forked from Minki/linux
a3f7461734
test_cgrp2_array_pin.c: A userland program that creates a bpf_map (BPF_MAP_TYPE_GROUP_ARRAY), pouplates/updates it with a cgroup2's backed fd and pins it to a bpf-fs's file. The pinned file can be loaded by tc and then used by the bpf prog later. This program can also update an existing pinned array and it could be useful for debugging/testing purpose. test_cgrp2_tc_kern.c: A bpf prog which should be loaded by tc. It is to demonstrate the usage of bpf_skb_in_cgroup. test_cgrp2_tc.sh: A script that glues the test_cgrp2_array_pin.c and test_cgrp2_tc_kern.c together. The idea is like: 1. Load the test_cgrp2_tc_kern.o by tc 2. Use test_cgrp2_array_pin.c to populate a BPF_MAP_TYPE_CGROUP_ARRAY with a cgroup fd 3. Do a 'ping -6 ff02::1%ve' to ensure the packet has been dropped because of a match on the cgroup Most of the lines in test_cgrp2_tc.sh is the boilerplate to setup the cgroup/bpf-fs/net-devices/netns...etc. It is not bulletproof on errors but should work well enough and give enough debug info if things did not go well. Signed-off-by: Martin KaFai Lau <kafai@fb.com> Cc: Alexei Starovoitov <ast@fb.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Tejun Heo <tj@kernel.org> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
70 lines
1.8 KiB
C
70 lines
1.8 KiB
C
/* Copyright (c) 2016 Facebook
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of version 2 of the GNU General Public
|
|
* License as published by the Free Software Foundation.
|
|
*/
|
|
#include <uapi/linux/if_ether.h>
|
|
#include <uapi/linux/in6.h>
|
|
#include <uapi/linux/ipv6.h>
|
|
#include <uapi/linux/pkt_cls.h>
|
|
#include <uapi/linux/bpf.h>
|
|
#include "bpf_helpers.h"
|
|
|
|
/* copy of 'struct ethhdr' without __packed */
|
|
struct eth_hdr {
|
|
unsigned char h_dest[ETH_ALEN];
|
|
unsigned char h_source[ETH_ALEN];
|
|
unsigned short h_proto;
|
|
};
|
|
|
|
#define PIN_GLOBAL_NS 2
|
|
struct bpf_elf_map {
|
|
__u32 type;
|
|
__u32 size_key;
|
|
__u32 size_value;
|
|
__u32 max_elem;
|
|
__u32 flags;
|
|
__u32 id;
|
|
__u32 pinning;
|
|
};
|
|
|
|
struct bpf_elf_map SEC("maps") test_cgrp2_array_pin = {
|
|
.type = BPF_MAP_TYPE_CGROUP_ARRAY,
|
|
.size_key = sizeof(uint32_t),
|
|
.size_value = sizeof(uint32_t),
|
|
.pinning = PIN_GLOBAL_NS,
|
|
.max_elem = 1,
|
|
};
|
|
|
|
SEC("filter")
|
|
int handle_egress(struct __sk_buff *skb)
|
|
{
|
|
void *data = (void *)(long)skb->data;
|
|
struct eth_hdr *eth = data;
|
|
struct ipv6hdr *ip6h = data + sizeof(*eth);
|
|
void *data_end = (void *)(long)skb->data_end;
|
|
char dont_care_msg[] = "dont care %04x %d\n";
|
|
char pass_msg[] = "pass\n";
|
|
char reject_msg[] = "reject\n";
|
|
|
|
/* single length check */
|
|
if (data + sizeof(*eth) + sizeof(*ip6h) > data_end)
|
|
return TC_ACT_OK;
|
|
|
|
if (eth->h_proto != htons(ETH_P_IPV6) ||
|
|
ip6h->nexthdr != IPPROTO_ICMPV6) {
|
|
bpf_trace_printk(dont_care_msg, sizeof(dont_care_msg),
|
|
eth->h_proto, ip6h->nexthdr);
|
|
return TC_ACT_OK;
|
|
} else if (bpf_skb_in_cgroup(skb, &test_cgrp2_array_pin, 0) != 1) {
|
|
bpf_trace_printk(pass_msg, sizeof(pass_msg));
|
|
return TC_ACT_OK;
|
|
} else {
|
|
bpf_trace_printk(reject_msg, sizeof(reject_msg));
|
|
return TC_ACT_SHOT;
|
|
}
|
|
}
|
|
|
|
char _license[] SEC("license") = "GPL";
|