Loading...
1/* eBPF example program:
2 *
3 * - Creates arraymap in kernel with 4 bytes keys and 8 byte values
4 *
5 * - Loads eBPF program
6 *
7 * The eBPF program accesses the map passed in to store two pieces of
8 * information. The number of invocations of the program, which maps
9 * to the number of packets received, is stored to key 0. Key 1 is
10 * incremented on each iteration by the number of bytes stored in
11 * the skb.
12 *
13 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH
14 *
15 * - Every second, reads map[0] and map[1] to see how many bytes and
16 * packets were seen on any socket of tasks in the given cgroup.
17 */
18
19#define _GNU_SOURCE
20
21#include <stdio.h>
22#include <stdlib.h>
23#include <stddef.h>
24#include <string.h>
25#include <unistd.h>
26#include <assert.h>
27#include <errno.h>
28#include <fcntl.h>
29
30#include <linux/bpf.h>
31#include <bpf/bpf.h>
32
33#include "bpf_insn.h"
34#include "bpf_util.h"
35
36enum {
37 MAP_KEY_PACKETS,
38 MAP_KEY_BYTES,
39};
40
41char bpf_log_buf[BPF_LOG_BUF_SIZE];
42
43static int prog_load(int map_fd, int verdict)
44{
45 struct bpf_insn prog[] = {
46 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */
47
48 /* Count packets */
49 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */
50 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
51 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
52 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
53 BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */
54 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
55 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
56 BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */
57 BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),
58
59 /* Count bytes */
60 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */
61 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
62 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
63 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
64 BPF_LD_MAP_FD(BPF_REG_1, map_fd),
65 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
66 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
67 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */
68
69 BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),
70
71 BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
72 BPF_EXIT_INSN(),
73 };
74 size_t insns_cnt = ARRAY_SIZE(prog);
75 LIBBPF_OPTS(bpf_prog_load_opts, opts,
76 .log_buf = bpf_log_buf,
77 .log_size = BPF_LOG_BUF_SIZE,
78 );
79
80 return bpf_prog_load(BPF_PROG_TYPE_CGROUP_SKB, NULL, "GPL",
81 prog, insns_cnt, &opts);
82}
83
84static int usage(const char *argv0)
85{
86 printf("Usage: %s [-d] [-D] <cg-path> <egress|ingress>\n", argv0);
87 printf(" -d Drop Traffic\n");
88 printf(" -D Detach filter, and exit\n");
89 return EXIT_FAILURE;
90}
91
92static int attach_filter(int cg_fd, int type, int verdict)
93{
94 int prog_fd, map_fd, ret, key;
95 long long pkt_cnt, byte_cnt;
96
97 map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, NULL,
98 sizeof(key), sizeof(byte_cnt),
99 256, NULL);
100 if (map_fd < 0) {
101 printf("Failed to create map: '%s'\n", strerror(errno));
102 return EXIT_FAILURE;
103 }
104
105 prog_fd = prog_load(map_fd, verdict);
106 printf("Output from kernel verifier:\n%s\n-------\n", bpf_log_buf);
107
108 if (prog_fd < 0) {
109 printf("Failed to load prog: '%s'\n", strerror(errno));
110 return EXIT_FAILURE;
111 }
112
113 ret = bpf_prog_attach(prog_fd, cg_fd, type, 0);
114 if (ret < 0) {
115 printf("Failed to attach prog to cgroup: '%s'\n",
116 strerror(errno));
117 return EXIT_FAILURE;
118 }
119 while (1) {
120 key = MAP_KEY_PACKETS;
121 assert(bpf_map_lookup_elem(map_fd, &key, &pkt_cnt) == 0);
122
123 key = MAP_KEY_BYTES;
124 assert(bpf_map_lookup_elem(map_fd, &key, &byte_cnt) == 0);
125
126 printf("cgroup received %lld packets, %lld bytes\n",
127 pkt_cnt, byte_cnt);
128 sleep(1);
129 }
130
131 return EXIT_SUCCESS;
132}
133
134int main(int argc, char **argv)
135{
136 int detach_only = 0, verdict = 1;
137 enum bpf_attach_type type;
138 int opt, cg_fd, ret;
139
140 while ((opt = getopt(argc, argv, "Dd")) != -1) {
141 switch (opt) {
142 case 'd':
143 verdict = 0;
144 break;
145 case 'D':
146 detach_only = 1;
147 break;
148 default:
149 return usage(argv[0]);
150 }
151 }
152
153 if (argc - optind < 2)
154 return usage(argv[0]);
155
156 if (strcmp(argv[optind + 1], "ingress") == 0)
157 type = BPF_CGROUP_INET_INGRESS;
158 else if (strcmp(argv[optind + 1], "egress") == 0)
159 type = BPF_CGROUP_INET_EGRESS;
160 else
161 return usage(argv[0]);
162
163 cg_fd = open(argv[optind], O_DIRECTORY | O_RDONLY);
164 if (cg_fd < 0) {
165 printf("Failed to open cgroup path: '%s'\n", strerror(errno));
166 return EXIT_FAILURE;
167 }
168
169 if (detach_only) {
170 ret = bpf_prog_detach(cg_fd, type);
171 printf("bpf_prog_detach() returned '%s' (%d)\n",
172 strerror(errno), errno);
173 } else
174 ret = attach_filter(cg_fd, type, verdict);
175
176 return ret;
177}
1/* eBPF example program:
2 *
3 * - Creates arraymap in kernel with 4 bytes keys and 8 byte values
4 *
5 * - Loads eBPF program
6 *
7 * The eBPF program accesses the map passed in to store two pieces of
8 * information. The number of invocations of the program, which maps
9 * to the number of packets received, is stored to key 0. Key 1 is
10 * incremented on each iteration by the number of bytes stored in
11 * the skb.
