rbbcc 0.9.1 → 0.11.0.pre
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/ci-image.yml +69 -0
- data/.github/workflows/ci.yml +7 -5
- data/Dockerfile.ci +88 -86
- data/Gemfile +8 -8
- data/Gemfile.lock +6 -27
- data/Makefile +15 -0
- data/ci/Dockerfile.ci_base +4 -0
- data/examples/dns_blocker.rb +133 -0
- data/lib/rbbcc/bcc.rb +18 -2
- data/lib/rbbcc/clib.rb +2 -1
- data/lib/rbbcc/version.rb +1 -1
- data/rbbcc.gemspec +2 -0
- metadata +21 -4
- data/semaphore.sh +0 -73
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 1c5cbecb6f86bc56c109433915be6daea255c5578145372e7fef05e643c74f22
|
|
4
|
+
data.tar.gz: 73b4dcb08ed7882ffd905f44b3662e1f26fbc7075b9e832c29f44701304b1826
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: ce916936932a3a0bb00bf28b3bd67d55b2d2068e0d4d05308296d472306db0ffae3dd495a441189fdcfe0db0c29705a389f31781f0e3971f1ef349b1d0eb4a1f
|
|
7
|
+
data.tar.gz: 15da5d9cd65ec31dd5a3fd1b3b87ce76edf4c40805f2cb800bbb5178300ec003975aea1bff084e740a1a8820a8137701692c861188bd9b85cbd31a971caf5535
|
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
name: Build and Push CI Image
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
workflow_dispatch:
|
|
5
|
+
inputs:
|
|
6
|
+
bcc_version:
|
|
7
|
+
description: 'BCC Version (e.g., 0.35.0)'
|
|
8
|
+
required: true
|
|
9
|
+
default: '0.35.0'
|
|
10
|
+
ruby_version:
|
|
11
|
+
description: 'Ruby Version (e.g., 4.0.2)'
|
|
12
|
+
required: true
|
|
13
|
+
default: '4.0.2'
|
|
14
|
+
push_image:
|
|
15
|
+
description: 'Push image to registry?'
|
|
16
|
+
type: boolean
|
|
17
|
+
default: true
|
|
18
|
+
|
|
19
|
+
jobs:
|
|
20
|
+
build:
|
|
21
|
+
runs-on: ubuntu-latest
|
|
22
|
+
|
|
23
|
+
permissions:
|
|
24
|
+
contents: read
|
|
25
|
+
packages: write
|
|
26
|
+
|
|
27
|
+
steps:
|
|
28
|
+
- name: Check user permission
|
|
29
|
+
uses: actions-cool/check-user-permission@v2
|
|
30
|
+
with:
|
|
31
|
+
require: 'write'
|
|
32
|
+
|
|
33
|
+
- name: Checkout repository
|
|
34
|
+
uses: actions/checkout@v4
|
|
35
|
+
- name: Set up Docker Buildx
|
|
36
|
+
uses: docker/setup-buildx-action@v3
|
|
37
|
+
|
|
38
|
+
- name: Login to GitHub Container Registry
|
|
39
|
+
uses: docker/login-action@v3
|
|
40
|
+
with:
|
|
41
|
+
registry: ghcr.io
|
|
42
|
+
username: ${{ github.actor }}
|
|
43
|
+
password: ${{ secrets.DOCKERHUB_WRITE_TOKEN }}
|
|
44
|
+
|
|
45
|
+
- name: Build
|
|
46
|
+
run: |
|
|
47
|
+
docker buildx build \
|
|
48
|
+
--platform linux/amd64 \
|
|
49
|
+
--build-arg BCC_VERSION=${{ inputs.bcc_version }} \
|
|
50
|
+
--build-arg RUBY_VERSION=${{ inputs.ruby_version }} \
|
|
51
|
+
-t ghcr.io/udzura/rbbcc-ci-images:libbcc-${{ inputs.bcc_version }}-ruby-${{ inputs.ruby_version }} \
|
|
52
|
+
--file Dockerfile.ci \
|
|
53
|
+
--load .
|
|
54
|
+
|
|
55
|
+
- name: Push
|
|
56
|
+
if: ${{ inputs.push_image }}
|
|
57
|
+
run: |
|
|
58
|
+
docker push \
|
|
59
|
+
ghcr.io/udzura/rbbcc-ci-images:libbcc-${{ inputs.bcc_version }}-ruby-${{ inputs.ruby_version }}
|
|
60
|
+
|
|
61
|
+
- name: Build Summary
|
|
62
|
+
run: |
|
|
63
|
+
echo "### Build Completed 🚀" >> $GITHUB_STEP_SUMMARY
|
|
64
|
+
echo "- **BCC Version**: ${{ inputs.bcc_version }}" >> $GITHUB_STEP_SUMMARY
|
|
65
|
+
echo "- **Ruby Version**: ${{ inputs.ruby_version }}" >> $GITHUB_STEP_SUMMARY
|
|
66
|
+
echo "- **Pushed**: ${{ inputs.push_image }}" >> $GITHUB_STEP_SUMMARY
|
|
67
|
+
if [ "${{ inputs.push_image }}" = "true" ]; then
|
|
68
|
+
echo "- **Image URL**: \`ghcr.io/udzura/rbbcc-ci-images:libbcc-${{ inputs.bcc_version }}-ruby-${{ inputs.ruby_version }}\`" >> $GITHUB_STEP_SUMMARY
|
|
69
|
+
fi
|
data/.github/workflows/ci.yml
CHANGED
|
@@ -9,19 +9,21 @@ jobs:
|
|
|
9
9
|
test:
|
|
10
10
|
strategy:
|
|
11
11
|
matrix:
|
|
12
|
-
libbcc_version: [0.
