Loading...
1/* eBPF example program:
2 *
3 * - Loads eBPF program
4 *
5 * The eBPF program sets the sk_bound_dev_if index in new AF_INET{6}
6 * sockets opened by processes in the cgroup.
7 *
8 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH
9 */
10
11#define _GNU_SOURCE
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <stddef.h>
16#include <string.h>
17#include <unistd.h>
18#include <assert.h>
19#include <errno.h>
20#include <fcntl.h>
21#include <net/if.h>
22#include <inttypes.h>
23#include <linux/bpf.h>
24#include <bpf/bpf.h>
25
26#include "bpf_insn.h"
27
28char bpf_log_buf[BPF_LOG_BUF_SIZE];
29
30static int prog_load(__u32 idx, __u32 mark, __u32 prio)
31{
32 /* save pointer to context */
33 struct bpf_insn prog_start[] = {
34 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
35 };
36 struct bpf_insn prog_end[] = {
37 BPF_MOV64_IMM(BPF_REG_0, 1), /* r0 = verdict */
38 BPF_EXIT_INSN(),
39 };
40
41 /* set sk_bound_dev_if on socket */
42 struct bpf_insn prog_dev[] = {
43 BPF_MOV64_IMM(BPF_REG_3, idx),
44 BPF_MOV64_IMM(BPF_REG_2, offsetof(struct bpf_sock, bound_dev_if)),
45 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, offsetof(struct bpf_sock, bound_dev_if)),
46 };
47
48 /* set mark on socket */
49 struct bpf_insn prog_mark[] = {
50 /* get uid of process */
51 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
52 BPF_FUNC_get_current_uid_gid),
53 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffffffff),
54
55 /* if uid is 0, use given mark, else use the uid as the mark */
56 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
57 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
58 BPF_MOV64_IMM(BPF_REG_3, mark),
59
60 /* set the mark on the new socket */
61 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
62 BPF_MOV64_IMM(BPF_REG_2, offsetof(struct bpf_sock, mark)),
63 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, offsetof(struct bpf_sock, mark)),
64 };
65
66 /* set priority on socket */
67 struct bpf_insn prog_prio[] = {
68 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
69 BPF_MOV64_IMM(BPF_REG_3, prio),
70 BPF_MOV64_IMM(BPF_REG_2, offsetof(struct bpf_sock, priority)),
71 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, offsetof(struct bpf_sock, priority)),
72 };
73 LIBBPF_OPTS(bpf_prog_load_opts, opts,
74 .log_buf = bpf_log_buf,
75 .log_size = BPF_LOG_BUF_SIZE,
76 );
77
78 struct bpf_insn *prog;
79 size_t insns_cnt;
80 void *p;
81 int ret;
82
83 insns_cnt = sizeof(prog_start) + sizeof(prog_end);
84 if (idx)
85 insns_cnt += sizeof(prog_dev);
86
87 if (mark)
88 insns_cnt += sizeof(prog_mark);
89
90 if (prio)
91 insns_cnt += sizeof(prog_prio);
92
93 p = prog = malloc(insns_cnt);
94 if (!prog) {
95 fprintf(stderr, "Failed to allocate memory for instructions\n");
96 return EXIT_FAILURE;
97 }
98
99 memcpy(p, prog_start, sizeof(prog_start));
100 p += sizeof(prog_start);
101
102 if (idx) {
103 memcpy(p, prog_dev, sizeof(prog_dev));
104 p += sizeof(prog_dev);
105 }
106
107 if (mark) {
108 memcpy(p, prog_mark, sizeof(prog_mark));
109 p += sizeof(prog_mark);
110 }
111
112 if (prio) {
113 memcpy(p, prog_prio, sizeof(prog_prio));
114 p += sizeof(prog_prio);
115 }
116
117 memcpy(p, prog_end, sizeof(prog_end));
118 p += sizeof(prog_end);
119
120 insns_cnt /= sizeof(struct bpf_insn);
121
122 ret = bpf_prog_load(BPF_PROG_TYPE_CGROUP_SOCK, NULL, "GPL",
123 prog, insns_cnt, &opts);
124
125 free(prog);
126
127 return ret;
128}
129
130static int get_bind_to_device(int sd, char *name, size_t len)
131{
132 socklen_t optlen = len;
133 int rc;
134
135 name[0] = '\0';
136 rc = getsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, name, &optlen);
137 if (rc < 0)
