1 /* eBPF example program:
2  *
3  * - Creates arraymap in kernel with 4 bytes keys and 8 byte values
4  *
5  * - Loads eBPF program
6  *
7  *   The eBPF program accesses the map passed in to store two pieces of
8  *   information. The number of invocations of the program, which maps
9  *   to the number of packets received, is stored to key 0. Key 1 is
10  *   incremented on each iteration by the number of bytes stored in
11  *   the skb.
12  *
13  * - Attaches the new program to a cgroup using BPF_PROG_ATTACH
14  *
15  * - Every second, reads map[0] and map[1] to see how many bytes and
16  *   packets were seen on any socket of tasks in the given cgroup.
17  */
18 
19 #define _GNU_SOURCE
20 
21 #include <stdio.h>
22 #include <stdlib.h>
23 #include <stddef.h>
24 #include <string.h>
25 #include <unistd.h>
26 #include <assert.h>
27 #include <errno.h>
28 #include <fcntl.h>
29 
30 #include <linux/bpf.h>
31 #include <bpf/bpf.h>
32 
33 #include "bpf_insn.h"
34 #include "bpf_util.h"
35 
36 enum {
37 	MAP_KEY_PACKETS,
38 	MAP_KEY_BYTES,
39 };
40 
41 char bpf_log_buf[BPF_LOG_BUF_SIZE];
42 
prog_load(int map_fd,int verdict)43 static int prog_load(int map_fd, int verdict)
44 {
45 	struct bpf_insn prog[] = {
46 		BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */
47 
48 		/* Count packets */
49 		BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */
50 		BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
51 		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
52 		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
53 		BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */
54 		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
55 		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
56 		BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */
57 		BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),
58 
59 		/* Count bytes */
60 		BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */
61 		BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
62 		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
63 		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
64 		BPF_LD_MAP_FD(BPF_REG_1, map_fd),
65 		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
66 		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
67 		BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */
68 
69 		BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),
70 
71 		BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
72 		BPF_EXIT_INSN(),
73 	};
74 	size_t insns_cnt = ARRAY_SIZE(prog);
75 	LIBBPF_OPTS(bpf_prog_load_opts, opts,
76 		.log_buf = bpf_log_buf,
77 		.log_size = BPF_LOG_BUF_SIZE,
78 	);
79 
80 	return bpf_prog_load(BPF_PROG_TYPE_CGROUP_SKB, NULL, "GPL",
81 			     prog, insns_cnt, &opts);
82 }
83 
usage(const char * argv0)84 static int usage(const char *argv0)
85 {
86 	printf("Usage: %s [-d] [-D] <cg-path> <egress|ingress>\n", argv0);
87 	printf("	-d	Drop Traffic\n");
88 	printf("	-D	Detach filter, and exit\n");
89 	return EXIT_FAILURE;
90 }
91 
attach_filter(int cg_fd,int type,int verdict)92 static int attach_filter(int cg_fd, int type, int verdict)
93 {
94 	int prog_fd, map_fd, ret, key;
95 	long long pkt_cnt, byte_cnt;
96 
97 	map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, NULL,
98 				sizeof(key), sizeof(byte_cnt),
99 				256, NULL);
100 	if (map_fd < 0) {
101 		printf("Failed to create map: '%s'\n", strerror(errno));
102 		return EXIT_FAILURE;
103 	}
104 
105 	prog_fd = prog_load(map_fd, verdict);
106 	printf("Output from kernel verifier:\n%s\n-------\n", bpf_log_buf);
107 
108 	if (prog_fd < 0) {
109 		printf("Failed to load prog: '%s'\n", strerror(errno));
110 		return EXIT_FAILURE;
111 	}
112 
113 	ret = bpf_prog_attach(prog_fd, cg_fd, type, 0);
114 	if (ret < 0) {
115 		printf("Failed to attach prog to cgroup: '%s'\n",
116 		       strerror(errno));
117 		return EXIT_FAILURE;
118 	}
119 	while (1) {
120 		key = MAP_KEY_PACKETS;
121 		assert(bpf_map_lookup_elem(map_fd, &key, &pkt_cnt) == 0);
122 
123 		key = MAP_KEY_BYTES;
124 		assert(bpf_map_lookup_elem(map_fd, &key, &byte_cnt) == 0);
125 
126 		printf("cgroup received %lld packets, %lld bytes\n",
127 		       pkt_cnt, byte_cnt);
128 		sleep(1);
129 	}
130 
131 	return EXIT_SUCCESS;
132 }
133 
main(int argc,char ** argv)134 int main(int argc, char **argv)
135 {
136 	int detach_only = 0, verdict = 1;
137 	enum bpf_attach_type type;
138 	int opt, cg_fd, ret;
139 
140 	while ((opt = getopt(argc, argv, "Dd")) != -1) {
141 		switch (opt) {
142 		case 'd':
143 			verdict = 0;
144 			break;
145 		case 'D':
146 			detach_only = 1;
147 			break;
148 		default:
149 			return usage(argv[0]);
150 		}
151 	}
152 
153 	if (argc - optind < 2)
154 		return usage(argv[0]);
155 
156 	if (strcmp(argv[optind + 1], "ingress") == 0)
157 		type = BPF_CGROUP_INET_INGRESS;
158 	else if (strcmp(argv[optind + 1], "egress") == 0)
159 		type = BPF_CGROUP_INET_EGRESS;
160 	else
161 		return usage(argv[0]);
162 
163 	cg_fd = open(argv[optind], O_DIRECTORY | O_RDONLY);
164 	if (cg_fd < 0) {
165 		printf("Failed to open cgroup path: '%s'\n", strerror(errno));
166 		return EXIT_FAILURE;
167 	}
168 
169 	if (detach_only) {
170 		ret = bpf_prog_detach(cg_fd, type);
171 		printf("bpf_prog_detach() returned '%s' (%d)\n",
172 		       strerror(errno), errno);
173 	} else
174 		ret = attach_filter(cg_fd, type, verdict);
175 
176 	return ret;
177 }
178