|
|
13
|
-
ruby_version: [
|
|
12
|
+
libbcc_version: [0.29.0, 0.31.0, 0.35.0]
|
|
13
|
+
ruby_version: [4.0.2]
|
|
14
14
|
|
|
15
15
|
runs-on: ubuntu-latest
|
|
16
16
|
steps:
|
|
17
17
|
- uses: actions/checkout@v2
|
|
18
18
|
- name: Login to ghcr.io
|
|
19
19
|
run: |
|
|
20
|
-
echo ${{ secrets.CR_PAT }} | docker login ghcr.io -u udzura
|
|
20
|
+
echo ${{ secrets.CR_PAT }} | docker login ghcr.io -u udzura --password-stdin
|
|
21
21
|
- name: Build docker container with all deps
|
|
22
22
|
run: |
|
|
23
23
|
docker build -t rbbcc-ci-${{ matrix.libbcc_version }}-${{ matrix.ruby_version }} \
|
|
24
|
-
-
|
|
24
|
+
--build-arg BCC_VERSION=${{ matrix.libbcc_version }} \
|
|
25
|
+
--build-arg RUBY_VERSION=${{ matrix.ruby_version }} \
|
|
26
|
+
-f ci/Dockerfile.ci_base ci/
|
|
25
27
|
- name: Run test
|
|
26
28
|
run: |
|
|
27
29
|
/bin/bash -c \
|
|
@@ -34,5 +36,5 @@ jobs:
|
|
|
34
36
|
-v /usr/include/linux:/usr/include/linux:ro \
|
|
35
37
|
rbbcc-ci-${{ matrix.libbcc_version }}-${{ matrix.ruby_version }} \
|
|
36
38
|
/bin/bash -c \
|
|
37
|
-
'cd /rbbcc && bundle install && bundle exec rake test'"
|
|
39
|
+
'cd /rbbcc && git config --global --add safe.directory /rbbcc && bundle install && bundle exec rake test'"
|
|
38
40
|
|
data/Dockerfile.ci
CHANGED
|
@@ -1,98 +1,100 @@
|
|
|
1
|
-
# ref: https://github.com/iovisor/bcc/blob/master/Dockerfile.
|
|
2
|
-
FROM ubuntu:
|
|
1
|
+
# ref: https://github.com/iovisor/bcc/blob/master/docker/build/Dockerfile.ubuntu
|
|
2
|
+
FROM ubuntu:24.04
|
|
3
3
|
|
|
4
|
-
ENV
|
|
4
|
+
ENV DEBIAN_FRONTEND=noninteractive
|
|
5
5
|
|
|
6
|
-
|
|
6
|
+
ENV LLVM_VERSION="18"
|
|
7
|
+
|
|
8
|
+
ARG BCC_VERSION="0.29.0"
|
|
7
9
|
ENV BCC_VERSION=$BCC_VERSION
|
|
8
10
|
|
|
9
|
-
ARG RUBY_VERSION="
|
|
11
|
+
ARG RUBY_VERSION="4.0.2"
|
|
10
12
|
ENV RUBY_VERSION=$RUBY_VERSION
|
|
11
13
|
|
|
12
|
-
ARG RUBY_VERSION_ARCHIVE="ruby-${RUBY_VERSION}.tar.bz2"
|
|
13
|
-
ENV RUBY_VERSION_ARCHIVE=$RUBY_VERSION_ARCHIVE
|
|
14
|
-
|
|
15
14
|
ARG RUBY_EXTRA_OPTS=""
|
|
16
15
|
ENV RUBY_EXTRA_OPTS=$RUBY_EXTRA_OPTS
|
|
17
16
|
|
|
18
17
|
ARG BCC_EXTRA_OPTS=""
|
|
19
18
|
ENV BCC_EXTRA_OPTS=$BCC_EXTRA_OPTS
|
|
20
19
|
|
|
21
|
-
RUN apt-get update && apt-get install -y
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
20
|
+
RUN apt-get update && apt-get install -y \
|
|
21
|
+
curl \
|
|
22
|
+
gnupg \
|
|
23
|
+
util-linux \
|
|
24
|
+
bison \
|
|
25
|
+
cmake \
|
|
26
|
+
flex \
|
|
27
|
+
g++ \
|
|
28
|
+
make \
|
|
29
|
+
git \
|
|
30
|
+
kmod \
|
|
31
|
+
wget \
|
|
32
|
+
sudo \
|
|
33
|
+
iproute2 \
|
|
34
|
+
iputils-ping \
|
|
35
|
+
bridge-utils \
|
|
36
|
+
libncurses-dev \
|
|
37
|
+
libssl-dev \
|
|
38
|
+
libreadline-dev \
|
|
39
|
+
zlib1g-dev \
|
|
40
|
+
libyaml-dev \
|
|
41
|
+
libffi-dev \
|
|
42
|
+
libdebuginfod1 \
|
|
43
|
+
libelf1 \
|
|
44
|
+
liblzma5 \
|
|
45
|
+
binutils-dev \
|
|
46
|
+
libelf-dev \
|
|
47
|
+
libiberty-dev \
|
|
48
|
+
libbfd-dev \
|
|
49
|
+
libedit-dev \
|
|
50
|
+
libfl-dev \
|
|
51
|
+
liblzma-dev \
|
|
52
|
+
libdebuginfod-dev \
|
|
53
|
+
python3 \
|
|
