Commit | Line | Data |
---|---|---|
d8c5b17f DM |
1 | /* eBPF example program: |
2 | * | |
3 | * - Creates arraymap in kernel with 4 bytes keys and 8 byte values | |
4 | * | |
5 | * - Loads eBPF program | |
6 | * | |
7 | * The eBPF program accesses the map passed in to store two pieces of | |
8 | * information. The number of invocations of the program, which maps | |
9 | * to the number of packets received, is stored to key 0. Key 1 is | |
10 | * incremented on each iteration by the number of bytes stored in | |
11 | * the skb. | |
12 | * | |
d8c5b17f DM |
13 | * - Attaches the new program to a cgroup using BPF_PROG_ATTACH |
14 | * | |
15 | * - Every second, reads map[0] and map[1] to see how many bytes and | |
16 | * packets were seen on any socket of tasks in the given cgroup. | |
17 | */ | |
18 | ||
19 | #define _GNU_SOURCE | |
20 | ||
21 | #include <stdio.h> | |
22 | #include <stdlib.h> | |
23 | #include <stddef.h> | |
24 | #include <string.h> | |
25 | #include <unistd.h> | |
26 | #include <assert.h> | |
27 | #include <errno.h> | |
28 | #include <fcntl.h> | |
29 | ||
30 | #include <linux/bpf.h> | |
8d930450 | 31 | #include <bpf/bpf.h> |
d8c5b17f | 32 | |
8d930450 | 33 | #include "bpf_insn.h" |
d8c5b17f DM |
34 | |
35 | enum { | |
36 | MAP_KEY_PACKETS, | |
37 | MAP_KEY_BYTES, | |
38 | }; | |
39 | ||
d40fc181 JS |
40 | char bpf_log_buf[BPF_LOG_BUF_SIZE]; |
41 | ||
d8c5b17f DM |
42 | static int prog_load(int map_fd, int verdict) |
43 | { | |
44 | struct bpf_insn prog[] = { | |
45 | BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */ | |
46 | ||
47 | /* Count packets */ | |
48 | BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */ | |
49 | BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */ | |
50 | BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), | |
51 | BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */ | |
52 | BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */ | |
53 | BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), | |
54 | BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), | |
55 | BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */ | |
56 | BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */ | |
57 | ||
58 | /* Count bytes */ | |
59 | BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */ | |
60 | BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */ | |
61 | BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), | |
62 | BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */ | |
63 | BPF_LD_MAP_FD(BPF_REG_1, map_fd), | |
64 | BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), | |
65 | BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), | |
66 | BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */ | |
67 | BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */ | |
68 | ||
69 | BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */ | |
70 | BPF_EXIT_INSN(), | |
71 | }; | |
43371c83 | 72 | size_t insns_cnt = sizeof(prog) / sizeof(struct bpf_insn); |
d8c5b17f | 73 | |
d40fc181 | 74 | return bpf_load_program(BPF_PROG_TYPE_CGROUP_SKB, |
43371c83 | 75 | prog, insns_cnt, "GPL", 0, |
d40fc181 | 76 | bpf_log_buf, BPF_LOG_BUF_SIZE); |
d8c5b17f DM |
77 | } |
78 | ||
79 | static int usage(const char *argv0) | |
80 | { | |
1379fd3c SD |
81 | printf("Usage: %s [-d] [-D] <cg-path> <egress|ingress>\n", argv0); |
82 | printf(" -d Drop Traffic\n"); | |
83 | printf(" -D Detach filter, and exit\n"); | |
d8c5b17f DM |
84 | return EXIT_FAILURE; |
85 | } | |
86 | ||
1379fd3c | 87 | static int attach_filter(int cg_fd, int type, int verdict) |
d8c5b17f | 88 | { |
1379fd3c | 89 | int prog_fd, map_fd, ret, key; |
d8c5b17f | 90 | long long pkt_cnt, byte_cnt; |
d8c5b17f DM |
91 | |
92 | map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, | |
93 | sizeof(key), sizeof(byte_cnt), | |
94 | 256, 0); | |
95 | if (map_fd < 0) { | |
96 | printf("Failed to create map: '%s'\n", strerror(errno)); | |
97 | return EXIT_FAILURE; | |
98 | } | |
99 | ||
100 | prog_fd = prog_load(map_fd, verdict); | |
101 | printf("Output from kernel verifier:\n%s\n-------\n", bpf_log_buf); | |
102 | ||
103 | if (prog_fd < 0) { | |
104 | printf("Failed to load prog: '%s'\n", strerror(errno)); | |
105 | return EXIT_FAILURE; | |
106 | } | |
107 | ||
7f677633 | 108 | ret = bpf_prog_attach(prog_fd, cg_fd, type, 0); |
d8c5b17f DM |
109 | if (ret < 0) { |
110 | printf("Failed to attach prog to cgroup: '%s'\n", | |
111 | strerror(errno)); | |
112 | return EXIT_FAILURE; | |
113 | } | |
d8c5b17f DM |
114 | while (1) { |
115 | key = MAP_KEY_PACKETS; | |
d40fc181 | 116 | assert(bpf_map_lookup_elem(map_fd, &key, &pkt_cnt) == 0); |
d8c5b17f DM |
117 | |
118 | key = MAP_KEY_BYTES; | |
d40fc181 | 119 | assert(bpf_map_lookup_elem(map_fd, &key, &byte_cnt) == 0); |
d8c5b17f DM |
120 | |
121 | printf("cgroup received %lld packets, %lld bytes\n", | |
122 | pkt_cnt, byte_cnt); | |
123 | sleep(1); | |
124 | } | |
125 | ||
126 | return EXIT_SUCCESS; | |
127 | } | |
1379fd3c SD |
128 | |
129 | int main(int argc, char **argv) | |
130 | { | |
131 | int detach_only = 0, verdict = 1; | |
132 | enum bpf_attach_type type; | |
133 | int opt, cg_fd, ret; | |
134 | ||
135 | while ((opt = getopt(argc, argv, "Dd")) != -1) { | |
136 | switch (opt) { | |
137 | case 'd': | |
138 | verdict = 0; | |
139 | break; | |
140 | case 'D': | |
141 | detach_only = 1; | |
142 | break; | |
143 | default: | |
144 | return usage(argv[0]); | |
145 | } | |
146 | } | |
147 | ||
148 | if (argc - optind < 2) | |
149 | return usage(argv[0]); | |
150 | ||
151 | if (strcmp(argv[optind + 1], "ingress") == 0) | |
152 | type = BPF_CGROUP_INET_INGRESS; | |
153 | else if (strcmp(argv[optind + 1], "egress") == 0) | |
154 | type = BPF_CGROUP_INET_EGRESS; | |
155 | else | |
156 | return usage(argv[0]); | |
157 | ||
158 | cg_fd = open(argv[optind], O_DIRECTORY | O_RDONLY); | |
159 | if (cg_fd < 0) { | |
160 | printf("Failed to open cgroup path: '%s'\n", strerror(errno)); | |
161 | return EXIT_FAILURE; | |
162 | } | |
163 | ||
164 | if (detach_only) { | |
165 | ret = bpf_prog_detach(cg_fd, type); | |
166 | printf("bpf_prog_detach() returned '%s' (%d)\n", | |
167 | strerror(errno), errno); | |
168 | } else | |
169 | ret = attach_filter(cg_fd, type, verdict); | |
170 | ||
171 | return ret; | |
172 | } |