1/* eBPF example program:
  2 *
  3 * - Creates arraymap in kernel with 4 bytes keys and 8 byte values
  4 *
  5 * - Loads eBPF program
  6 *
  7 *   The eBPF program accesses the map passed in to store two pieces of
  8 *   information. The number of invocations of the program, which maps
  9 *   to the number of packets received, is stored to key 0. Key 1 is
 10 *   incremented on each iteration by the number of bytes stored in
 11 *   the skb.
 12 *
 13 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH
 14 *
 15 * - Every second, reads map[0] and map[1] to see how many bytes and
 16 *   packets were seen on any socket of tasks in the given cgroup.
 17 */
 18
 19#define _GNU_SOURCE
 20
 21#include <stdio.h>
 22#include <stdlib.h>
 23#include <stddef.h>
 24#include <string.h>
 25#include <unistd.h>
 26#include <assert.h>
 27#include <errno.h>
 28#include <fcntl.h>
 29
 30#include <linux/bpf.h>
 31
 32#include "libbpf.h"
 33
 34enum {
 35	MAP_KEY_PACKETS,
 36	MAP_KEY_BYTES,
 37};
 38
 39char bpf_log_buf[BPF_LOG_BUF_SIZE];
 40
 41static int prog_load(int map_fd, int verdict)
 42{
 43	struct bpf_insn prog[] = {
 44		BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */
 45
 46		/* Count packets */
 47		BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */
 48		BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
 49		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 50		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
 51		BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */
 52		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 53		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
 54		BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */
 55		BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
 56
 57		/* Count bytes */
 58		BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */
 59		BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
 60		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 61		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
 62		BPF_LD_MAP_FD(BPF_REG_1, map_fd),
 63		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 64		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
 65		BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */
 66		BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
 67
 68		BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
 69		BPF_EXIT_INSN(),
 70	};
 71	size_t insns_cnt = sizeof(prog) / sizeof(struct bpf_insn);
 72
 73	return bpf_load_program(BPF_PROG_TYPE_CGROUP_SKB,
 74				prog, insns_cnt, "GPL", 0,
 75				bpf_log_buf, BPF_LOG_BUF_SIZE);
 76}
 77
 78static int usage(const char *argv0)
 79{
 80	printf("Usage: %s [-d] [-D] <cg-path> <egress|ingress>\n", argv0);
 81	printf("	-d	Drop Traffic\n");
 82	printf("	-D	Detach filter, and exit\n");
 83	return EXIT_FAILURE;
 84}
 85
 86static int attach_filter(int cg_fd, int type, int verdict)
 87{
 88	int prog_fd, map_fd, ret, key;
 89	long long pkt_cnt, byte_cnt;
 90
 91	map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY,
 92				sizeof(key), sizeof(byte_cnt),
 93				256, 0);
 94	if (map_fd < 0) {
 95		printf("Failed to create map: '%s'\n", strerror(errno));
 96		return EXIT_FAILURE;
 97	}
 98
 99	prog_fd = prog_load(map_fd, verdict);
100	printf("Output from kernel verifier:\n%s\n-------\n", bpf_log_buf);
101
102	if (prog_fd < 0) {
103		printf("Failed to load prog: '%s'\n", strerror(errno));
104		return EXIT_FAILURE;
105	}
106
107	ret = bpf_prog_attach(prog_fd, cg_fd, type, 0);
108	if (ret < 0) {
109		printf("Failed to attach prog to cgroup: '%s'\n",
110		       strerror(errno));
111		return EXIT_FAILURE;
112	}
113	while (1) {
114		key = MAP_KEY_PACKETS;
115		assert(bpf_map_lookup_elem(map_fd, &key, &pkt_cnt) == 0);
116
117		key = MAP_KEY_BYTES;
118		assert(bpf_map_lookup_elem(map_fd, &key, &byte_cnt) == 0);
119
120		printf("cgroup received %lld packets, %lld bytes\n",
121		       pkt_cnt, byte_cnt);
122		sleep(1);
123	}
124
125	return EXIT_SUCCESS;
126}
127
128int main(int argc, char **argv)
129{
130	int detach_only = 0, verdict = 1;
131	enum bpf_attach_type type;
132	int opt, cg_fd, ret;
133
134	while ((opt = getopt(argc, argv, "Dd")) != -1) {
135		switch (opt) {
136		case 'd':
137			verdict = 0;
138			break;
139		case 'D':
140			detach_only = 1;
141			break;
142		default:
143			return usage(argv[0]);
144		}
145	}
146
147	if (argc - optind < 2)
148		return usage(argv[0]);
149
150	if (strcmp(argv[optind + 1], "ingress") == 0)
151		type = BPF_CGROUP_INET_INGRESS;
152	else if (strcmp(argv[optind + 1], "egress") == 0)
153		type = BPF_CGROUP_INET_EGRESS;
154	else
155		return usage(argv[0]);
156
157	cg_fd = open(argv[optind], O_DIRECTORY | O_RDONLY);
158	if (cg_fd < 0) {
159		printf("Failed to open cgroup path: '%s'\n", strerror(errno));
160		return EXIT_FAILURE;
161	}
162
163	if (detach_only) {
164		ret = bpf_prog_detach(cg_fd, type);
165		printf("bpf_prog_detach() returned '%s' (%d)\n",
166		       strerror(errno), errno);
167	} else
168		ret = attach_filter(cg_fd, type, verdict);
169
170	return ret;
171}