samples: bpf: large eBPF program in C
sockex2_kern.c is purposefully large eBPF program in C. llvm compiles ~200 lines of C code into ~300 eBPF instructions. It's similar to __skb_flow_dissect() to demonstrate that complex packet parsing can be done by eBPF. Then it uses (struct flow_keys)->dst IP address (or hash of ipv6 dst) to keep stats of number of packets per IP. User space loads eBPF program, attaches it to loopback interface and prints dest_ip->#packets stats every second. Usage: $sudo samples/bpf/sockex2 ip 127.0.0.1 count 19 ip 127.0.0.1 count 178115 ip 127.0.0.1 count 369437 ip 127.0.0.1 count 559841 ip 127.0.0.1 count 750539 Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Alexei Starovoitov
David S. Miller
Родитель
a80857822b
Коммит
fbe3310840
|
|
@ -5,20 +5,24 @@ obj- := dummy.o
|
|||
hostprogs-y := test_verifier test_maps
|
||||
hostprogs-y += sock_example
|
||||
hostprogs-y += sockex1
|
||||
hostprogs-y += sockex2
|
||||
|
||||
test_verifier-objs := test_verifier.o libbpf.o
|
||||
test_maps-objs := test_maps.o libbpf.o
|
||||
sock_example-objs := sock_example.o libbpf.o
|
||||
sockex1-objs := bpf_load.o libbpf.o sockex1_user.o
|
||||
sockex2-objs := bpf_load.o libbpf.o sockex2_user.o
|
||||
|
||||
# Tell kbuild to always build the programs
|
||||
always := $(hostprogs-y)
|
||||
always += sockex1_kern.o
|
||||
always += sockex2_kern.o
|
||||
|
||||
HOSTCFLAGS += -I$(objtree)/usr/include
|
||||
|
||||
HOSTCFLAGS_bpf_load.o += -I$(objtree)/usr/include -Wno-unused-variable
|
||||
HOSTLOADLIBES_sockex1 += -lelf
|
||||
HOSTLOADLIBES_sockex2 += -lelf
|
||||
|
||||
# point this to your LLVM backend with bpf support
|
||||
LLC=$(srctree)/tools/bpf/llvm/bld/Debug+Asserts/bin/llc
|
||||
|
|
|
|||
|
|
@ -0,0 +1,215 @@
|
|||
#include <uapi/linux/bpf.h>
|
||||
#include "bpf_helpers.h"
|
||||
#include <uapi/linux/in.h>
|
||||
#include <uapi/linux/if.h>
|
||||
#include <uapi/linux/if_ether.h>
|
||||
#include <uapi/linux/ip.h>
|
||||
#include <uapi/linux/ipv6.h>
|
||||
#include <uapi/linux/if_tunnel.h>
|
||||
#define IP_MF 0x2000
|
||||
#define IP_OFFSET 0x1FFF
|
||||
|
||||
struct vlan_hdr {
|
||||
__be16 h_vlan_TCI;
|
||||
__be16 h_vlan_encapsulated_proto;
|
||||
};
|
||||
|
||||
struct flow_keys {
|
||||
__be32 src;
|
||||
__be32 dst;
|
||||
union {
|
||||
__be32 ports;
|
||||
__be16 port16[2];
|
||||
};
|
||||
__u16 thoff;
|
||||
__u8 ip_proto;
|
||||
};
|
||||
|
||||
static inline int proto_ports_offset(__u64 proto)
|
||||
{
|
||||
switch (proto) {
|
||||
case IPPROTO_TCP:
|
||||
case IPPROTO_UDP:
|
||||
case IPPROTO_DCCP:
|
||||
case IPPROTO_ESP:
|
||||
case IPPROTO_SCTP:
|
||||
case IPPROTO_UDPLITE:
|
||||
return 0;
|
||||
case IPPROTO_AH:
|
||||
return 4;
|
||||
default:
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
static inline int ip_is_fragment(struct sk_buff *ctx, __u64 nhoff)
|
||||
{
|
||||
return load_half(ctx, nhoff + offsetof(struct iphdr, frag_off))
|
||||
