1 /* eBPF example program:
3 * - Creates arraymap in kernel with 4 bytes keys and 8 byte values
7 * The eBPF program accesses the map passed in to store two pieces of
8 * information. The number of invocations of the program, which maps
9 * to the number of packets received, is stored to key 0. Key 1 is
10 * incremented on each iteration by the number of bytes stored in
11 * the skb. The program also stores the number of received bytes
12 * in the cgroup storage.
14 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH
16 * - Every second, reads map[0] and map[1] to see how many bytes and
17 * packets were seen on any socket of tasks in the given cgroup.
25 #include <sys/resource.h>
29 #include <linux/bpf.h>
33 #include "bpf_rlimit.h"
34 #include "cgroup_helpers.h"
37 #define BAR "/foo/bar/"
38 #define PING_CMD "ping -c1 -w1 127.0.0.1 > /dev/null"
40 char bpf_log_buf[BPF_LOG_BUF_SIZE];
42 static int prog_load(int verdict)
45 struct bpf_insn prog[] = {
46 BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
49 size_t insns_cnt = sizeof(prog) / sizeof(struct bpf_insn);
51 ret = bpf_load_program(BPF_PROG_TYPE_CGROUP_SKB,
52 prog, insns_cnt, "GPL", 0,
53 bpf_log_buf, BPF_LOG_BUF_SIZE);
56 log_err("Loading program");
57 printf("Output from verifier:\n%s\n-------\n", bpf_log_buf);
63 static int test_foo_bar(void)
65 int drop_prog, allow_prog, foo = 0, bar = 0, rc = 0;
67 allow_prog = prog_load(1);
71 drop_prog = prog_load(0);
75 if (setup_cgroup_environment())
78 /* Create cgroup /foo, get fd, and join it */
79 foo = create_and_get_cgroup(FOO);
86 if (bpf_prog_attach(drop_prog, foo, BPF_CGROUP_INET_EGRESS,
87 BPF_F_ALLOW_OVERRIDE)) {
88 log_err("Attaching prog to /foo");
92 printf("Attached DROP prog. This ping in cgroup /foo should fail...\n");
93 assert(system(PING_CMD) != 0);
95 /* Create cgroup /foo/bar, get fd, and join it */
96 bar = create_and_get_cgroup(BAR);
100 if (join_cgroup(BAR))
103 printf("Attached DROP prog. This ping in cgroup /foo/bar should fail...\n");
104 assert(system(PING_CMD) != 0);
106 if (bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
107 BPF_F_ALLOW_OVERRIDE)) {
108 log_err("Attaching prog to /foo/bar");
112 printf("Attached PASS prog. This ping in cgroup /foo/bar should pass...\n");
113 assert(system(PING_CMD) == 0);
115 if (bpf_prog_detach(bar, BPF_CGROUP_INET_EGRESS)) {
116 log_err("Detaching program from /foo/bar");
120 printf("Detached PASS from /foo/bar while DROP is attached to /foo.\n"
121 "This ping in cgroup /foo/bar should fail...\n");
122 assert(system(PING_CMD) != 0);
124 if (bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
125 BPF_F_ALLOW_OVERRIDE)) {
126 log_err("Attaching prog to /foo/bar");
130 if (bpf_prog_detach(foo, BPF_CGROUP_INET_EGRESS)) {
131 log_err("Detaching program from /foo");
135 printf("Attached PASS from /foo/bar and detached DROP from /foo.\n"
136 "This ping in cgroup /foo/bar should pass...\n");
137 assert(system(PING_CMD) == 0);
139 if (bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
140 BPF_F_ALLOW_OVERRIDE)) {
141 log_err("Attaching prog to /foo/bar");
145 if (!bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS, 0)) {
147 log_err("Unexpected success attaching prog to /foo/bar");
151 if (bpf_prog_detach(bar, BPF_CGROUP_INET_EGRESS)) {
152 log_err("Detaching program from /foo/bar");
156 if (!bpf_prog_detach(foo, BPF_CGROUP_INET_EGRESS)) {
158 log_err("Unexpected success in double detach from /foo");
