]>
git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - samples/bpf/test_cgrp2_attach2.c
1 /* eBPF example program:
3 * - Creates arraymap in kernel with 4 bytes keys and 8 byte values
7 * The eBPF program accesses the map passed in to store two pieces of
8 * information. The number of invocations of the program, which maps
9 * to the number of packets received, is stored to key 0. Key 1 is
10 * incremented on each iteration by the number of bytes stored in
13 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH
15 * - Every second, reads map[0] and map[1] to see how many bytes and
16 * packets were seen on any socket of tasks in the given cgroup.
26 #include <linux/bpf.h>
29 #include "cgroup_helpers.h"
32 #define BAR "/foo/bar/"
33 #define PING_CMD "ping -c1 -w1 127.0.0.1 > /dev/null"
35 char bpf_log_buf
[BPF_LOG_BUF_SIZE
];
37 static int prog_load(int verdict
)
40 struct bpf_insn prog
[] = {
41 BPF_MOV64_IMM(BPF_REG_0
, verdict
), /* r0 = verdict */
44 size_t insns_cnt
= sizeof(prog
) / sizeof(struct bpf_insn
);
46 ret
= bpf_load_program(BPF_PROG_TYPE_CGROUP_SKB
,
47 prog
, insns_cnt
, "GPL", 0,
48 bpf_log_buf
, BPF_LOG_BUF_SIZE
);
51 log_err("Loading program");
52 printf("Output from verifier:\n%s\n-------\n", bpf_log_buf
);
58 static int test_foo_bar(void)
60 int drop_prog
, allow_prog
, foo
= 0, bar
= 0, rc
= 0;
62 allow_prog
= prog_load(1);
66 drop_prog
= prog_load(0);
70 if (setup_cgroup_environment())
73 /* Create cgroup /foo, get fd, and join it */
74 foo
= create_and_get_cgroup(FOO
);
81 if (bpf_prog_attach(drop_prog
, foo
, BPF_CGROUP_INET_EGRESS
, 1)) {
82 log_err("Attaching prog to /foo");
86 printf("Attached DROP prog. This ping in cgroup /foo should fail...\n");
87 assert(system(PING_CMD
) != 0);
89 /* Create cgroup /foo/bar, get fd, and join it */
90 bar
= create_and_get_cgroup(BAR
);
97 printf("Attached DROP prog. This ping in cgroup /foo/bar should fail...\n");
98 assert(system(PING_CMD
) != 0);
100 if (bpf_prog_attach(allow_prog
, bar
, BPF_CGROUP_INET_EGRESS
, 1)) {
101 log_err("Attaching prog to /foo/bar");
105 printf("Attached PASS prog. This ping in cgroup /foo/bar should pass...\n");
106 assert(system(PING_CMD
) == 0);
108 if (bpf_prog_detach(bar
, BPF_CGROUP_INET_EGRESS
)) {
109 log_err("Detaching program from /foo/bar");
113 printf("Detached PASS from /foo/bar while DROP is attached to /foo.\n"
114 "This ping in cgroup /foo/bar should fail...\n");
115 assert(system(PING_CMD
) != 0);
117 if (bpf_prog_attach(allow_prog
, bar
, BPF_CGROUP_INET_EGRESS
, 1)) {
118 log_err("Attaching prog to /foo/bar");
122 if (bpf_prog_detach(foo
, BPF_CGROUP_INET_EGRESS
)) {
123 log_err("Detaching program from /foo");
127 printf("Attached PASS from /foo/bar and detached DROP from /foo.\n"
128 "This ping in cgroup /foo/bar should pass...\n");
129 assert(system(PING_CMD
) == 0);
131 if (bpf_prog_attach(allow_prog
, bar
, BPF_CGROUP_INET_EGRESS
, 1)) {
132 log_err("Attaching prog to /foo/bar");
136 if (!bpf_prog_attach(allow_prog
, bar
, BPF_CGROUP_INET_EGRESS
, 0)) {
138 log_err("Unexpected success attaching prog to /foo/bar");
142 if (bpf_prog_detach(bar
, BPF_CGROUP_INET_EGRESS
)) {
143 log_err("Detaching program from /foo/bar");
147 if (!bpf_prog_detach(foo
