1 /* eBPF example program: 2 * 3 * - Creates arraymap in kernel with 4 bytes keys and 8 byte values 4 * 5 * - Loads eBPF program 6 * 7 * The eBPF program accesses the map passed in to store two pieces of 8 * information. The number of invocations of the program, which maps 9 * to the number of packets received, is stored to key 0. Key 1 is 10 * incremented on each iteration by the number of bytes stored in 11 * the skb. 12 * 13 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH 14 * 15 * - Every second, reads map[0] and map[1] to see how many bytes and 16 * packets were seen on any socket of tasks in the given cgroup. 17 */ 18 19 #define _GNU_SOURCE 20 21 #include <stdio.h> 22 #include <stdlib.h> 23 #include <stddef.h> 24 #include <string.h> 25 #include <unistd.h> 26 #include <assert.h> 27 #include <errno.h> 28 #include <fcntl.h> 29 30 #include <linux/bpf.h> 31 #include <bpf/bpf.h> 32 33 #include "bpf_insn.h" 34 #include "bpf_util.h" 35 36 enum { 37 MAP_KEY_PACKETS, 38 MAP_KEY_BYTES, 39 }; 40 41 char bpf_log_buf[BPF_LOG_BUF_SIZE]; 42 43 static int prog_load(int map_fd, int verdict) 44 { 45 struct bpf_insn prog[] = { 46 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */ 47 48 /* Count packets */ 49 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */ 50 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */ 51 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 52 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */ 53 BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */ 54 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 55 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), 56 BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */ 57 BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0), 58 59 /* Count bytes */ 60 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */ 61 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */ 62 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 63 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */ 64 BPF_LD_MAP_FD(BPF_REG_1, map_fd), 65 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 66 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), 67 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */ 68 69 BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0), 70 71 BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */ 72 BPF_EXIT_INSN(), 73 }; 74 size_t insns_cnt = ARRAY_SIZE(prog); 75 LIBBPF_OPTS(bpf_prog_load_opts, opts, 76 .log_buf = bpf_log_buf, 77 .log_size = BPF_LOG_BUF_SIZE, 78 ); 79 80 return bpf_prog_load(BPF_PROG_TYPE_CGROUP_SKB, NULL, "GPL", 81 prog, insns_cnt, &opts); 82 } 83 84 static int usage(const char *argv0) 85 { 86 printf("Usage: %s [-d] [-D] <cg-path> <egress|ingress>\n", argv0); 87 printf(" -d Drop Traffic\n"); 88 printf(" -D Detach filter, and exit\n"); 89 return EXIT_FAILURE; 90 } 91 92 static int attach_filter(int cg_fd, int type, int verdict) 93 { 94 int prog_fd, map_fd, ret, key; 95 long long pkt_cnt, byte_cnt; 96 97 map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, NULL, 98 sizeof(key), sizeof(byte_cnt), 99 256, NULL); 100 if (map_fd < 0) { 101 printf("Failed to create map: '%s'\n", strerror(errno)); 102 return EXIT_FAILURE; 103 } 104 105 prog_fd = prog_load(map_fd, verdict); 106 printf("Output from kernel verifier:\n%s\n-------\n", bpf_log_buf); 107 108 if (prog_fd < 0) { 109 printf("Failed to load prog: '%s'\n", strerror(errno)); 110 return EXIT_FAILURE; 111 } 112 113 ret = bpf_prog_attach(prog_fd, cg_fd, type, 0); 114 if (ret < 0) { 115 printf("Failed to attach prog to cgroup: '%s'\n", 116 strerror(errno)); 117 return EXIT_FAILURE; 118 } 119 while (1) { 120 key = MAP_KEY_PACKETS; 121 assert(bpf_map_lookup_elem(map_fd, &key, &pkt_cnt) == 0); 122 123 key = MAP_KEY_BYTES; 124 assert(bpf_map_lookup_elem(map_fd, &key, &byte_cnt) == 0); 125 126 printf("cgroup received %lld packets, %lld bytes\n", 127 pkt_cnt, byte_cnt); 128 sleep(1); 129 } 130 131 return EXIT_SUCCESS; 132 } 133 134 int main(int argc, char **argv) 135 { 136 int detach_only = 0, verdict = 1; 137 enum bpf_attach_type type; 138 int opt, cg_fd, ret; 139 140 while ((opt = getopt(argc, argv, "Dd")) != -1) { 141 switch (opt) { 142 case 'd': 143 verdict = 0; 144 break; 145 case 'D': 146 detach_only = 1; 147 break; 148 default: 149 return usage(argv[0]); 150 } 151 } 152 153 if (argc - optind < 2) 154 return usage(argv[0]); 155 156 if (strcmp(argv[optind + 1], "ingress") == 0) 157 type = BPF_CGROUP_INET_INGRESS; 158 else if (strcmp(argv[optind + 1], "egress") == 0) 159 type = BPF_CGROUP_INET_EGRESS; 160 else 161 return usage(argv[0]); 162 163 cg_fd = open(argv[optind], O_DIRECTORY | O_RDONLY); 164 if (cg_fd < 0) { 165 printf("Failed to open cgroup path: '%s'\n", strerror(errno)); 166 return EXIT_FAILURE; 167 } 168 169 if (detach_only) { 170 ret = bpf_prog_detach(cg_fd, type); 171 printf("bpf_prog_detach() returned '%s' (%d)\n", 172 strerror(errno), errno); 173 } else 174 ret = attach_filter(cg_fd, type, verdict); 175 176 return ret; 177 } 178