54
|
+
python3-setuptools \
|
|
55
|
+
clang-${LLVM_VERSION} \
|
|
56
|
+
libclang-${LLVM_VERSION}-dev \
|
|
57
|
+
libclang-common-${LLVM_VERSION}-dev \
|
|
58
|
+
libclang1-${LLVM_VERSION} \
|
|
59
|
+
llvm-${LLVM_VERSION} \
|
|
60
|
+
llvm-${LLVM_VERSION}-dev \
|
|
61
|
+
llvm-${LLVM_VERSION}-runtime \
|
|
62
|
+
libllvm${LLVM_VERSION} \
|
|
63
|
+
libpolly-${LLVM_VERSION}-dev \
|
|
64
|
+
systemtap-sdt-dev
|
|
65
|
+
|
|
66
|
+
RUN wget -O ruby-install-0.9.3.tar.gz https://github.com/postmodern/ruby-install/archive/v0.9.3.tar.gz && \
|
|
67
|
+
tar -xzvf ruby-install-0.9.3.tar.gz && \
|
|
68
|
+
cd ruby-install-0.9.3/ && make install && \
|
|
69
|
+
ruby-install --system ruby $RUBY_VERSION && \
|
|
70
|
+
cd / && rm -rf ruby-install-0.9.3*
|
|
71
|
+
|
|
72
|
+
RUN git config --global user.name 'udzura' && git config --global user.email 'udzura@udzura.jp' && \
|
|
73
|
+
wget -O bcc-$BCC_VERSION.tar.gz https://github.com/iovisor/bcc/releases/download/v$BCC_VERSION/bcc-src-with-submodule.tar.gz && \
|
|
74
|
+
tar -xzvf bcc-$BCC_VERSION.tar.gz && \
|
|
75
|
+
cd bcc/ && \
|
|
76
|
+
git config --global --add safe.directory /bcc && \
|
|
77
|
+
git init . && git add . && git commit -m 'Dummy' && git tag v$BCC_VERSION && \
|
|
78
|
+
mkdir build && cd build/ && \
|
|
79
|
+
cmake -DCMAKE_BUILD_TYPE=Release .. && \
|
|
80
|
+
cd src/cc && make -j$(nproc) && make install && \
|
|
81
|
+
cd / && rm -rf bcc/ bcc-$BCC_VERSION.tar.gz
|
|
82
|
+
|
|
83
|
+
RUN apt-get remove --purge -y \
|
|
84
|
+
binutils-dev \
|
|
85
|
+
libiberty-dev \
|
|
86
|
+
libbfd-dev \
|
|
87
|
+
libedit-dev \
|
|
88
|
+
libfl-dev \
|
|
89
|
+
liblzma-dev \
|
|
90
|
+
libdebuginfod-dev \
|
|
91
|
+
clang-${LLVM_VERSION} \
|
|
92
|
+
libclang-${LLVM_VERSION}-dev \
|
|
93
|
+
libclang-common-${LLVM_VERSION}-dev \
|
|
94
|
+
llvm-${LLVM_VERSION}-dev \
|
|
95
|
+
libllvm${LLVM_VERSION} \
|
|
96
|
+
libpolly-${LLVM_VERSION}-dev \
|
|
97
|
+
systemtap-sdt-dev && \
|
|
98
|
+
apt autoremove -y && \
|
|
99
|
+
apt-get clean -y && \
|
|
100
|
+
rm -rf /var/lib/apt/lists/*
|
data/Gemfile
CHANGED
|
@@ -6,13 +6,13 @@ gemspec
|
|
|
6
6
|
gem "bundler", "~> 2.0"
|
|
7
7
|
gem "rake", "~> 13.0"
|
|
8
8
|
gem "pry", "~> 0.12"
|
|
9
|
-
gem "minitest", "
|
|
9
|
+
gem "minitest", "~> 5"
|
|
10
10
|
|
|
11
|
-
group :omnibus_package do
|
|
12
|
-
gem "appbundler"
|
|
13
|
-
gem "specific_install"
|
|
14
|
-
end
|
|
11
|
+
#group :omnibus_package do
|
|
12
|
+
# gem "appbundler"
|
|
13
|
+
# gem "specific_install"
|
|
14
|
+
#end
|
|
15
15
|
|
|
16
|
-
group :plugin_dev do
|
|
17
|
-
gem "rbbcc-hello", git: "https://github.com/udzura/rbbcc-hello.git"
|
|
18
|
-
end
|
|
16
|
+
#group :plugin_dev do
|
|
17
|
+
# gem "rbbcc-hello", git: "https://github.com/udzura/rbbcc-hello.git"
|
|
18
|
+
#end
|
data/Gemfile.lock
CHANGED
|
@@ -1,35 +1,17 @@
|
|
|
1
|
-
GIT
|
|
2
|
-
remote: https://github.com/udzura/rbbcc-hello.git
|
|
3
|
-
revision: 2e1af47d22e7cc92e970dc6c058e113cf00821db
|
|
4
|
-
specs:
|
|
5
|
-
rbbcc-hello (0.1.0)
|
|
6
|
-
rbbcc
|
|
7
|
-
|
|
8
1
|
PATH
|
|
9
2
|
remote: .
