test_cgrp2_attach.c 4.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172
  1. /* eBPF example program:
  2. *
  3. * - Creates arraymap in kernel with 4 bytes keys and 8 byte values
  4. *
  5. * - Loads eBPF program
  6. *
  7. * The eBPF program accesses the map passed in to store two pieces of
  8. * information. The number of invocations of the program, which maps
  9. * to the number of packets received, is stored to key 0. Key 1 is
  10. * incremented on each iteration by the number of bytes stored in
  11. * the skb.
  12. *
  13. * - Attaches the new program to a cgroup using BPF_PROG_ATTACH
  14. *
  15. * - Every second, reads map[0] and map[1] to see how many bytes and
  16. * packets were seen on any socket of tasks in the given cgroup.
  17. */
  18. #define _GNU_SOURCE
  19. #include <stdio.h>
  20. #include <stdlib.h>
  21. #include <stddef.h>
  22. #include <string.h>
  23. #include <unistd.h>
  24. #include <assert.h>
  25. #include <errno.h>
  26. #include <fcntl.h>
  27. #include <linux/bpf.h>
  28. #include <bpf/bpf.h>
  29. #include "bpf_insn.h"
  30. enum {
  31. MAP_KEY_PACKETS,
  32. MAP_KEY_BYTES,
  33. };
  34. char bpf_log_buf[BPF_LOG_BUF_SIZE];
  35. static int prog_load(int map_fd, int verdict)
  36. {
  37. struct bpf_insn prog[] = {
  38. BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */
  39. /* Count packets */
  40. BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */
  41. BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
  42. BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  43. BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
  44. BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */
  45. BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  46. BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
  47. BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */
  48. BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
  49. /* Count bytes */
  50. BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */
  51. BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
  52. BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  53. BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
  54. BPF_LD_MAP_FD(BPF_REG_1, map_fd),
  55. BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  56. BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
  57. BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */
  58. BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
  59. BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
  60. BPF_EXIT_INSN(),
  61. };
  62. size_t insns_cnt = sizeof(prog) / sizeof(struct bpf_insn);
  63. return bpf_load_program(BPF_PROG_TYPE_CGROUP_SKB,
  64. prog, insns_cnt, "GPL", 0,
  65. bpf_log_buf, BPF_LOG_BUF_SIZE);
  66. }
  67. static int usage(const char *argv0)
  68. {
  69. printf("Usage: %s [-d] [-D] <cg-path> <egress|ingress>\n", argv0);
  70. printf(" -d Drop Traffic\n");
  71. printf(" -D Detach filter, and exit\n");
  72. return EXIT_FAILURE;
  73. }
  74. static int attach_filter(int cg_fd, int type, int verdict)
  75. {
  76. int prog_fd, map_fd, ret, key;
  77. long long pkt_cnt, byte_cnt;
  78. map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY,
  79. sizeof(key), sizeof(byte_cnt),
  80. 256, 0);
  81. if (map_fd < 0) {
  82. printf("Failed to create map: '%s'\n", strerror(errno));
  83. return EXIT_FAILURE;
  84. }
  85. prog_fd = prog_load(map_fd, verdict);
  86. printf("Output from kernel verifier:\n%s\n-------\n", bpf_log_buf);
  87. if (prog_fd < 0) {
  88. printf("Failed to load prog: '%s'\n", strerror(errno));
  89. return EXIT_FAILURE;
  90. }
  91. ret = bpf_prog_attach(prog_fd, cg_fd, type, 0);
  92. if (ret < 0) {
  93. printf("Failed to attach prog to cgroup: '%s'\n",
  94. strerror(errno));
  95. return EXIT_FAILURE;
  96. }
  97. while (1) {
  98. key = MAP_KEY_PACKETS;
  99. assert(bpf_map_lookup_elem(map_fd, &key, &pkt_cnt) == 0);
  100. key = MAP_KEY_BYTES;
  101. assert(bpf_map_lookup_elem(map_fd, &key, &byte_cnt) == 0);
  102. printf("cgroup received %lld packets, %lld bytes\n",
  103. pkt_cnt, byte_cnt);
  104. sleep(1);
  105. }
  106. return EXIT_SUCCESS;
  107. }
  108. int main(int argc, char **argv)
  109. {
  110. int detach_only = 0, verdict = 1;
  111. enum bpf_attach_type type;
  112. int opt, cg_fd, ret;
  113. while ((opt = getopt(argc, argv, "Dd")) != -1) {
  114. switch (opt) {
  115. case 'd':
  116. verdict = 0;
  117. break;
  118. case 'D':
  119. detach_only = 1;
  120. break;
  121. default:
  122. return usage(argv[0]);
  123. }
  124. }
  125. if (argc - optind < 2)
  126. return usage(argv[0]);
  127. if (strcmp(argv[optind + 1], "ingress") == 0)
  128. type = BPF_CGROUP_INET_INGRESS;
  129. else if (strcmp(argv[optind + 1], "egress") == 0)
  130. type = BPF_CGROUP_INET_EGRESS;
  131. else
  132. return usage(argv[0]);
  133. cg_fd = open(argv[optind], O_DIRECTORY | O_RDONLY);
  134. if (cg_fd < 0) {
  135. printf("Failed to open cgroup path: '%s'\n", strerror(errno));
  136. return EXIT_FAILURE;
  137. }
  138. if (detach_only) {
  139. ret = bpf_prog_detach(cg_fd, type);
  140. printf("bpf_prog_detach() returned '%s' (%d)\n",
  141. strerror(errno), errno);
  142. } else
  143. ret = attach_filter(cg_fd, type, verdict);
  144. return ret;
  145. }