further cleanup

elastic · Sep 11, 2024 · ed64454 · ed64454
1 parent 30bc829
commit ed64454
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 9 deletions.
diff --git a/GPL/Events/Network/Network.h b/GPL/Events/Network/Network.h
@@ -14,8 +14,6 @@
 #define AF_INET 2
 #define AF_INET6 10
 
-#define MSG_PEEK 2
-
 static int ebpf_sock_info__fill(struct ebpf_net_info *net, struct sock *sk)
 {
     int err = 0;

diff --git a/GPL/Events/Network/Probe.bpf.c b/GPL/Events/Network/Probe.bpf.c
@@ -48,11 +48,11 @@ static int udp_skb_handle(struct sk_buff *skb, enum ebpf_net_udp_info evt_type)
 {
 
     if (ebpf_events_is_trusted_pid())
-        return 0;
+        goto out;
 
     struct ebpf_dns_event *event = get_event_buffer();
     if (!event)
-        return 0;
+        goto out;
 
     // read from skbuf
     unsigned char *skb_head = BPF_CORE_READ(skb, head);
@@ -127,8 +127,6 @@ static int udp_skb_handle(struct sk_buff *skb, enum ebpf_net_udp_info evt_type)
     event->udp_evt  = evt_type;
     ebpf_ringbuf_write(&ringbuf, event, EVENT_SIZE(event), 0);
 
-    return 0;
-
 out:
     return 0;
 }
@@ -140,7 +138,7 @@ int BPF_PROG(fentry__ip_send_skb, struct net *net, struct sk_buff *skb)
 }
 
 SEC("fentry/skb_consume_udp")
-int BPF_PROG(fexit__skb_consume_udp, struct sock *sk, struct sk_buff *skb, int len)
+int BPF_PROG(fentry__skb_consume_udp, struct sock *sk, struct sk_buff *skb, int len)
 {
     // skip peek operations
     if (len < 0) {
@@ -156,7 +154,7 @@ int BPF_KPROBE(kprobe__ip_send_udp, struct net *net, struct sk_buff *skb)
 }
 
 SEC("kprobe/skb_consume_udp")
-int BPF_KPROBE(kprobe__skb_consume_udp, struct net *net, struct sk_buff *skb)
+int BPF_KPROBE(kprobe__skb_consume_udp, struct net *net, struct sk_buff *skb, int len)
 {
     return udp_skb_handle(skb, EBPF_NETWORK_EVENT_SKB_CONSUME_UDP);
 }

diff --git a/non-GPL/Events/Lib/EbpfEvents.c b/non-GPL/Events/Lib/EbpfEvents.c
@@ -406,7 +406,7 @@ static inline int probe_set_autoload(struct btf *btf, struct EventProbe_bpf *obj
         err = err ?: bpf_program__set_autoload(obj->progs.fexit__vfs_write, false);
         err = err ?: bpf_program__set_autoload(obj->progs.fexit__chown_common, false);
         err = err ?: bpf_program__set_autoload(obj->progs.fentry__ip_send_skb, false);
-        err = err ?: bpf_program__set_autoload(obj->progs.fexit__skb_consume_udp, false);
+        err = err ?: bpf_program__set_autoload(obj->progs.fentry__skb_consume_udp, false);
     }
 
     return err;