|
|
10
3
|
specs:
|
|
11
|
-
rbbcc (0.
|
|
4
|
+
rbbcc (0.11.0.pre)
|
|
5
|
+
fiddle
|
|
12
6
|
|
|
13
7
|
GEM
|
|
14
8
|
remote: https://rubygems.org/
|
|
15
9
|
specs:
|
|
16
|
-
appbundler (0.13.4)
|
|
17
|
-
mixlib-cli (>= 1.4, < 3.0)
|
|
18
|
-
mixlib-shellout (>= 2.0, < 4.0)
|
|
19
|
-
chef-utils (19.2.12)
|
|
20
|
-
concurrent-ruby
|
|
21
10
|
coderay (1.1.3)
|
|
22
|
-
|
|
23
|
-
drb (2.2.3)
|
|
11
|
+
fiddle (1.1.8)
|
|
24
12
|
io-console (0.8.2)
|
|
25
13
|
method_source (1.1.0)
|
|
26
|
-
minitest (
|
|
27
|
-
drb (~> 2.0)
|
|
28
|
-
prism (~> 1.5)
|
|
29
|
-
mixlib-cli (2.1.8)
|
|
30
|
-
mixlib-shellout (3.4.10)
|
|
31
|
-
chef-utils
|
|
32
|
-
prism (1.9.0)
|
|
14
|
+
minitest (5.27.0)
|
|
33
15
|
pry (0.16.0)
|
|
34
16
|
coderay (~> 1.1)
|
|
35
17
|
method_source (~> 1.0)
|
|
@@ -37,22 +19,19 @@ GEM
|
|
|
37
19
|
rake (13.3.1)
|
|
38
20
|
reline (0.6.3)
|
|
39
21
|
io-console (~> 0.5)
|
|
40
|
-
specific_install (0.3.8)
|
|
41
22
|
|
|
42
23
|
PLATFORMS
|
|
43
24
|
aarch64-linux
|
|
44
25
|
arm64-darwin-21
|
|
26
|
+
arm64-darwin-24
|
|
45
27
|
arm64-darwin-25
|
|
46
28
|
|
|
47
29
|
DEPENDENCIES
|
|
48
|
-
appbundler
|
|
49
30
|
bundler (~> 2.0)
|
|
50
|
-
minitest (
|
|
31
|
+
minitest (~> 5)
|
|
51
32
|
pry (~> 0.12)
|
|
52
33
|
rake (~> 13.0)
|
|
53
34
|
rbbcc!
|
|
54
|
-
rbbcc-hello!
|
|
55
|
-
specific_install
|
|
56
35
|
|
|
57
36
|
BUNDLED WITH
|
|
58
37
|
2.3.16
|
data/Makefile
ADDED
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
ci-base-all:
|
|
2
|
+
@docker buildx build --platform linux/amd64/v3 -t ghcr.io/udzura/rbbcc-ci-images:libbcc-0.29.0-ruby-4.0.2 --file Dockerfile.ci --load .
|
|
3
|
+
@docker buildx build --platform linux/amd64/v3 --build-arg RUBY_VERSION=3.4.9 -t ghcr.io/udzura/rbbcc-ci-images:libbcc-0.29.0-ruby-3.4.9 --file Dockerfile.ci --load .
|
|
4
|
+
@docker buildx build --platform linux/amd64/v3 --build-arg BCC_VERSION=0.31.0 -t ghcr.io/udzura/rbbcc-ci-images:libbcc-0.31.0-ruby-4.0.2 --file Dockerfile.ci --load .
|
|
5
|
+
@docker buildx build --platform linux/amd64/v3 --build-arg BCC_VERSION=0.31.0 --build-arg RUBY_VERSION=3.4.9 -t ghcr.io/udzura/rbbcc-ci-images:libbcc-0.31.0-ruby-3.4.9 --file Dockerfile.ci --load .
|
|
6
|
+
@docker buildx build --platform linux/amd64/v3 --build-arg BCC_VERSION=0.35.0 -t ghcr.io/udzura/rbbcc-ci-images:libbcc-0.35.0-ruby-4.0.2 --file Dockerfile.ci --load .
|
|
7
|
+
@docker buildx build --platform linux/amd64/v3 --build-arg BCC_VERSION=0.35.0 --build-arg RUBY_VERSION=3.4.9 -t ghcr.io/udzura/rbbcc-ci-images:libbcc-0.35.0-ruby-3.4.9 --file Dockerfile.ci --load .