162 if (bpf_prog_attach(allow_prog, foo, BPF_CGROUP_INET_EGRESS, 0)) {
163 log_err("Attaching non-overridable prog to /foo");
167 if (!bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS, 0)) {
169 log_err("Unexpected success attaching non-overridable prog to /foo/bar");
173 if (!bpf_prog_attach(allow_prog, bar, BPF_CGROUP_INET_EGRESS,
174 BPF_F_ALLOW_OVERRIDE)) {
176 log_err("Unexpected success attaching overridable prog to /foo/bar");
180 if (!bpf_prog_attach(allow_prog, foo, BPF_CGROUP_INET_EGRESS,
181 BPF_F_ALLOW_OVERRIDE)) {
183 log_err("Unexpected success attaching overridable prog to /foo");
187 if (bpf_prog_attach(drop_prog, foo, BPF_CGROUP_INET_EGRESS, 0)) {
188 log_err("Attaching different non-overridable prog to /foo");
200 cleanup_cgroup_environment();
202 printf("### override:PASS\n");
204 printf("### override:FAIL\n");
208 static int map_fd = -1;
210 static int prog_load_cnt(int verdict, int val)
212 int cgroup_storage_fd;
215 map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, 4, 8, 1, 0);
217 printf("failed to create map '%s'\n", strerror(errno));
221 cgroup_storage_fd = bpf_create_map(BPF_MAP_TYPE_CGROUP_STORAGE,
222 sizeof(struct bpf_cgroup_storage_key), 8, 0, 0);
223 if (cgroup_storage_fd < 0) {
224 printf("failed to create map '%s'\n", strerror(errno));
228 struct bpf_insn prog[] = {
229 BPF_MOV32_IMM(BPF_REG_0, 0),
230 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
231 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
232 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
233 BPF_LD_MAP_FD(BPF_REG_1, map_fd),
234 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
235 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
236 BPF_MOV64_IMM(BPF_REG_1, val), /* r1 = 1 */
237 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
238 BPF_LD_MAP_FD(BPF_REG_1, cgroup_storage_fd),
239 BPF_MOV64_IMM(BPF_REG_2, 0),
240 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
241 BPF_MOV64_IMM(BPF_REG_1, val),
242 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_0, BPF_REG_1, 0, 0),
243 BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */
246 size_t insns_cnt = sizeof(prog) / sizeof(struct bpf_insn);
249 ret = bpf_load_program(BPF_PROG_TYPE_CGROUP_SKB,
250 prog, insns_cnt, "GPL", 0,
251 bpf_log_buf, BPF_LOG_BUF_SIZE);
254 log_err("Loading program");
255 printf("Output from verifier:\n%s\n-------\n", bpf_log_buf);
258 close(cgroup_storage_fd);
263 static int test_multiprog(void)
265 __u32 prog_ids[4], prog_cnt = 0, attach_flags, saved_prog_id;
266 int cg1 = 0, cg2 = 0, cg3 = 0, cg4 = 0, cg5 = 0, key = 0;
267 int drop_prog, allow_prog[6] = {}, rc = 0;
268 unsigned long long value;
271 for (i = 0; i < 6; i++) {
272 allow_prog[i] = prog_load_cnt(1, 1 << i);
276 drop_prog = prog_load_cnt(0, 1);
280 if (setup_cgroup_environment())
283 cg1 = create_and_get_cgroup("/cg1");
286 cg2 = create_and_get_cgroup("/cg1/cg2");
289 cg3 = create_and_get_cgroup("/cg1/cg2/cg3");
292 cg4 = create_and_get_cgroup("/cg1/cg2/cg3/cg4");
295 cg5 = create_and_get_cgroup("/cg1/cg2/cg3/cg4/cg5");
299 if (join_cgroup("/cg1/cg2/cg3/cg4/cg5"))
302 if (bpf_prog_attach(allow_prog[0], cg1, BPF_CGROUP_INET_EGRESS,
303 BPF_F_ALLOW_MULTI)) {
304 log_err("Attaching prog to cg1");
307 if (!bpf_prog_attach(allow_prog[0], cg1, BPF_CGROUP_INET_EGRESS,
308 BPF_F_ALLOW_MULTI)) {
309 log_err("Unexpected success attaching the same prog to cg1");
312 if (bpf_prog_attach(allow_prog[1], cg1, BPF_CGROUP_INET_EGRESS,
