bpf linux 使用实例

BPF是Linux内核中的一种虚拟机，可以用于过滤和修改传入的数据包。以下是一个使用BPF的示例程序：tc_demo.c,它演示了如何使用BPF来过滤和修改传入的数据包。

BPF简介

BPF(Berkeley Packet Filter)是一种内核技术，它允许开发者在内核中编写程序，以便对网络数据包进行过滤、分析和修改，BPF技术在Linux内核中得到了广泛应用，网络监控、安全审计、负载均衡等，本文将介绍如何在Linux中使用BPF增强SSH会话的安全审计。

SSH安全审计的重要性

SSH(Secure Shell)是一种加密的网络传输协议，用于在不安全的网络环境中保护数据的安全，随着网络攻击手段的不断升级，SSH协议也可能面临一定的安全隐患，对SSH会话进行安全审计是非常重要的，可以帮助我们发现潜在的安全问题，提高系统的安全性。

使用BPF增强SSH会话的安全审计

1、安装BPF工具链

在开始使用BPF之前，我们需要安装BPF工具链，在Ubuntu系统中，可以通过以下命令安装：

sudo apt-get install bpfcc-tools libbpf-dev

2、编写BPF程序

接下来，我们需要编写一个BPF程序来实现SSH会话的安全审计，创建一个名为ssh_audit.c的文件，并添加以下内容：

include <uapi/linux/ptrace.h>
include <linux/sched.h>
include <bcc/proto.h>
BPF_HASH(start, u32);
BPF_PERF_OUTPUT(events);
int count = 0;
int start_ssh_session(struct pt_regs *ctx) {
    u32 pid = bpf_get_current_pid_tgid();
    u64 ts = bpf_ktime_get_ns();
    start.update(&pid, &ts);
    return 0;
}
int end_ssh_session(struct pt_regs *ctx) {
    u32 pid = bpf_get_current_pid_tgid();
    u64 *tsp, delta;
    tsp = start.lookup(&pid);
    if (tsp == 0) {
        return 0; // not a SSH session for this process
    } else {
        delta = bpf_ktime_get_ns() *tsp;
        events.perf_submit(delta, sizeof(delta));
        start.delete(&pid);
        count++;
    }
    return 0;
}

这个程序定义了两个BPF函数：start_ssh_session和end_ssh_session。start_ssh_session函数在SSH会话开始时被调用，记录当前进程ID和时间戳。end_ssh_session函数在SSH会话结束时被调用，计算会话持续时间，并将结果提交给BPF性能统计器。

3、将BPF程序加载到内核中

为了使BPF程序生效，我们需要将其加载到Linux内核中，可以使用以下命令将ssh_audit.c编译为.o文件：

clang -O2 -emit-llvm -c ssh_audit.c -o ssh_audit.bc

使用bcc工具将.o文件加载到内核中：

sudo bcc ssh_audit.bc --out-file ssh_audit.ko --objdump-file ssh_audit.map --load-dict ssh_audit.dicts --syscalls --output ssh_audit.log --tracer-base=1000000000000000 --tracer-max=1000000000000000 --relocation-model pic --debug-info=false --register-params=false --no-pie --seccomp-mode=unconfined --target=x86_64-pc-linux-gnu --signed-bits=64 --arch=bpfcc-linux-user && sudo chmod +x ssh_audit.ko && sudo sudo kmod load ssh_audit.ko && sudo ulimit -c unlimited && sudo pkill -SIGSTOP tracee && sudo sudo pkill -SIGCONT tracee && sudo sudo pkill tracee && sudo sudo cat /sys/kernel/debug/tracing/events/power/pstate_* | grep '^P' | sort | uniq | tail -n +5 >> ssh_audit.log && sudo cat ssh_audit.log | grep '^[0-9]' | sort | uniq | tail -n +5 >> ssh_audit.log && sudo cat ssh_audit.log | grep '^[a-zA-Z]' | sort | uniq | tail -n +5 >> ssh_audit.log && sudo cat ssh_audit.log | grep '^[@%$&*+=<>]' | sort | uniq | tail -n +5 >> ssh_audit.log && sudo cat ssh_audit.log | grep '^[!?|]' | sort | uniq | tail -n +5 >> ssh_audit.log && sudo cat ssh_audit.log | grep '^[{}]' | sort | uniq | tail -n +5 >> ssh_audit.log && sudo cat ssh_audit.log | grep '^[[:space:]]' | sort | uniq > ssh_audit.txt && sudo chmod +r ssh_audit.txt && sudo umount $(df --local -k | tail -1 | cut -d ' ' -f 1) && sudo exit $count" & sleep $count & wait $count || echo "Failed to load BPF module" & exit $count" & sleep $count & wait $count || echo "Failed to run BPF program" & exit $count" & sleep $count & wait $count || echo "Failed to collect performance data" & exit $count" & sleep $count & wait $count || echo "Failed to generate output file" & exit $count" & sleep $count & wait $count || echo "Failed to execute command" & exit $count" & sleep $count & wait $count || echo "Failed to load kernel module" & exit $count" & sleep $count & wait $count || echo "Failed to unload kernel module" & exit $count" & sleep $count & wait $count || echo "Failed to create log file" & exit $count" & sleep $count & wait $count || echo "Failed to write log file" & exit $count" & sleep $count & wait $count || echo "Failed to close log file" & exit $count" & sleep $count & wait $count || echo "Failed to terminate tracee process" & exit $count" & sleep $count & wait $count || echo "Failed to stop tracee process" & exit $count" & sleep $count & wait $count || echo "Failed to start tracee process with PTRACE syscall" & exit $count" & sleep $count & wait $count || echo "Failed to load BPF program into kernel space" & exit $count" & sleep $count & wait $count || echo "Failed to attach event counters to tracee process" & exit $count" & sleep $count & wait $count || echo "Failed to start tracing with PTRACE syscall" & exit $count" & sleep $count & wait $count || echo "Failed to start tracing with KPROBE syscall" & exit $count" & sleep $count & wait $count || echo "Failed to start tracing with KRETPROBE syscall" & exit $score" & sleep $score" & wait $score || echo "Failed to start tracing with KRETPROBE syscall with ret value of zero" & exit $(($score+1))"& sleep $(($score+1))& wait $(($score+1)))|| echo "Failed to execute command with ret value of zero" >&2 && exit $(($score+1))"; exec bash; exit; make clean; make; sudo insmod ssh_audit.ko; sudo umount $(df --local -k | tail -1 | cut -d ' ' -f 1) && sudo killall tracee && sudo killall ptracedcmd >&2 && exit $(($score+1))); exec bash; exit; make clean; make; sudo insmod ssh_audit.ko; sudo umount $(df --local -k | tail -1 | cut -d ' ' -f 1) && sudo killall tracee && sudo killall ptracedcmd >&2 && exit $(($score+1)); exec bash; exit; make clean; make; sudo insmod ssh_audit.ko; sudo umount $(df --local -k | tail -