& (IP_MF | IP_OFFSET);
|
||||
}
|
||||
|
||||
static inline __u32 ipv6_addr_hash(struct sk_buff *ctx, __u64 off)
|
||||
{
|
||||
__u64 w0 = load_word(ctx, off);
|
||||
__u64 w1 = load_word(ctx, off + 4);
|
||||
__u64 w2 = load_word(ctx, off + 8);
|
||||
__u64 w3 = load_word(ctx, off + 12);
|
||||
|
||||
return (__u32)(w0 ^ w1 ^ w2 ^ w3);
|
||||
}
|
||||
|
||||
static inline __u64 parse_ip(struct sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
|
||||
struct flow_keys *flow)
|
||||
{
|
||||
__u64 verlen;
|
||||
|
||||
if (unlikely(ip_is_fragment(skb, nhoff)))
|
||||
*ip_proto = 0;
|
||||
else
|
||||
*ip_proto = load_byte(skb, nhoff + offsetof(struct iphdr, protocol));
|
||||
|
||||
if (*ip_proto != IPPROTO_GRE) {
|
||||
flow->src = load_word(skb, nhoff + offsetof(struct iphdr, saddr));
|
||||
flow->dst = load_word(skb, nhoff + offsetof(struct iphdr, daddr));
|
||||
}
|
||||
|
||||
verlen = load_byte(skb, nhoff + 0/*offsetof(struct iphdr, ihl)*/);
|
||||
if (likely(verlen == 0x45))
|
||||
nhoff += 20;
|
||||
else
|
||||
nhoff += (verlen & 0xF) << 2;
|
||||
|
||||
return nhoff;
|
||||
}
|
||||
|
||||
static inline __u64 parse_ipv6(struct sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
|
||||
struct flow_keys *flow)
|
||||
{
|
||||
*ip_proto = load_byte(skb,
|
||||
nhoff + offsetof(struct ipv6hdr, nexthdr));
|
||||
flow->src = ipv6_addr_hash(skb,
|
||||
nhoff + offsetof(struct ipv6hdr, saddr));
|
||||
flow->dst = ipv6_addr_hash(skb,
|
||||
nhoff + offsetof(struct ipv6hdr, daddr));
|
||||
nhoff += sizeof(struct ipv6hdr);
|
||||
|
||||
return nhoff;
|
||||
}
|
||||
|
||||
static inline bool flow_dissector(struct sk_buff *skb, struct flow_keys *flow)
|
||||
{
|
||||
__u64 nhoff = ETH_HLEN;
|
||||
__u64 ip_proto;
|
||||
__u64 proto = load_half(skb, 12);
|
||||
int poff;
|
||||
|
||||
if (proto == ETH_P_8021AD) {
|
||||
proto = load_half(skb, nhoff + offsetof(struct vlan_hdr,
|
||||
h_vlan_encapsulated_proto));
|
||||
nhoff += sizeof(struct vlan_hdr);
|
||||
}
|
||||
|
||||
if (proto == ETH_P_8021Q) {
|
||||
proto = load_half(skb, nhoff + offsetof(struct vlan_hdr,
|
||||
h_vlan_encapsulated_proto));
|
||||
nhoff += sizeof(struct vlan_hdr);
|
||||
}
|
||||
|
||||
if (likely(proto == ETH_P_IP))
|
||||
nhoff = parse_ip(skb, nhoff, &ip_proto, flow);
|
||||
else if (proto == ETH_P_IPV6)
|
||||
nhoff = parse_ipv6(skb, nhoff, &ip_proto, flow);
|
||||
else
|
||||
return false;
|
||||
|
||||
switch (ip_proto) {
|
||||
case IPPROTO_GRE: {
|
||||
struct gre_hdr {
|
||||
__be16 flags;
|
||||
__be16 proto;
|
||||
};
|
||||
|
||||
__u64 gre_flags = load_half(skb,
|
||||
nhoff + offsetof(struct gre_hdr, flags));
|
||||
__u64 gre_proto = load_half(skb,
|
||||
nhoff + offsetof(struct gre_hdr, proto));
|
||||
|
||||
if (gre_flags & (GRE_VERSION|GRE_ROUTING))
|
||||
break;
|
||||
|
||||
proto = gre_proto;
|
||||
nhoff += 4;
|
||||
if (gre_flags & GRE_CSUM)
|
||||
nhoff += 4;
|
||||
if (gre_flags & GRE_KEY)
|
||||
