}
bpf_probe_read(&data.addr_type, sizeof(data.addr_type),
&res->ai_family);
@@ -186,7 +206,7 @@ int ret_addrinfo(struct pt_regs *ctx) {
bpf_probe_read_user(&data.ip, sizeof(data.ip), &ipv6->sin6_addr);
} else {
- return 1;
+ goto out;
}
bpf_probe_read_kernel_str(&data.host, sizeof(data.host),
@@ -198,9 +218,15 @@ int ret_addrinfo(struct pt_regs *ctx) {
struct addrinfo * next;
bpf_probe_read(&next, sizeof(next), &res->ai_next);
+ if (next == NULL){
+ goto out;
+ }
res_p = &next;
}
+out:
+ bpf_map_delete_elem(&addrinfo_args_hash, &tid);
+
return 0;
}