138 perror("setsockopt(SO_BINDTODEVICE)");
139
140 return rc;
141}
142
143static unsigned int get_somark(int sd)
144{
145 unsigned int mark = 0;
146 socklen_t optlen = sizeof(mark);
147 int rc;
148
149 rc = getsockopt(sd, SOL_SOCKET, SO_MARK, &mark, &optlen);
150 if (rc < 0)
151 perror("getsockopt(SO_MARK)");
152
153 return mark;
154}
155
156static unsigned int get_priority(int sd)
157{
158 unsigned int prio = 0;
159 socklen_t optlen = sizeof(prio);
160 int rc;
161
162 rc = getsockopt(sd, SOL_SOCKET, SO_PRIORITY, &prio, &optlen);
163 if (rc < 0)
164 perror("getsockopt(SO_PRIORITY)");
165
166 return prio;
167}
168
169static int show_sockopts(int family)
170{
171 unsigned int mark, prio;
172 char name[16];
173 int sd;
174
175 sd = socket(family, SOCK_DGRAM, 17);
176 if (sd < 0) {
177 perror("socket");
178 return 1;
179 }
180
181 if (get_bind_to_device(sd, name, sizeof(name)) < 0)
182 return 1;
183
184 mark = get_somark(sd);
185 prio = get_priority(sd);
186
187 close(sd);
188
189 printf("sd %d: dev %s, mark %u, priority %u\n", sd, name, mark, prio);
190
191 return 0;
192}
193
194static int usage(const char *argv0)
195{
196 printf("Usage:\n");
197 printf(" Attach a program\n");
198 printf(" %s -b bind-to-dev -m mark -p prio cg-path\n", argv0);
199 printf("\n");
200 printf(" Detach a program\n");
201 printf(" %s -d cg-path\n", argv0);
202 printf("\n");
203 printf(" Show inherited socket settings (mark, priority, and device)\n");
204 printf(" %s [-6]\n", argv0);
205 return EXIT_FAILURE;
206}
207
208int main(int argc, char **argv)
209{
210 __u32 idx = 0, mark = 0, prio = 0;
211 const char *cgrp_path = NULL;
212 int cg_fd, prog_fd, ret;
213 int family = PF_INET;
214 int do_attach = 1;
215 int rc;
216
217 while ((rc = getopt(argc, argv, "db:m:p:6")) != -1) {
218 switch (rc) {
219 case 'd':
220 do_attach = 0;
221 break;
222 case 'b':
223 idx = if_nametoindex(optarg);
224 if (!idx) {
225 idx = strtoumax(optarg, NULL, 0);
226 if (!idx) {
227 printf("Invalid device name\n");
228 return EXIT_FAILURE;
229 }
230 }
231 break;
232 case 'm':
233 mark = strtoumax(optarg, NULL, 0);
234 break;
235 case 'p':
236 prio = strtoumax(optarg, NULL, 0);
237 break;
238 case '6':
239 family = PF_INET6;
240 break;
241 default:
242 return usage(argv[0]);
243 }
244 }
245
246 if (optind == argc)
247 return show_sockopts(family);
248
249 cgrp_path = argv[optind];
250 if (!cgrp_path) {
251 fprintf(stderr, "cgroup path not given\n");
252 return EXIT_FAILURE;
253 }
254
255 if (do_attach && !idx && !mark && !prio) {
256 fprintf(stderr,
257 "One of device, mark or priority must be given\n");
258 return EXIT_FAILURE;
259 }
260
261 cg_fd = open(cgrp_path, O_DIRECTORY | O_RDONLY);
262 if (cg_fd < 0) {
263 printf("Failed to open cgroup path: '%s'\n", strerror(errno));
264 return EXIT_FAILURE;
265 }
266
267 if (do_attach) {
268 prog_fd = prog_load(idx, mark, prio);
269 if (prog_fd < 0) {
270 printf("Failed to load prog: '%s'\n", strerror(errno));
271 printf("Output from kernel verifier:\n%s\n-------\n",
272 bpf_log_buf);
273 return EXIT_FAILURE;
274 }
275
276 ret = bpf_prog_attach(prog_fd, cg_fd,
277 BPF_CGROUP_INET_SOCK_CREATE, 0);
278 if (ret < 0) {
279 printf("Failed to attach prog to cgroup: '%s'\n",
280 strerror(errno));
281 return EXIT_FAILURE;
282 }
283 } else {
284 ret = bpf_prog_detach(cg_fd, BPF_CGROUP_INET_SOCK_CREATE);
285 if (ret < 0) {
286 printf("Failed to detach prog from cgroup: '%s'\n",
287 strerror(errno));
288 return EXIT_FAILURE;
289 }
290 }
291
292 close(cg_fd);
293 return EXIT_SUCCESS;
294}
1/* eBPF example program:
2 *
3 * - Loads eBPF program
4 *
5 * The eBPF program sets the sk_bound_dev_if index in new AF_INET{6}
6 * sockets opened by processes in the cgroup.