nhoff += 4;
|
||||
if (gre_flags & GRE_SEQ)
|
||||
nhoff += 4;
|
||||
|
||||
if (proto == ETH_P_8021Q) {
|
||||
proto = load_half(skb,
|
||||
nhoff + offsetof(struct vlan_hdr,
|
||||
h_vlan_encapsulated_proto));
|
||||
nhoff += sizeof(struct vlan_hdr);
|
||||
}
|
||||
|
||||
if (proto == ETH_P_IP)
|
||||
nhoff = parse_ip(skb, nhoff, &ip_proto, flow);
|
||||
else if (proto == ETH_P_IPV6)
|
||||
nhoff = parse_ipv6(skb, nhoff, &ip_proto, flow);
|
||||
else
|
||||
return false;
|
||||
break;
|
||||
}
|
||||
case IPPROTO_IPIP:
|
||||
nhoff = parse_ip(skb, nhoff, &ip_proto, flow);
|
||||
break;
|
||||
case IPPROTO_IPV6:
|
||||
nhoff = parse_ipv6(skb, nhoff, &ip_proto, flow);
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
flow->ip_proto = ip_proto;
|
||||
poff = proto_ports_offset(ip_proto);
|
||||
if (poff >= 0) {
|
||||
nhoff += poff;
|
||||
flow->ports = load_word(skb, nhoff);
|
||||
}
|
||||
|
||||
flow->thoff = (__u16) nhoff;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
struct bpf_map_def SEC("maps") hash_map = {
|
||||
.type = BPF_MAP_TYPE_HASH,
|
||||
.key_size = sizeof(__be32),
|
||||
.value_size = sizeof(long),
|
||||
.max_entries = 1024,
|
||||
};
|
||||
|
||||
SEC("socket2")
|
||||
int bpf_prog2(struct sk_buff *skb)
|
||||
{
|
||||
struct flow_keys flow;
|
||||
long *value;
|
||||
u32 key;
|
||||
|
||||
if (!flow_dissector(skb, &flow))
|
||||
return 0;
|
||||
|
||||
key = flow.dst;
|
||||
value = bpf_map_lookup_elem(&hash_map, &key);
|
||||
if (value) {
|
||||
__sync_fetch_and_add(value, 1);
|
||||
} else {
|
||||
long val = 1;
|
||||
|
||||
bpf_map_update_elem(&hash_map, &key, &val, BPF_ANY);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
char _license[] SEC("license") = "GPL";
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
#include <stdio.h>
|
||||
#include <assert.h>
|
||||
#include <linux/bpf.h>
|
||||
#include "libbpf.h"
|
||||
#include "bpf_load.h"
|
||||
#include <unistd.h>
|
||||
#include <arpa/inet.h>
|
||||
|
||||
int main(int ac, char **argv)
|
||||
{
|
||||
char filename[256];
|
||||
FILE *f;
|
||||
int i, sock;
|
||||
|
||||
snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
|
||||
|
||||
if (load_bpf_file(filename)) {
|
||||
printf("%s", bpf_log_buf);
|
||||
return 1;
|
||||
}
|
||||
|
||||
sock = open_raw_sock("lo");
|
||||
|
||||
assert(setsockopt(sock, SOL_SOCKET, SO_ATTACH_BPF, prog_fd,
|
||||
sizeof(prog_fd[0])) == 0);
|
||||
|
||||
f = popen("ping -c5 localhost", "r");
|
||||
(void) f;
|
||||
|
||||
for (i = 0; i < 5; i++) {
|
||||
int key = 0, next_key;
|
||||
long long value;
|
||||
|
||||
while (bpf_get_next_key(map_fd[0], &key, &next_key) == 0) {
|
||||
bpf_lookup_elem(map_fd[0], &next_key, &value);
|
||||
printf("ip %s count %lld\n",
|
||||
inet_ntoa((struct in_addr){htonl(next_key)}),
|
||||
value);
|
||||
key = next_key;
|
||||
}
|
||||
sleep(1);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
Загрузка…
Ссылка в новой задаче