|
|
8
|
+
|
|
9
|
+
push-base-all:
|
|
10
|
+
@docker push ghcr.io/udzura/rbbcc-ci-images:libbcc-0.29.0-ruby-4.0.2
|
|
11
|
+
@docker push ghcr.io/udzura/rbbcc-ci-images:libbcc-0.29.0-ruby-3.4.9
|
|
12
|
+
@docker push ghcr.io/udzura/rbbcc-ci-images:libbcc-0.31.0-ruby-4.0.2
|
|
13
|
+
@docker push ghcr.io/udzura/rbbcc-ci-images:libbcc-0.31.0-ruby-3.4.9
|
|
14
|
+
@docker push ghcr.io/udzura/rbbcc-ci-images:libbcc-0.35.0-ruby-4.0.2
|
|
15
|
+
@docker push ghcr.io/udzura/rbbcc-ci-images:libbcc-0.35.0-ruby-3.4.9
|
|
@@ -0,0 +1,133 @@
|
|
|
1
|
+
#!/usr/bin/env ruby
|
|
2
|
+
#
|
|
3
|
+
# dns_blocker.rb Block DNS queries for a specified domain using TC/eBPF.
|
|
4
|
+
#
|
|
5
|
+
# Uses TC clsact qdisc and attaches a SCHED_CLS BPF program to the
|
|
6
|
+
# egress path. Because pyroute2 is unavailable in Ruby, the BPF
|
|
7
|
+
# program is pinned to /sys/fs/bpf and attached via the `tc` shell
|
|
8
|
+
# command.
|
|
9
|
+
#
|
|
10
|
+
# Usage (must be run as root):
|
|
11
|
+
# ruby dns_blocker.rb -i eth0 -d ruby-lang.org
|
|
12
|
+
#
|
|
13
|
+
|
|
14
|
+
require 'rbbcc'
|
|
15
|
+
require 'optparse'
|
|
16
|
+
|
|
17
|
+
include RbBCC
|
|
18
|
+
|
|
19
|
+
def domain_to_payload_check_code(domain)
|
|
20
|
+
# Convert a domain name to DNS wire format (length-prefixed labels)
|
|
21
|
+
# For example, "example.com" becomes "\\x07example\\x03com\\x00"
|
|
22
|
+
dns_expression = domain.split('.').map { |label| "#{label.length.chr}#{label}" }.join + "\x00"
|
|
23
|
+
c_check_code = dns_expression.chars.map.with_index { |c, i| "payload[offset+#{i}] == #{c.ord}" }.join(" &&\n ")
|
|
24
|
+
c_check_code
|
|
25
|
+
end
|
|
26
|
+
|
|
27
|
+
BPF_TEXT = ->(domain) {
|
|
28
|
+
<<~CLANG
|
|
29
|
+
// Some Hack :(
|
|
30
|
+
#define BPF_LOAD_ACQ -1
|
|
31
|
+
#define BPF_STORE_REL -2
|
|
32
|
+
|
|
33
|
+
#include <uapi/linux/bpf.h>
|
|
34
|
+
#include <uapi/linux/pkt_cls.h>
|
|
35
|
+
#include <linux/if_ether.h>
|
|
36
|
+
#include <linux/ip.h>
|
|
37
|
+
#include <linux/udp.h>
|
|
38
|
+
|
|
39
|
+
int block_dns(struct __sk_buff *skb) {
|
|
40
|
+
void *data = (void *)(long)skb->data;
|
|
41
|
+
void *data_end = (void *)(long)skb->data_end;
|
|
42
|
+
|
|
43
|
+
// Ethernet header check
|
|
44
|
+
struct ethhdr *eth = data;
|
|
45
|
+
if ((void *)(eth + 1) > data_end) return TC_ACT_OK;
|
|
46
|
+
if (eth->h_proto != bpf_htons(ETH_P_IP)) return TC_ACT_OK;
|
|
47
|
+
|
|
48
|
+
// IP header check
|
|
49
|
+
struct iphdr *ip = (void *)(eth + 1);
|
|
50
|
+
if ((void *)(ip + 1) > data_end) return TC_ACT_OK;
|
|
51
|
+
if (ip->protocol != IPPROTO_UDP) return TC_ACT_OK;
|
|
52
|
+
|
|
53
|
+
// UDP header check
|
|
54
|
+
struct udphdr *udp = (void *)ip + (ip->ihl * 4);
|
|
55
|
+
if ((void *)(udp + 1) > data_end) return TC_ACT_OK;
|
|
56
|
+
|
|
57
|
+
// Only care about port 53 (DNS) egress queries
|
|
58
|
+
if (udp->dest != bpf_htons(53)) return TC_ACT_OK;
|
|
59
|
+
|
|
60
|
+
// DNS payload boundary check: DNS header (12 bytes) + "example.com" wire format (13 bytes)
|
|
61
|
+
unsigned char *payload = (unsigned char *)(udp + 1);
|
|
62
|
+
if ((void *)(payload + 12 + 13) > data_end) return TC_ACT_OK;
|
|
63
|
+
|
|
64
|
+
// "example.com" in DNS wire format: \\x07example\\x03com\\x00
|
|
65
|
+
int offset = 12;
|
|
66
