运行此ebpf代码时出现"权限被拒绝"错误消息

Question

运行xdp.py文件时出现此错误

bpf: Failed to load program: Permission denied
; int dropper(struct xdp_md *ctx) {
0: (b7) r6 = 2
; void *data_end = (void *)(long)ctx->data_end;
1: (61) r2 = *(u32 *)(r1 +4)
; void *data = (void *)(long)ctx->data;
2: (61) r1 = *(u32 *)(r1 +0)
; if (data + ipsize > data_end) {
3: (bf) r3 = r1
4: (07) r3 += 34
; if (data + ipsize > data_end) {
5: (2d) if r3 > r2 goto pc+21
R1_w=pkt(id=0,off=0,r=34,imm=0) R2_w=pkt_end(id=0,off=0,imm=0) R3_w=pkt(id=0,off=34,r=34,imm=0) R6_w=inv2 R10=fp0
; if (ip->protocol == IPPROTO_TCP) {
6: (71) r2 = *(u8 *)(r1 +23)
; if (ip->protocol == IPPROTO_TCP) {
7: (55) if r2 != 0x6 goto pc+19
R1_w=pkt(id=0,off=0,r=34,imm=0) R2_w=inv6 R3_w=pkt(id=0,off=34,r=34,imm=0) R6_w=inv2 R10=fp0
8: (b7) r6 = 1
; if (ntohs(tcp->dest) == 4040){
9: (69) r1 = *(u16 *)(r1 +96)
invalid access to packet, off=96 size=2, R1(id=0,off=96,r=34)
R1 offset is outside of the packet
processed 10 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
Traceback (most recent call last):
File "/home/kali/Documents/assignment/xdp.py", line 6, in <module>
fn = b.load_func("dropper", BPF.XDP)
File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 527, in load_func
raise Exception("Failed to load BPF program %s: %s" %
Exception: Failed to load BPF program b'dropper': Permission denied

这是我的xdp.py代码

from bcc import BPF #1
from bcc.utils import printb
device = "lo" 
b = BPF(src_file="dropper.c") 
fn = b.load_func("dropper", BPF.XDP)
b.attach_xdp(device, fn, 0) 
b.trace_print()
b.remove_xdp(device, 0)

这是我的滴管。c代码

#include <linux/bpf.h>
#include <linux/in.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/pkt_cls.h>
#include <linux/tcp.h>
#define SEC(NAME) __attribute__((section(NAME), used))
#undef ntohs
#define ntohs(val) ((val)&0x00ff <<8 | (val)&0xff00 >>8)
SEC("dropper_main")
int dropper(struct xdp_md *ctx) {
int ipsize = 0;
void *data = (void *)(long)ctx->data;
void *data_end = (void *)(long)ctx->data_end;
struct ethhdr *eth = data;
ipsize = sizeof(*eth);
struct iphdr *ip = data + ipsize;
ipsize += sizeof(struct iphdr);

if (data + ipsize > data_end) {
return XDP_PASS;
}
if (ip->protocol == IPPROTO_TCP) {
struct tcphdr *tcp = (struct tcphdr *)((__u32 *)ip + sizeof(*ip));
//bpf_trace_printk("Packet dropped");
if (ntohs(tcp->dest) == 4040){
bpf_trace_printk("Packet dropped at 4040");
}
return XDP_DROP;
}
return XDP_PASS;
}

如果数据包落在Tcp端口4040中，我正在尝试打印"数据包已丢弃"消息。无论何时在Tcp端口上发送数据包，我都能够实现数据包丢弃消息，但不能仅针对端口4040实现结果。

Answer 1

在访问该标头之前，您需要检查数据包是否足够长，以具有TCP标头，就像在访问协议字段之前检查数据包的长度是否足够长以具有IP标头一样。