7 *
8 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH
9 */
10
11#define _GNU_SOURCE
12
13#include <stdio.h>
14#include <stdlib.h>
15#include <stddef.h>
16#include <string.h>
17#include <unistd.h>
18#include <assert.h>
19#include <errno.h>
20#include <fcntl.h>
21#include <net/if.h>
22#include <inttypes.h>
23#include <linux/bpf.h>
24
25#include "libbpf.h"
26
27char bpf_log_buf[BPF_LOG_BUF_SIZE];
28
29static int prog_load(__u32 idx, __u32 mark, __u32 prio)
30{
31 /* save pointer to context */
32 struct bpf_insn prog_start[] = {
33 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
34 };
35 struct bpf_insn prog_end[] = {
36 BPF_MOV64_IMM(BPF_REG_0, 1), /* r0 = verdict */
37 BPF_EXIT_INSN(),
38 };
39
40 /* set sk_bound_dev_if on socket */
41 struct bpf_insn prog_dev[] = {
42 BPF_MOV64_IMM(BPF_REG_3, idx),
43 BPF_MOV64_IMM(BPF_REG_2, offsetof(struct bpf_sock, bound_dev_if)),
44 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, offsetof(struct bpf_sock, bound_dev_if)),
45 };
46
47 /* set mark on socket */
48 struct bpf_insn prog_mark[] = {
49 /* get uid of process */
50 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
51 BPF_FUNC_get_current_uid_gid),
52 BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffffffff),
53
54 /* if uid is 0, use given mark, else use the uid as the mark */
55 BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
56 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
57 BPF_MOV64_IMM(BPF_REG_3, mark),
58
59 /* set the mark on the new socket */
60 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
61 BPF_MOV64_IMM(BPF_REG_2, offsetof(struct bpf_sock, mark)),
62 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, offsetof(struct bpf_sock, mark)),
63 };
64
65 /* set priority on socket */
66 struct bpf_insn prog_prio[] = {
67 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
68 BPF_MOV64_IMM(BPF_REG_3, prio),
69 BPF_MOV64_IMM(BPF_REG_2, offsetof(struct bpf_sock, priority)),
70 BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, offsetof(struct bpf_sock, priority)),
71 };
72
73 struct bpf_insn *prog;
74 size_t insns_cnt;
75 void *p;
76 int ret;
77
78 insns_cnt = sizeof(prog_start) + sizeof(prog_end);
79 if (idx)
80 insns_cnt += sizeof(prog_dev);
81
82 if (mark)
83 insns_cnt += sizeof(prog_mark);
84
85 if (prio)
86 insns_cnt += sizeof(prog_prio);
87
88 p = prog = malloc(insns_cnt);
89 if (!prog) {
90 fprintf(stderr, "Failed to allocate memory for instructions\n");
91 return EXIT_FAILURE;
92 }
93
94 memcpy(p, prog_start, sizeof(prog_start));
95 p += sizeof(prog_start);
96
97 if (idx) {
98 memcpy(p, prog_dev, sizeof(prog_dev));
99 p += sizeof(prog_dev);
100 }
101
102 if (mark) {
103 memcpy(p, prog_mark, sizeof(prog_mark));
104 p += sizeof(prog_mark);
105 }
106
107 if (prio) {
108 memcpy(p, prog_prio, sizeof(prog_prio));
109 p += sizeof(prog_prio);
110 }
111
112 memcpy(p, prog_end, sizeof(prog_end));
113 p += sizeof(prog_end);
114
115 insns_cnt /= sizeof(struct bpf_insn);
116
117 ret = bpf_load_program(BPF_PROG_TYPE_CGROUP_SOCK, prog, insns_cnt,
118 "GPL", 0, bpf_log_buf, BPF_LOG_BUF_SIZE);
119
120 free(prog);
121
122 return ret;
123}
124
125static int get_bind_to_device(int sd, char *name, size_t len)
126{
127 socklen_t optlen = len;
128 int rc;
129
130 name[0] = '\0';
131 rc = getsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, name, &optlen);
132 if (rc < 0)
133 perror("setsockopt(SO_BINDTODEVICE)");
134
135 return rc;
136}
137