12 *
13 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH
14 *
15 * - Every second, reads map[0] and map[1] to see how many bytes and
16 * packets were seen on any socket of tasks in the given cgroup.
17 */
18
19#define _GNU_SOURCE
20
21#include <stdio.h>
22#include <stdlib.h>
23#include <stddef.h>
24#include <string.h>
25#include <unistd.h>
26#include <assert.h>
27#include <errno.h>
28#include <fcntl.h>
29
30#include <linux/bpf.h>
31#include <bpf/bpf.h>
32
33#include "bpf_insn.h"
34
35enum {
36 MAP_KEY_PACKETS,
37 MAP_KEY_BYTES,
38};
39
40char bpf_log_buf[BPF_LOG_BUF_SIZE];
41
42static int prog_load(int map_fd, int verdict)
43{
44 struct bpf_insn prog[] = {
45 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */
46
47 /* Count packets */
48 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */
49 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
50 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
51 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
52 BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */
53 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
54 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
55 BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */
56 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
57
58 /* Count bytes */
59 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */
60 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
61 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
62 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
63 BPF_LD_MAP_FD(BPF_REG_1, map_fd),
64 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
65 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
66 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */
67 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
68
69 BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
70 BPF_EXIT_INSN(),
71 };
72 size_t insns_cnt = sizeof(prog) / sizeof(struct bpf_insn);
73
74 return bpf_load_program(BPF_PROG_TYPE_CGROUP_SKB,
75 prog, insns_cnt, "GPL", 0,
76 bpf_log_buf, BPF_LOG_BUF_SIZE);
77}
78
79static int usage(const char *argv0)
80{
81 printf("Usage: %s [-d] [-D] <cg-path> <egress|ingress>\n", argv0);
82 printf(" -d Drop Traffic\n");
83 printf(" -D Detach filter, and exit\n");
84 return EXIT_FAILURE;
85}
86
87static int attach_filter(int cg_fd, int type, int verdict)
88{
89 int prog_fd, map_fd, ret, key;
90 long long pkt_cnt, byte_cnt;
91
92 map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY,
93 sizeof(key), sizeof(byte_cnt),
94 256, 0);
95 if (map_fd < 0) {
96 printf("Failed to create map: '%s'\n", strerror(errno));
97 return EXIT_FAILURE;
98 }
99
100 prog_fd = prog_load(map_fd, verdict);
101 printf("Output from kernel verifier:\n%s\n-------\n", bpf_log_buf);
102
103 if (prog_fd < 0) {
104 printf("Failed to load prog: '%s'\n", strerror(errno));
105 return EXIT_FAILURE;
106 }
107
108 ret = bpf_prog_attach(prog_fd, cg_fd, type, 0);
109 if (ret < 0) {
110 printf("Failed to attach prog to cgroup: '%s'\n",
111 strerror(errno));
112 return EXIT_FAILURE;
113 }
114 while (1) {
115 key = MAP_KEY_PACKETS;
116 assert(bpf_map_lookup_elem(map_fd, &key, &pkt_cnt) == 0);
117
118 key = MAP_KEY_BYTES;
119 assert(bpf_map_lookup_elem(map_fd, &key, &byte_cnt) == 0);
120
121 printf("cgroup received %lld packets, %lld bytes\n",
122 pkt_cnt, byte_cnt);
123 sleep(1);
124 }
125
126 return EXIT_SUCCESS;
127}
128
129int main(int argc, char **argv)
130{
131 int detach_only = 0, verdict = 1;
132 enum bpf_attach_type type;
133 int opt, cg_fd, ret;
134
135 while ((opt = getopt(argc, argv, "Dd")) != -1) {
136 switch (opt) {
137 case 'd':
138 verdict = 0;
139 break;
140 case 'D':
141 detach_only = 1;
142 break;
143 default:
144 return usage(argv[0]);
145 }
146 }
147
148 if (argc - optind < 2)
149 return usage(argv[0]);
150
151 if (strcmp(argv[optind + 1], "ingress") == 0)
152 type = BPF_CGROUP_INET_INGRESS;
153 else if (strcmp(argv[optind + 1], "egress") == 0)
154 type = BPF_CGROUP_INET_EGRESS;
155 else
156 return usage(argv[0]);
157
158 cg_fd = open(argv[optind], O_DIRECTORY | O_RDONLY);
159 if (cg_fd < 0) {
160 printf("Failed to open cgroup path: '%s'\n", strerror(errno));
161 return EXIT_FAILURE;
162 }
163
164 if (detach_only) {
165 ret = bpf_prog_detach(cg_fd, type);
166 printf("bpf_prog_detach() returned '%s' (%d)\n",
167 strerror(errno), errno);
168 } else
169 ret = attach_filter(cg_fd, type, verdict);
170
171 return ret;
172}