|
+
if (#{domain_to_payload_check_code(domain)}) {
|
|
67
|
+
bpf_trace_printk("Blocked DNS query for #{domain}\\n");
|
|
68
|
+
return TC_ACT_SHOT;
|
|
69
|
+
}
|
|
70
|
+
|
|
71
|
+
return TC_ACT_OK;
|
|
72
|
+
}
|
|
73
|
+
CLANG
|
|
74
|
+
}
|
|
75
|
+
|
|
76
|
+
PIN_PATH = "/sys/fs/bpf/dns_blocker_prog"
|
|
77
|
+
|
|
78
|
+
def setup_tc(interface)
|
|
79
|
+
# Run idempotently
|
|
80
|
+
system("sudo tc qdisc add dev #{interface} clsact 2>/dev/null")
|
|
81
|
+
end
|
|
82
|
+
|
|
83
|
+
def attach_tc(interface)
|
|
84
|
+
system(
|
|
85
|
+
"sudo `tc filter add dev #{interface} egress" +
|
|
86
|
+
" bpf pinned #{PIN_PATH} da",
|
|
87
|
+
exception: true
|
|
88
|
+
)
|
|
89
|
+
end
|
|
90
|
+
|
|
91
|
+
def cleanup_tc(interface)
|
|
92
|
+
system("sudo tc qdisc del dev #{interface} clsact", exception: true)
|
|
93
|
+
File.unlink(PIN_PATH) if File.exist?(PIN_PATH)
|
|
94
|
+
end
|
|
95
|
+
|
|
96
|
+
options = {domain: "example.com"}
|
|
97
|
+
OptionParser.new { |opts|
|
|
98
|
+
opts.banner = "Usage: #{$0} -i INTERFACE"
|
|
99
|
+
opts.on("-i", "--interface IFACE", "Network interface to monitor (e.g. eth0)") do |v|
|
|
100
|
+
options[:interface] = v
|
|
101
|
+
end
|
|
102
|
+
opts.on("-d", "--domain DOMAIN", "Domain to block (default: example.com)") do |v|
|
|
103
|
+
options[:domain] = v
|
|
104
|
+
end
|
|
105
|
+
}.parse!
|
|
106
|
+
|
|
107
|
+
iface = options[:interface] || abort("Error: Interface name is required")
|
|
108
|
+
|
|
109
|
+
# Clean up any leftover state from a previous run
|
|
110
|
+
cleanup_tc(iface)
|
|
111
|
+
|
|
112
|
+
puts "[*] Compiling BPF program..."
|
|
113
|
+
b = BCC.new(text: BPF_TEXT.call(options[:domain]))
|
|
114
|
+
fn = b.load_func("block_dns", BPF::SCHED_CLS)
|
|
115
|
+
|
|
116
|
+
# Pin the loaded BPF program so that `tc` can reference it by path
|
|
117
|
+
puts "[*] Pinning BPF program to #{PIN_PATH} ..."
|
|
118
|
+
BCC.pin!(fn, PIN_PATH)
|
|
119
|
+
|
|
120
|
+
# Set up clsact qdisc and attach the pinned program to egress
|
|
121
|
+
puts "[*] Attaching TC filter to #{iface} (egress) ..."
|
|
122
|
+
setup_tc(iface)
|
|
123
|
+
attach_tc(iface)
|
|
124
|
+
|
|
125
|
+
puts "[*] Blocking DNS queries for #{options[:domain]} on #{iface}. Press Ctrl+C to stop."
|
|
126
|
+
begin
|
|
127
|
+
b.trace_print
|
|
128
|
+
rescue Interrupt
|
|
129
|
+
puts "\n[*] Shutting down..."
|
|
130
|
+
ensure
|
|
131
|
+
cleanup_tc(iface)
|
|
132
|
+
puts "[*] Cleanup done."
|
|
133
|
+
end
|
data/lib/rbbcc/bcc.rb
CHANGED
|
@@ -180,7 +180,7 @@ module RbBCC
|
|
|
180
180
|
end
|
|
181
181
|
orig_name = c.inspect
|
|
182
182
|
c.define_singleton_method :inspect do
|
|
183
|
-
orig_name.sub
|
|
183
|
+
orig_name.sub(/(?=>$)/, " original_desc=#{desc.inspect}") rescue super
|
|
184
184
|
end
|
|
185
185
|
c
|
|
186
186
|
end
|
|
@@ -218,6 +218,23 @@ module RbBCC
|
|
|
218
218
|
fn[:sock] = sock
|
|
219
219
|
fn
|
|
220
220
|
end
|
|
221
|
+
|
|
222
|
+
#: (Integer | Hash[Symbol, untyped] fd, String path) -> String
|
|
223
|
+
def pin!(fd, path)
|
|
224
|
+
fd = fd[:fd] if fd.is_a?(Hash)
|
|
225
|
+
unless fd.is_a?(Integer) && fd >= 0
|
|
226
|
+
raise ArgumentError, "fd must exist and be a non-negative Integer"
|
|
227
|
+
end
|
|
228
|
+
unless path.is_a?(String) && !path.empty?
