1 | /* eBPF example program: |
2 | * |
3 | * - Creates arraymap in kernel with 4 bytes keys and 8 byte values |
4 | * |
5 | * - Loads eBPF program |
6 | * |
7 | * The eBPF program accesses the map passed in to store two pieces of |
8 | * information. The number of invocations of the program, which maps |
9 | * to the number of packets received, is stored to key 0. Key 1 is |
10 | * incremented on each iteration by the number of bytes stored in |
11 | * the skb. |
12 | * |
13 | * - Attaches the new program to a cgroup using BPF_PROG_ATTACH |
14 | * |
15 | * - Every second, reads map[0] and map[1] to see how many bytes and |
16 | * packets were seen on any socket of tasks in the given cgroup. |
17 | */ |
18 | |
19 | #define _GNU_SOURCE |
20 | |
21 | #include <stdio.h> |
22 | #include <stdlib.h> |
23 | #include <stddef.h> |
24 | #include <string.h> |
25 | #include <unistd.h> |
26 | #include <assert.h> |
27 | #include <errno.h> |
28 | #include <fcntl.h> |
29 | |
30 | #include <linux/bpf.h> |
31 | #include <bpf/bpf.h> |
32 | |
33 | #include "bpf_insn.h" |
34 | #include "bpf_util.h" |
35 | |
36 | enum { |
37 | MAP_KEY_PACKETS, |
38 | MAP_KEY_BYTES, |
39 | }; |
40 | |
41 | char bpf_log_buf[BPF_LOG_BUF_SIZE]; |
42 | |
43 | static int prog_load(int map_fd, int verdict) |
44 | { |
45 | struct bpf_insn prog[] = { |
46 | BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */ |
47 | |
48 | /* Count packets */ |
49 | BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */ |
50 | BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */ |
51 | BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), |
52 | BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */ |
53 | BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */ |
54 | BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), |
55 | BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), |
56 | BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */ |
57 | BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0), |
58 | |
59 | /* Count bytes */ |
60 | BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */ |
61 | BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */ |
62 | BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), |
63 | BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */ |
64 | BPF_LD_MAP_FD(BPF_REG_1, map_fd), |
65 | BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), |
66 | BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), |
67 | BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */ |
68 | |
69 | BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0), |
70 | |
71 | BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */ |
72 | BPF_EXIT_INSN(), |
73 | }; |
74 | size_t insns_cnt = ARRAY_SIZE(prog); |
75 | LIBBPF_OPTS(bpf_prog_load_opts, opts, |
76 | .log_buf = bpf_log_buf, |
77 | .log_size = BPF_LOG_BUF_SIZE, |
78 | ); |
79 | |
80 | return bpf_prog_load(BPF_PROG_TYPE_CGROUP_SKB, NULL, "GPL" , |
81 | prog, insns_cnt, &opts); |
82 | } |
83 | |
84 | static int usage(const char *argv0) |
85 | { |
86 | printf(format: "Usage: %s [-d] [-D] <cg-path> <egress|ingress>\n" , argv0); |
87 | printf(format: " -d Drop Traffic\n" ); |
88 | printf(format: " -D Detach filter, and exit\n" ); |
89 | return EXIT_FAILURE; |
90 | } |
91 | |
92 | static int attach_filter(int cg_fd, int type, int verdict) |
93 | { |
94 | int prog_fd, map_fd, ret, key; |
95 | long long pkt_cnt, byte_cnt; |
96 | |
97 | map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, NULL, |
98 | sizeof(key), sizeof(byte_cnt), |
99 | 256, NULL); |
100 | if (map_fd < 0) { |
101 | printf(format: "Failed to create map: '%s'\n" , strerror(errno)); |
102 | return EXIT_FAILURE; |
103 | } |
104 | |
105 | prog_fd = prog_load(map_fd, verdict); |
106 | printf(format: "Output from kernel verifier:\n%s\n-------\n" , bpf_log_buf); |
107 | |
108 | if (prog_fd < 0) { |
109 | printf(format: "Failed to load prog: '%s'\n" , strerror(errno)); |
110 | return EXIT_FAILURE; |
111 | } |
112 | |
113 | ret = bpf_prog_attach(prog_fd, cg_fd, type, 0); |
114 | if (ret < 0) { |
115 | printf(format: "Failed to attach prog to cgroup: '%s'\n" , |
116 | strerror(errno)); |
117 | return EXIT_FAILURE; |
118 | } |
119 | while (1) { |
120 | key = MAP_KEY_PACKETS; |
121 | assert(bpf_map_lookup_elem(map_fd, &key, &pkt_cnt) == 0); |
122 | |
123 | key = MAP_KEY_BYTES; |
124 | assert(bpf_map_lookup_elem(map_fd, &key, &byte_cnt) == 0); |
125 | |
126 | printf(format: "cgroup received %lld packets, %lld bytes\n" , |
127 | pkt_cnt, byte_cnt); |
128 | sleep(seconds: 1); |
129 | } |
130 | |
131 | return EXIT_SUCCESS; |
132 | } |
133 | |
134 | int main(int argc, char **argv) |
135 | { |
136 | int detach_only = 0, verdict = 1; |
137 | enum bpf_attach_type type; |
138 | int opt, cg_fd, ret; |
139 | |
140 | while ((opt = getopt(argc: argc, argv: argv, shortopts: "Dd" )) != -1) { |
141 | switch (opt) { |
142 | case 'd': |
143 | verdict = 0; |
144 | break; |
145 | case 'D': |
146 | detach_only = 1; |
147 | break; |
148 | default: |
149 | return usage(argv0: argv[0]); |
150 | } |
151 | } |
152 | |
153 | if (argc - optind < 2) |
154 | return usage(argv0: argv[0]); |
155 | |
156 | if (strcmp(s1: argv[optind + 1], s2: "ingress" ) == 0) |
157 | type = BPF_CGROUP_INET_INGRESS; |
158 | else if (strcmp(s1: argv[optind + 1], s2: "egress" ) == 0) |
159 | type = BPF_CGROUP_INET_EGRESS; |
160 | else |
161 | return usage(argv0: argv[0]); |
162 | |
163 | cg_fd = open(file: argv[optind], O_DIRECTORY | O_RDONLY); |
164 | if (cg_fd < 0) { |
165 | printf(format: "Failed to open cgroup path: '%s'\n" , strerror(errno)); |
166 | return EXIT_FAILURE; |
167 | } |
168 | |
169 | if (detach_only) { |
170 | ret = bpf_prog_detach(cg_fd, type); |
171 | printf(format: "bpf_prog_detach() returned '%s' (%d)\n" , |
172 | strerror(errno), errno); |
173 | } else |
174 | ret = attach_filter(cg_fd, type, verdict); |
175 | |
176 | return ret; |
177 | } |
178 | |