| 1 | |
| 2 | * - creates arraymap in kernel with key 4 bytes and value 8 bytes
|
| 3 | *
|
| 4 | * - loads eBPF program:
|
| 5 | * r0 = skb->data[ETH_HLEN + offsetof(struct iphdr, protocol)];
|
| 6 | * *(u32*)(fp - 4) = r0;
|
| 7 | * // assuming packet is IPv4, lookup ip->proto in a map
|
| 8 | * value = bpf_map_lookup_elem(map_fd, fp - 4);
|
| 9 | * if (value)
|
| 10 | * (*(u64*)value) += 1;
|
| 11 | *
|
| 12 | * - attaches this program to loopback interface "lo" raw socket
|
| 13 | *
|
| 14 | * - every second user space reads map[tcp], map[udp], map[icmp] to see
|
| 15 | * how many packets of given protocol were seen on "lo"
|
| 16 |
|
| 17 | #include <stdio.h>
|
| 18 | #include <unistd.h>
|
| 19 | #include <assert.h>
|
| 20 | #include <linux/bpf.h>
|
| 21 | #include <string.h>
|
| 22 | #include <stdlib.h>
|
| 23 | #include <errno.h>
|
| 24 | #include <sys/socket.h>
|
| 25 | #include <arpa/inet.h>
|
| 26 | #include <linux/if_ether.h>
|
| 27 | #include <linux/ip.h>
|
| 28 | #include <stddef.h>
|
| 29 | #include <bpf/bpf.h>
|
| 30 | #include "bpf_insn.h"
|
| 31 | #include "sock_example.h"
|
| 32 | #include "bpf_util.h"
|
| 33 |
|
| 34 | char bpf_log_buf[BPF_LOG_BUF_SIZE];
|
| 35 |
|
| 36 | static int test_sock(void)
|
| 37 | {
|
| 38 | int sock = -1, map_fd, prog_fd, i, key;
|
| 39 | long long value = 0, tcp_cnt, udp_cnt, icmp_cnt;
|
| 40 |
|
| 41 | map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, NULL, sizeof(key), sizeof(value),
|
| 42 | 256, NULL);
|
| 43 | if (map_fd < 0) {
|
| 44 | printf("failed to create map '%s'\n", strerror(errno));
|
| 45 | goto cleanup;
|
| 46 | }
|
| 47 |
|
| 48 | struct bpf_insn prog[] = {
|
| 49 | BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
|
| 50 | BPF_LD_ABS(BPF_B, ETH_HLEN + offsetof(struct iphdr, protocol) ),
|
| 51 | BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4),
|
| 52 | BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
| 53 | BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
|
| 54 | BPF_LD_MAP_FD(BPF_REG_1, map_fd),
|
| 55 | BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
| 56 | BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
|
| 57 | BPF_MOV64_IMM(BPF_REG_1, 1),
|
| 58 | BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),
|
| 59 | BPF_MOV64_IMM(BPF_REG_0, 0),
|
| 60 | BPF_EXIT_INSN(),
|
| 61 | };
|
| 62 | size_t insns_cnt = ARRAY_SIZE(prog);
|
| 63 | LIBBPF_OPTS(bpf_prog_load_opts, opts,
|
| 64 | .log_buf = bpf_log_buf,
|
| 65 | .log_size = BPF_LOG_BUF_SIZE,
|
| 66 | );
|
| 67 |
|
| 68 | prog_fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL",
|
| 69 | prog, insns_cnt, &opts);
|
| 70 | if (prog_fd < 0) {
|
| 71 | printf("failed to load prog '%s'\n", strerror(errno));
|
| 72 | goto cleanup;
|
| 73 | }
|
| 74 |
|
| 75 | sock = open_raw_sock("lo");
|
| 76 |
|
| 77 | if (setsockopt(sock, SOL_SOCKET, SO_ATTACH_BPF, &prog_fd,
|
| 78 | sizeof(prog_fd)) < 0) {
|
| 79 | printf("setsockopt %s\n", strerror(errno));
|
| 80 | goto cleanup;
|
| 81 | }
|
| 82 |
|
| 83 | for (i = 0; i < 10; i++) {
|
| 84 | key = IPPROTO_TCP;
|
| 85 | assert(bpf_map_lookup_elem(map_fd, &key, &tcp_cnt) == 0);
|
| 86 |
|
| 87 | key = IPPROTO_UDP;
|
| 88 | assert(bpf_map_lookup_elem(map_fd, &key, &udp_cnt) == 0);
|
| 89 |
|
| 90 | key = IPPROTO_ICMP;
|
| 91 | assert(bpf_map_lookup_elem(map_fd, &key, &icmp_cnt) == 0);
|
| 92 |
|
| 93 | printf("TCP %lld UDP %lld ICMP %lld packets\n",
|
| 94 | tcp_cnt, udp_cnt, icmp_cnt);
|
| 95 | sleep(1);
|
| 96 | }
|
| 97 |
|
| 98 | cleanup:
|
| 99 |
|
| 100 | return 0;
|
| 101 | }
|
| 102 |
|
| 103 | int main(void)
|
| 104 | {
|
| 105 | FILE *f;
|
| 106 |
|
| 107 | f = popen("ping -4 -c5 localhost", "r");
|
| 108 | (void)f;
|
| 109 |
|
| 110 | return test_sock();
|
| 111 | }
|