ebpfsieve 0.1.0

Byte-frequency prefilter for read-heavy scanning pipelines with optional eBPF offload
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

#define BPF_MAP_TYPE_HASH 1

typedef unsigned char u8;
typedef unsigned short u16;
typedef unsigned int u32;

#define SEC(NAME) __attribute__((section(NAME), used))

struct bpf_map_def {
    u32 type;
    u32 key_size;
    u32 value_size;
    u32 max_entries;
    u32 map_flags;
};

SEC(".maps")
struct bpf_map_def thresholds = {
    .type = BPF_MAP_TYPE_HASH,
    .key_size = sizeof(u8),
    .value_size = sizeof(u16),
    .max_entries = 256,
};

SEC("fentry/vfs_read")
int sieve_vfs_read(void *ctx) {
    // In a full implementation, we would extract the buffer from ctx
    // and compute byte frequencies here, then check the thresholds map.
    // Return 0 to allow the original vfs_read to execute uninterrupted.
    return 0;
}

SEC("license")
char _license[] = "GPL";