, BPF_CGROUP_INET_EGRESS
)) {
149 log_err("Unexpected success in double detach from /foo");
153 if (bpf_prog_attach(allow_prog
, foo
, BPF_CGROUP_INET_EGRESS
, 0)) {
154 log_err("Attaching non-overridable prog to /foo");
158 if (!bpf_prog_attach(allow_prog
, bar
, BPF_CGROUP_INET_EGRESS
, 0)) {
160 log_err("Unexpected success attaching non-overridable prog to /foo/bar");
164 if (!bpf_prog_attach(allow_prog
, bar
, BPF_CGROUP_INET_EGRESS
, 1)) {
166 log_err("Unexpected success attaching overridable prog to /foo/bar");
170 if (!bpf_prog_attach(allow_prog
, foo
, BPF_CGROUP_INET_EGRESS
, 1)) {
172 log_err("Unexpected success attaching overridable prog to /foo");
176 if (bpf_prog_attach(drop_prog
, foo
, BPF_CGROUP_INET_EGRESS
, 0)) {
177 log_err("Attaching different non-overridable prog to /foo");
189 cleanup_cgroup_environment();
191 printf("### override:PASS\n");
193 printf("### override:FAIL\n");
197 static int map_fd
= -1;
199 static int prog_load_cnt(int verdict
, int val
)
202 map_fd
= bpf_create_map(BPF_MAP_TYPE_ARRAY
, 4, 8, 1, 0);
204 printf("failed to create map '%s'\n", strerror(errno
));
208 struct bpf_insn prog
[] = {
209 BPF_MOV32_IMM(BPF_REG_0
, 0),
210 BPF_STX_MEM(BPF_W
, BPF_REG_10
, BPF_REG_0
, -4), /* *(u32 *)(fp - 4) = r0 */
211 BPF_MOV64_REG(BPF_REG_2
, BPF_REG_10
),
212 BPF_ALU64_IMM(BPF_ADD
, BPF_REG_2
, -4), /* r2 = fp - 4 */
213 BPF_LD_MAP_FD(BPF_REG_1
, map_fd
),
214 BPF_RAW_INSN(BPF_JMP
| BPF_CALL
, 0, 0, 0, BPF_FUNC_map_lookup_elem
),
215 BPF_JMP_IMM(BPF_JEQ
, BPF_REG_0
, 0, 2),
216 BPF_MOV64_IMM(BPF_REG_1
, val
), /* r1 = 1 */
217 BPF_RAW_INSN(BPF_STX
| BPF_XADD
| BPF_DW
, BPF_REG_0
, BPF_REG_1
, 0, 0), /* xadd r0 += r1 */
218 BPF_MOV64_IMM(BPF_REG_0
, verdict
), /* r0 = verdict */
221 size_t insns_cnt
= sizeof(prog
) / sizeof(struct bpf_insn
);
224 ret
= bpf_load_program(BPF_PROG_TYPE_CGROUP_SKB
,
225 prog
, insns_cnt
, "GPL", 0,
226 bpf_log_buf
, BPF_LOG_BUF_SIZE
);
229 log_err("Loading program");
230 printf("Output from verifier:\n%s\n-------\n", bpf_log_buf
);
237 static int test_multiprog(void)
239 __u32 prog_ids
[4], prog_cnt
= 0, attach_flags
, saved_prog_id
;
240 int cg1
= 0, cg2
= 0, cg3
= 0, cg4
= 0, cg5
= 0, key
= 0;
241 int drop_prog
, allow_prog
[6] = {}, rc
= 0;
242 unsigned long long value
;
245 for (i
= 0; i
< 6; i
++) {
246 allow_prog
[i
] = prog_load_cnt(1, 1 << i
);
250 drop_prog
= prog_load_cnt(0, 1);
254 if (setup_cgroup_environment())
257 cg1
= create_and_get_cgroup("/cg1");
260 cg2
= create_and_get_cgroup("/cg1/cg2");
263 cg3
= create_and_get_cgroup("/cg1/cg2/cg3");
266 cg4
= create_and_get_cgroup("/cg1/cg2/cg3/cg4");
269 cg5
= create_and_get_cgroup("/cg1/cg2/cg3/cg4/cg5");
273 if (join_cgroup("/cg1/cg2/cg3/cg4/cg5"))
276 if (bpf_prog_attach(allow_prog
[0], cg1
, BPF_CGROUP_INET_EGRESS
, 2)) {
277 log_err("Attaching prog to cg1");
280 if (!bpf_prog_attach(allow_prog
[0], cg1
, BPF_CGROUP_INET_EGRESS
, 2)) {
281 log_err("Unexpected success attaching the same prog to cg1");
284 if (bpf_prog_attach(allow_prog
[1], cg1
, BPF_CGROUP_INET_EGRESS
, 2)) {
285 log_err("Attaching prog2 to cg1");
288 if (bpf_prog_attach(allow_prog
[2], cg2
, BPF_CGROUP_INET_EGRESS
, 1)) {
289 log_err("Attaching prog to cg2");
292 if (bpf_prog_attach(allow_prog