|
|
229
|
+
raise ArgumentError, "path must be a non-empty String"
|
|
230
|
+
end
|
|
231
|
+
|
|
232
|
+
res = Clib.bpf_obj_pin(fd, path)
|
|
233
|
+
if res < 0
|
|
234
|
+
raise SystemCallError.new("Failed to pin BPF object to %s" % path, Fiddle.last_error)
|
|
235
|
+
end
|
|
236
|
+
path
|
|
237
|
+
end
|
|
221
238
|
end
|
|
222
239
|
|
|
223
240
|
def initialize(text: "", src_file: nil, hdr_file: nil, debug: 0, cflags: [], usdt_contexts: [], allow_rlimit: 0, dev_name: nil)
|
|
@@ -279,7 +296,6 @@ module RbBCC
|
|
|
279
296
|
|
|
280
297
|
def gen_args_from_usdt
|
|
281
298
|
ptr = Clib.bcc_usdt_genargs(@usdt_contexts.map(&:context).pack('J*'), @usdt_contexts.size)
|
|
282
|
-
code = ""
|
|
283
299
|
if !ptr || ptr.null?
|
|
284
300
|
return nil
|
|
285
301
|
end
|
data/lib/rbbcc/clib.rb
CHANGED
|
@@ -25,7 +25,7 @@ module RbBCC
|
|
|
25
25
|
end
|
|
26
26
|
|
|
27
27
|
def self.system_libbcc_versions
|
|
28
|
-
paths = ['/usr/lib', '/usr/lib64', '/usr/local/lib', '/usr/lib/x86_64-linux-gnu'].freeze
|
|
28
|
+
paths = ['/lib', '/usr/lib', '/usr/lib64', '/usr/local/lib', '/usr/lib/x86_64-linux-gnu', '/usr/lib/aarch64-linux-gnu'].freeze
|
|
29
29
|
candidates = paths.flat_map do |path|
|
|
30
30
|
Dir.glob("#{path}/libbcc.so.[0-9]*")
|
|
31
31
|
end
|
|
@@ -192,6 +192,7 @@ module RbBCC
|
|
|
192
192
|
|
|
193
193
|
extern 'int bpf_open_raw_sock(const char *name)'
|
|
194
194
|
extern 'int bpf_attach_socket(int sockfd, int progfd)'
|
|
195
|
+
extern 'int bpf_obj_pin(int fd, const char *pathname)'
|
|
195
196
|
end
|
|
196
197
|
end
|
|
197
198
|
|
data/lib/rbbcc/version.rb
CHANGED
data/rbbcc.gemspec
CHANGED
metadata
CHANGED
|
@@ -1,14 +1,28 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: rbbcc
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.11.0.pre
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Uchio Kondo
|
|
8
8
|
bindir: exe
|
|
9
9
|
cert_chain: []
|
|
10
10
|
date: 1980-01-02 00:00:00.000000000 Z
|
|
11
|
-
dependencies:
|
|
11
|
+
dependencies:
|
|
12
|
+
- !ruby/object:Gem::Dependency
|
|
13
|
+
name: fiddle
|
|
14
|
+
requirement: !ruby/object:Gem::Requirement
|
|
15
|
+
requirements:
|
|
16
|
+
- - ">="
|
|
17
|
+
- !ruby/object:Gem::Version
|
|
18
|
+
version: '0'
|
|
19
|
+
type: :runtime
|
|
20
|
+
prerelease: false
|
|
21
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
22
|
+
requirements:
|
|
23
|
+
- - ">="
|
|
24
|
+
- !ruby/object:Gem::Version
|
|
25
|
+
version: '0'
|
|
12
26
|
description: BCC port for MRI. See https://github.com/iovisor/bcc
|
|
13
27
|
email:
|
|
14
28
|
- udzura@udzura.jp
|
|
@@ -18,6 +32,7 @@ extensions: []
|
|
|
18
32
|
extra_rdoc_files: []
|
|
19
33
|
files:
|
|
20
34
|
- ".dockerignore"
|
|
35
|
+
- ".github/workflows/ci-image.yml"
|
|
21
36
|
- ".github/workflows/ci.yml"
|
|
22
37
|
- ".gitignore"
|
|
23
38
|
- Dockerfile
|
|
@@ -26,6 +41,7 @@ files:
|
|
|
26
41
|
- Gemfile
|
|
27
42
|
- Gemfile.lock
|
|
28
43
|
- LICENSE
|
|
44
|
+
- Makefile
|
|
29
45
|
- README.md
|
|
30
46
|
- Rakefile
|
|
31
47
|
- bin/console
|
|
@@ -36,6 +52,7 @@ files:
|
|
|
36
52
|
- ci/Dockerfile.0.16.0-3.0.0
|
|
37
53
|
- ci/Dockerfile.0.17.0-2.7.2
|
|
38
54
|
- ci/Dockerfile.0.17.0-3.0.0
|
|
55
|
+
- ci/Dockerfile.ci_base
|
|
39
56
|
- docs/README.md
|
|
40
57
|
- docs/answers/01-hello-world.rb
|
|
41
58
|
- docs/answers/02-sys_sync.rb
|
|
@@ -67,6 +84,7 @@ files:
|
|
|
67
84
|
- examples/collectsyscall.rb
|
|
68
85
|
- examples/dddos.rb
|
|
69
86
