178 lines · c
1/* eBPF example program:2 *3 * - Creates arraymap in kernel with 4 bytes keys and 8 byte values4 *5 * - Loads eBPF program6 *7 * The eBPF program accesses the map passed in to store two pieces of8 * information. The number of invocations of the program, which maps9 * to the number of packets received, is stored to key 0. Key 1 is10 * incremented on each iteration by the number of bytes stored in11 * the skb.12 *13 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH14 *15 * - Every second, reads map[0] and map[1] to see how many bytes and16 * packets were seen on any socket of tasks in the given cgroup.17 */18 19#define _GNU_SOURCE20 21#include <stdio.h>22#include <stdlib.h>23#include <stddef.h>24#include <string.h>25#include <unistd.h>26#include <assert.h>27#include <errno.h>28#include <fcntl.h>29 30#include <linux/bpf.h>31#include <bpf/bpf.h>32 33#include "bpf_insn.h"34#include "bpf_util.h"35 36enum {37 MAP_KEY_PACKETS,38 MAP_KEY_BYTES,39};40 41char bpf_log_buf[BPF_LOG_BUF_SIZE];42 43static int prog_load(int map_fd, int verdict)44{45 struct bpf_insn prog[] = {46 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */47 48 /* Count packets */49 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */50 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */51 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),52 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */53 BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */54 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),55 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),56 BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */57 BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),58 59 /* Count bytes */60 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */61 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */62 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),63 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */64 BPF_LD_MAP_FD(BPF_REG_1, map_fd),65 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),66 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),67 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */68 69 BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),70 71 BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */72 BPF_EXIT_INSN(),73 };74 size_t insns_cnt = ARRAY_SIZE(prog);75 LIBBPF_OPTS(bpf_prog_load_opts, opts,76 .log_buf = bpf_log_buf,77 .log_size = BPF_LOG_BUF_SIZE,78 );79 80 return bpf_prog_load(BPF_PROG_TYPE_CGROUP_SKB, NULL, "GPL",81 prog, insns_cnt, &opts);82}83 84static int usage(const char *argv0)85{86 printf("Usage: %s [-d] [-D] <cg-path> <egress|ingress>\n", argv0);87 printf(" -d Drop Traffic\n");88 printf(" -D Detach filter, and exit\n");89 return EXIT_FAILURE;90}91 92static int attach_filter(int cg_fd, int type, int verdict)93{94 int prog_fd, map_fd, ret, key;95 long long pkt_cnt, byte_cnt;96 97 map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, NULL,98 sizeof(key), sizeof(byte_cnt),99 256, NULL);100 if (map_fd < 0) {101 printf("Failed to create map: '%s'\n", strerror(errno));102 return EXIT_FAILURE;103 }104 105 prog_fd = prog_load(map_fd, verdict);106 printf("Output from kernel verifier:\n%s\n-------\n", bpf_log_buf);107 108 if (prog_fd < 0) {109 printf("Failed to load prog: '%s'\n", strerror(errno));110 return EXIT_FAILURE;111 }112 113 ret = bpf_prog_attach(prog_fd, cg_fd, type, 0);114 if (ret < 0) {115 printf("Failed to attach prog to cgroup: '%s'\n",116 strerror(errno));117 return EXIT_FAILURE;118 }119 while (1) {120 key = MAP_KEY_PACKETS;121 assert(bpf_map_lookup_elem(map_fd, &key, &pkt_cnt) == 0);122 123 key = MAP_KEY_BYTES;124 assert(bpf_map_lookup_elem(map_fd, &key, &byte_cnt) == 0);125 126 printf("cgroup received %lld packets, %lld bytes\n",127 pkt_cnt, byte_cnt);128 sleep(1);129 }130 131 return EXIT_SUCCESS;132}133 134int main(int argc, char **argv)135{136 int detach_only = 0, verdict = 1;137 enum bpf_attach_type type;138 int opt, cg_fd, ret;139 140 while ((opt = getopt(argc, argv, "Dd")) != -1) {141 switch (opt) {142 case 'd':143 verdict = 0;144 break;145 case 'D':146 detach_only = 1;147 break;148 default:149 return usage(argv[0]);150 }151 }152 153 if (argc - optind < 2)154 return usage(argv[0]);155 156 if (strcmp(argv[optind + 1], "ingress") == 0)157 type = BPF_CGROUP_INET_INGRESS;158 else if (strcmp(argv[optind + 1], "egress") == 0)159 type = BPF_CGROUP_INET_EGRESS;160 else161 return usage(argv[0]);162 163 cg_fd = open(argv[optind], O_DIRECTORY | O_RDONLY);164 if (cg_fd < 0) {165 printf("Failed to open cgroup path: '%s'\n", strerror(errno));166 return EXIT_FAILURE;167 }168 169 if (detach_only) {170 ret = bpf_prog_detach(cg_fd, type);171 printf("bpf_prog_detach() returned '%s' (%d)\n",172 strerror(errno), errno);173 } else174 ret = attach_filter(cg_fd, type, verdict);175 176 return ret;177}178