diff --git a/pkg/network/ebpf/c/protocols/flush.h b/pkg/network/ebpf/c/protocols/flush.h index 95a28b6fd291c..dc13d6ec9b698 100644 --- a/pkg/network/ebpf/c/protocols/flush.h +++ b/pkg/network/ebpf/c/protocols/flush.h @@ -28,4 +28,12 @@ int tracepoint__net__netif_receive_skb(void *ctx) { return 0; } +SEC("raw_tracepoint/net/netif_receive_skb") +int BPF_PROG(raw_tracepoint__net__netif_receive_skb) { + CHECK_BPF_PROGRAM_BYPASSED() + log_debug("raw_tracepoint/net/netif_receive_skb"); + flush(ctx); + return 0; +} + #endif diff --git a/pkg/network/usm/ebpf_main.go b/pkg/network/usm/ebpf_main.go index e44ae89e8868a..277d4f0e672b2 100644 --- a/pkg/network/usm/ebpf_main.go +++ b/pkg/network/usm/ebpf_main.go @@ -14,10 +14,12 @@ import ( "slices" "unsafe" - manager "github.com/DataDog/ebpf-manager" "github.com/cilium/ebpf" + "github.com/cilium/ebpf/features" "github.com/davecgh/go-spew/spew" + manager "github.com/DataDog/ebpf-manager" + ddebpf "github.com/DataDog/datadog-agent/pkg/ebpf" "github.com/DataDog/datadog-agent/pkg/ebpf/bytecode" "github.com/DataDog/datadog-agent/pkg/ebpf/prebuilt" @@ -67,6 +69,9 @@ const ( sockFDLookup = "kprobe__sockfd_lookup_light" sockFDLookupRet = "kretprobe__sockfd_lookup_light" + netifReceiveSkbTp = "tracepoint__net__netif_receive_skb" + netifReceiveSkbRawTp = "raw_tracepoint__net__netif_receive_skb" + tcpCloseProbe = "kprobe__tcp_close" // maxActive configures the maximum number of instances of the @@ -90,6 +95,23 @@ type ebpfProgram struct { } func newEBPFProgram(c *config.Config, connectionProtocolMap *ebpf.Map) (*ebpfProgram, error) { + netifProbe := manager.Probe{ + ProbeIdentificationPair: manager.ProbeIdentificationPair{ + EBPFFuncName: netifReceiveSkbTp, + UID: probeUID, + }, + } + if features.HaveProgramType(ebpf.RawTracepoint) == nil { + netifProbe = manager.Probe{ + ProbeIdentificationPair: manager.ProbeIdentificationPair{ + EBPFFuncName: netifReceiveSkbRawTp, + UID: probeUID, + }, + TracepointCategory: "net", + TracepointName: "netif_receive_skb", + } + } + mgr := &manager.Manager{ Maps: []*manager.Map{ {Name: protocols.TLSDispatcherProgramsMap}, @@ -114,12 +136,7 @@ func newEBPFProgram(c *config.Config, connectionProtocolMap *ebpf.Map) (*ebpfPro UID: probeUID, }, }, - { - ProbeIdentificationPair: manager.ProbeIdentificationPair{ - EBPFFuncName: "tracepoint__net__netif_receive_skb", - UID: probeUID, - }, - }, + &netifProbe, { ProbeIdentificationPair: manager.ProbeIdentificationPair{ EBPFFuncName: protocolDispatcherSocketFilterFunction, @@ -462,6 +479,13 @@ func (e *ebpfProgram) init(buf bytecode.AssetReader, options manager.Options) er } } + // exclude unused netif_receive_skb probe + if features.HaveProgramType(ebpf.RawTracepoint) == nil { + options.ExcludedFunctions = append(options.ExcludedFunctions, netifReceiveSkbTp) + } else { + options.ExcludedFunctions = append(options.ExcludedFunctions, netifReceiveSkbRawTp) + } + err := e.InitWithOptions(buf, &options) if err != nil { cleanup()