|
- examples/disksnoop.rb
|
|
87
|
+
- examples/dns_blocker.rb
|
|
70
88
|
- examples/example.gif
|
|
71
89
|
- examples/extract_arg.rb
|
|
72
90
|
- examples/hello_fields.rb
|
|
@@ -106,7 +124,6 @@ files:
|
|
|
106
124
|
- lib/rbbcc/version.rb
|
|
107
125
|
- misc/rbbcc-dfm-ruby
|
|
108
126
|
- rbbcc.gemspec
|
|
109
|
-
- semaphore.sh
|
|
110
127
|
homepage: https://github.com/udzura/rbbcc
|
|
111
128
|
licenses:
|
|
112
129
|
- Apache-2.0
|
|
@@ -125,7 +142,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
125
142
|
- !ruby/object:Gem::Version
|
|
126
143
|
version: '0'
|
|
127
144
|
requirements: []
|
|
128
|
-
rubygems_version:
|
|
145
|
+
rubygems_version: 3.6.9
|
|
129
146
|
specification_version: 4
|
|
130
147
|
summary: BCC port for MRI
|
|
131
148
|
test_files: []
|
data/semaphore.sh
DELETED
|
@@ -1,73 +0,0 @@
|
|
|
1
|
-
#!/bin/bash
|
|
2
|
-
|
|
3
|
-
# packages
|
|
4
|
-
|
|
5
|
-
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 4052245BD4284CDD
|
|
6
|
-
echo "deb https://repo.iovisor.org/apt/$(lsb_release -cs) $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/iovisor.list
|
|
7
|
-
sudo apt -y update
|
|
8
|
-
sudo apt -y install libbcc
|
|
9
|
-
|
|
10
|
-
# build libbcc 0.11/0.12
|
|
11
|
-
ORIG_DIR=$(pwd)
|
|
12
|
-
sudo mkdir -p /opt/bcc
|
|
13
|
-
|
|
14
|
-
cd /
|
|
15
|
-
sudo chown $(whoami) /opt/bcc
|
|
16
|
-
cache has_key libbcc-so && cache restore libbcc-so
|
|
17
|
-
sudo chown -R root /opt/bcc
|
|
18
|
-
cd -
|
|
19
|
-
|
|
20
|
-
if test "$(ls /opt/bcc | wc -l)" -le "0"; then
|
|
21
|
-
sudo apt -y install bison build-essential cmake flex git libedit-dev \
|
|
22
|
-
libllvm6.0 llvm-6.0-dev libclang-6.0-dev python zlib1g-dev libelf-dev
|
|
23
|
-
|
|
24
|
-
sudo mkdir -p /opt/bcc-work
|
|
25
|
-
sudo chown $(whoami) /opt/bcc-work
|
|
26
|
-
cd /opt/bcc-work
|
|
27
|
-
git clone https://github.com/iovisor/bcc.git
|
|
28
|
-
mkdir bcc/build
|
|
29
|
-
cd bcc
|
|
30
|
-
|
|
31
|
-
git checkout v0.11.0
|
|
32
|
-
git submodule init
|
|
33
|
-
git submodule sync
|
|
34
|
-
git submodule update
|
|
35
|
-
cd build
|
|
36
|
-
cmake .. -DCMAKE_INSTALL_PREFIX=/opt/bcc
|
|
37
|
-
make -j$(nproc)
|
|
38
|
-
sudo make install
|
|
39
|
-
make clean
|
|
40
|
-
cd ..
|
|
41
|
-
|
|
42
|
-
V0_12_HASH=2d099cd8c5cb1598d6e911c0b389132ebc7c101b
|
|
43
|
-
git checkout $V0_12_HASH
|
|
44
|
-
git submodule init
|
|
45
|
-
git submodule sync
|
|
46
|
-
git submodule update
|
|
47
|
-
cd build
|
|
48
|
-
cmake .. -DCMAKE_INSTALL_PREFIX=/opt/bcc
|
|
49
|
-
make -j$(nproc)
|
|
50
|
-
sudo make install
|
|
51
|
-
|
|
52
|
-
cd /
|
|
53
|
-
cache has_key libbcc-so && cache clear libbcc-so
|
|
54
|
-
cache store libbcc-so opt/bcc
|
|
55
|
-
cd -
|
|
56
|
-
fi
|
|
57
|
-
cd $ORIG_DIR
|
|
58
|
-
|
|
59
|
-
# link all tha objects under /lib from /opt/bcc
|
|
60
|
-
sudo ln -sf /opt/bcc/lib/libbcc.so.0.11.0 /opt/bcc/lib/libbcc.so.0.12.0 /usr/lib/x86_64-linux-gnu/
|
|
61
|
-
|
|
62
|
-
# Doing tests
|
|
63
|
-
set -e
|
|
64
|
-
|
|
65
|
-
bundle install --path vendor/bundle
|
|
66
|
-
|
|
67
|
-
bundle exec ruby -e "require 'rbbcc'; puts 'Using rbbcc: %s && libbcc: %s' % [RbBCC::VERSION, RbBCC::Clib.libbcc_version.to_s]"
|
|
68
|
-
if test "$(bundle exec ruby -e 'require %q(rbbcc); print RbBCC::Clib.libbcc_version.to_s')" != "${LIBBCC_VERSION}"; then
|
|
69
|
-
echo "Test target mismatch"
|
|
70
|
-
exit 127
|
|
71
|
-
fi
|
|
72
|
-
|
|
73
|
-
sudo -E env PATH=$PATH bundle exec rake test
|