138static unsigned int get_somark(int sd)
139{
140 unsigned int mark = 0;
141 socklen_t optlen = sizeof(mark);
142 int rc;
143
144 rc = getsockopt(sd, SOL_SOCKET, SO_MARK, &mark, &optlen);
145 if (rc < 0)
146 perror("getsockopt(SO_MARK)");
147
148 return mark;
149}
150
151static unsigned int get_priority(int sd)
152{
153 unsigned int prio = 0;
154 socklen_t optlen = sizeof(prio);
155 int rc;
156
157 rc = getsockopt(sd, SOL_SOCKET, SO_PRIORITY, &prio, &optlen);
158 if (rc < 0)
159 perror("getsockopt(SO_PRIORITY)");
160
161 return prio;
162}
163
164static int show_sockopts(int family)
165{
166 unsigned int mark, prio;
167 char name[16];
168 int sd;
169
170 sd = socket(family, SOCK_DGRAM, 17);
171 if (sd < 0) {
172 perror("socket");
173 return 1;
174 }
175
176 if (get_bind_to_device(sd, name, sizeof(name)) < 0)
177 return 1;
178
179 mark = get_somark(sd);
180 prio = get_priority(sd);
181
182 close(sd);
183
184 printf("sd %d: dev %s, mark %u, priority %u\n", sd, name, mark, prio);
185
186 return 0;
187}
188
189static int usage(const char *argv0)
190{
191 printf("Usage:\n");
192 printf(" Attach a program\n");
193 printf(" %s -b bind-to-dev -m mark -p prio cg-path\n", argv0);
194 printf("\n");
195 printf(" Detach a program\n");
196 printf(" %s -d cg-path\n", argv0);
197 printf("\n");
198 printf(" Show inherited socket settings (mark, priority, and device)\n");
199 printf(" %s [-6]\n", argv0);
200 return EXIT_FAILURE;
201}
202
203int main(int argc, char **argv)
204{
205 __u32 idx = 0, mark = 0, prio = 0;
206 const char *cgrp_path = NULL;
207 int cg_fd, prog_fd, ret;
208 int family = PF_INET;
209 int do_attach = 1;
210 int rc;
211
212 while ((rc = getopt(argc, argv, "db:m:p:6")) != -1) {
213 switch (rc) {
214 case 'd':
215 do_attach = 0;
216 break;
217 case 'b':
218 idx = if_nametoindex(optarg);
219 if (!idx) {
220 idx = strtoumax(optarg, NULL, 0);
221 if (!idx) {
222 printf("Invalid device name\n");
223 return EXIT_FAILURE;
224 }
225 }
226 break;
227 case 'm':
228 mark = strtoumax(optarg, NULL, 0);
229 break;
230 case 'p':
231 prio = strtoumax(optarg, NULL, 0);
232 break;
233 case '6':
234 family = PF_INET6;
235 break;
236 default:
237 return usage(argv[0]);
238 }
239 }
240
241 if (optind == argc)
242 return show_sockopts(family);
243
244 cgrp_path = argv[optind];
245 if (!cgrp_path) {
246 fprintf(stderr, "cgroup path not given\n");
247 return EXIT_FAILURE;
248 }
249
250 if (do_attach && !idx && !mark && !prio) {
251 fprintf(stderr,
252 "One of device, mark or priority must be given\n");
253 return EXIT_FAILURE;
254 }
255
256 cg_fd = open(cgrp_path, O_DIRECTORY | O_RDONLY);
257 if (cg_fd < 0) {
258 printf("Failed to open cgroup path: '%s'\n", strerror(errno));
259 return EXIT_FAILURE;
260 }
261
262 if (do_attach) {
263 prog_fd = prog_load(idx, mark, prio);
264 if (prog_fd < 0) {
265 printf("Failed to load prog: '%s'\n", strerror(errno));
266 printf("Output from kernel verifier:\n%s\n-------\n",
267 bpf_log_buf);
268 return EXIT_FAILURE;
269 }
270
271 ret = bpf_prog_attach(prog_fd, cg_fd,
272 BPF_CGROUP_INET_SOCK_CREATE, 0);
273 if (ret < 0) {
274 printf("Failed to attach prog to cgroup: '%s'\n",
275 strerror(errno));
276 return EXIT_FAILURE;
277 }
278 } else {
279 ret = bpf_prog_detach(cg_fd, BPF_CGROUP_INET_SOCK_CREATE);
280 if (ret < 0) {
281 printf("Failed to detach prog from cgroup: '%s'\n",
282 strerror(errno));
283 return EXIT_FAILURE;
284 }
285 }
286
287 close(cg_fd);
288 return EXIT_SUCCESS;
289}