K8s 生产级混沌工程：eBPF 内核探测与 Service Mesh 流量无损降级实录

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>

struct {
    __uint(type, BPF_MAP_TYPE_SOCKHASH);
    __uint(max_entries, 65535);
    __type(key, struct sock_key);
    __type(value, __u64);
} sock_map SEC(".maps");

SEC("sockops")
int bpf_sockmap_tracer(struct bpf_sock_ops *skops) {
    if (skops->family == 2) { // AF_INET
        switch (skops->op) {
            case BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB:
            case BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB: {
                struct sock_key key = {
                    .sip   = skops->local_ip4,
                    .dip   = skops->remote_ip4,
                    .sport = skops->local_port,
                    .dport = bpf_ntohl(skops->remote_port)
                };
                // 将建立连接的 socket fd 注入 sockmap 实现内核直连
                bpf_sock_hash_update(skops, &sock_map, &key, BPF_ANY);
                break;
            }
        }
    }
    return 0;
}
char _license[] SEC("license") = "GPL";