[3], cg3
, BPF_CGROUP_INET_EGRESS
, 2)) {
293 log_err("Attaching prog to cg3");
296 if (bpf_prog_attach(allow_prog
[4], cg4
, BPF_CGROUP_INET_EGRESS
, 1)) {
297 log_err("Attaching prog to cg4");
300 if (bpf_prog_attach(allow_prog
[5], cg5
, BPF_CGROUP_INET_EGRESS
, 0)) {
301 log_err("Attaching prog to cg5");
304 assert(system(PING_CMD
) == 0);
305 assert(bpf_map_lookup_elem(map_fd
, &key
, &value
) == 0);
306 assert(value
== 1 + 2 + 8 + 32);
308 /* query the number of effective progs in cg5 */
309 assert(bpf_prog_query(cg5
, BPF_CGROUP_INET_EGRESS
, BPF_F_QUERY_EFFECTIVE
,
310 NULL
, NULL
, &prog_cnt
) == 0);
311 assert(prog_cnt
== 4);
312 /* retrieve prog_ids of effective progs in cg5 */
313 assert(bpf_prog_query(cg5
, BPF_CGROUP_INET_EGRESS
, BPF_F_QUERY_EFFECTIVE
,
314 &attach_flags
, prog_ids
, &prog_cnt
) == 0);
315 assert(prog_cnt
== 4);
316 assert(attach_flags
== 0);
317 saved_prog_id
= prog_ids
[0];
318 /* check enospc handling */
321 assert(bpf_prog_query(cg5
, BPF_CGROUP_INET_EGRESS
, BPF_F_QUERY_EFFECTIVE
,
322 &attach_flags
, prog_ids
, &prog_cnt
) == -1 &&
324 assert(prog_cnt
== 4);
325 /* check that prog_ids are returned even when buffer is too small */
326 assert(prog_ids
[0] == saved_prog_id
);
327 /* retrieve prog_id of single attached prog in cg5 */
329 assert(bpf_prog_query(cg5
, BPF_CGROUP_INET_EGRESS
, 0,
330 NULL
, prog_ids
, &prog_cnt
) == 0);
331 assert(prog_cnt
== 1);
332 assert(prog_ids
[0] == saved_prog_id
);
334 /* detach bottom program and ping again */
335 if (bpf_prog_detach2(-1, cg5
, BPF_CGROUP_INET_EGRESS
)) {
336 log_err("Detaching prog from cg5");
340 assert(bpf_map_update_elem(map_fd
, &key
, &value
, 0) == 0);
341 assert(system(PING_CMD
) == 0);
342 assert(bpf_map_lookup_elem(map_fd
, &key
, &value
) == 0);
343 assert(value
== 1 + 2 + 8 + 16);
345 /* detach 3rd from bottom program and ping again */
347 if (!bpf_prog_detach2(0, cg3
, BPF_CGROUP_INET_EGRESS
)) {
348 log_err("Unexpected success on detach from cg3");
351 if (bpf_prog_detach2(allow_prog
[3], cg3
, BPF_CGROUP_INET_EGRESS
)) {
352 log_err("Detaching from cg3");
356 assert(bpf_map_update_elem(map_fd
, &key
, &value
, 0) == 0);
357 assert(system(PING_CMD
) == 0);
358 assert(bpf_map_lookup_elem(map_fd
, &key
, &value
) == 0);
359 assert(value
== 1 + 2 + 16);
361 /* detach 2nd from bottom program and ping again */
362 if (bpf_prog_detach2(-1, cg4
, BPF_CGROUP_INET_EGRESS
)) {
363 log_err("Detaching prog from cg4");
367 assert(bpf_map_update_elem(map_fd
, &key
, &value
, 0) == 0);
368 assert(system(PING_CMD
) == 0);
369 assert(bpf_map_lookup_elem(map_fd
, &key
, &value
) == 0);
370 assert(value
== 1 + 2 + 4);
373 assert(bpf_prog_query(cg5
, BPF_CGROUP_INET_EGRESS
, BPF_F_QUERY_EFFECTIVE
,
374 &attach_flags
, prog_ids
, &prog_cnt
) == 0);
375 assert(prog_cnt
== 3);
376 assert(attach_flags
== 0);
377 assert(bpf_prog_query(cg5
, BPF_CGROUP_INET_EGRESS
, 0,
378 NULL
, prog_ids
, &prog_cnt
) == 0);
379 assert(prog_cnt
== 0);
385 for (i
= 0; i
< 6; i
++)
386 if (allow_prog
[i
] > 0)
387 close(allow_prog
[i
]);
393 cleanup_cgroup_environment();
395 printf("### multi:PASS\n");
397 printf("### multi:FAIL\n");
401 int main(int argc
, char **argv
)
409 return test_multiprog();