313 BPF_F_ALLOW_MULTI)) {
314 log_err("Attaching prog2 to cg1");
317 if (bpf_prog_attach(allow_prog[2], cg2, BPF_CGROUP_INET_EGRESS,
318 BPF_F_ALLOW_OVERRIDE)) {
319 log_err("Attaching prog to cg2");
322 if (bpf_prog_attach(allow_prog[3], cg3, BPF_CGROUP_INET_EGRESS,
323 BPF_F_ALLOW_MULTI)) {
324 log_err("Attaching prog to cg3");
327 if (bpf_prog_attach(allow_prog[4], cg4, BPF_CGROUP_INET_EGRESS,
328 BPF_F_ALLOW_OVERRIDE)) {
329 log_err("Attaching prog to cg4");
332 if (bpf_prog_attach(allow_prog[5], cg5, BPF_CGROUP_INET_EGRESS, 0)) {
333 log_err("Attaching prog to cg5");
336 assert(system(PING_CMD) == 0);
337 assert(bpf_map_lookup_elem(map_fd, &key, &value) == 0);
338 assert(value == 1 + 2 + 8 + 32);
340 /* query the number of effective progs in cg5 */
341 assert(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, BPF_F_QUERY_EFFECTIVE,
342 NULL, NULL, &prog_cnt) == 0);
343 assert(prog_cnt == 4);
344 /* retrieve prog_ids of effective progs in cg5 */
345 assert(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, BPF_F_QUERY_EFFECTIVE,
346 &attach_flags, prog_ids, &prog_cnt) == 0);
347 assert(prog_cnt == 4);
348 assert(attach_flags == 0);
349 saved_prog_id = prog_ids[0];
350 /* check enospc handling */
353 assert(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, BPF_F_QUERY_EFFECTIVE,
354 &attach_flags, prog_ids, &prog_cnt) == -1 &&
356 assert(prog_cnt == 4);
357 /* check that prog_ids are returned even when buffer is too small */
358 assert(prog_ids[0] == saved_prog_id);
359 /* retrieve prog_id of single attached prog in cg5 */
361 assert(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, 0,
362 NULL, prog_ids, &prog_cnt) == 0);
363 assert(prog_cnt == 1);
364 assert(prog_ids[0] == saved_prog_id);
366 /* detach bottom program and ping again */
367 if (bpf_prog_detach2(-1, cg5, BPF_CGROUP_INET_EGRESS)) {
368 log_err("Detaching prog from cg5");
372 assert(bpf_map_update_elem(map_fd, &key, &value, 0) == 0);
373 assert(system(PING_CMD) == 0);
374 assert(bpf_map_lookup_elem(map_fd, &key, &value) == 0);
375 assert(value == 1 + 2 + 8 + 16);
377 /* detach 3rd from bottom program and ping again */
379 if (!bpf_prog_detach2(0, cg3, BPF_CGROUP_INET_EGRESS)) {
380 log_err("Unexpected success on detach from cg3");
383 if (bpf_prog_detach2(allow_prog[3], cg3, BPF_CGROUP_INET_EGRESS)) {
384 log_err("Detaching from cg3");
388 assert(bpf_map_update_elem(map_fd, &key, &value, 0) == 0);
389 assert(system(PING_CMD) == 0);
390 assert(bpf_map_lookup_elem(map_fd, &key, &value) == 0);
391 assert(value == 1 + 2 + 16);
393 /* detach 2nd from bottom program and ping again */
394 if (bpf_prog_detach2(-1, cg4, BPF_CGROUP_INET_EGRESS)) {
395 log_err("Detaching prog from cg4");
399 assert(bpf_map_update_elem(map_fd, &key, &value, 0) == 0);
400 assert(system(PING_CMD) == 0);
401 assert(bpf_map_lookup_elem(map_fd, &key, &value) == 0);
402 assert(value == 1 + 2 + 4);
405 assert(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, BPF_F_QUERY_EFFECTIVE,
406 &attach_flags, prog_ids, &prog_cnt) == 0);
407 assert(prog_cnt == 3);
408 assert(attach_flags == 0);
409 assert(bpf_prog_query(cg5, BPF_CGROUP_INET_EGRESS, 0,
410 NULL, prog_ids, &prog_cnt) == 0);
411 assert(prog_cnt == 0);
417 for (i = 0; i < 6; i++)
418 if (allow_prog[i] > 0)
419 close(allow_prog[i]);
425 cleanup_cgroup_environment();
427 printf("### multi:PASS\n");
429 printf("### multi:FAIL\n");
433 int main(int argc, char **argv)
441 return test_multiprog();