forked from Minki/linux
03f4723ed7
this socket filter example does:
- creates arraymap in kernel with key 4 bytes and value 8 bytes
- loads eBPF program which assumes that packet is IPv4 and loads one byte of
IP->proto from the packet and uses it as a key in a map
r0 = skb->data[ETH_HLEN + offsetof(struct iphdr, protocol)];
*(u32*)(fp - 4) = r0;
value = bpf_map_lookup_elem(map_fd, fp - 4);
if (value)
(*(u64*)value) += 1;
- attaches this program to raw socket
- every second user space reads map[IPPROTO_TCP], map[IPPROTO_UDP], map[IPPROTO_ICMP]
to see how many packets of given protocol were seen on loopback interface
Usage:
$sudo samples/bpf/sock_example
TCP 0 UDP 0 ICMP 0 packets
TCP 187600 UDP 0 ICMP 4 packets
TCP 376504 UDP 0 ICMP 8 packets
TCP 563116 UDP 0 ICMP 12 packets
TCP 753144 UDP 0 ICMP 16 packets
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
16 lines
428 B
Makefile
16 lines
428 B
Makefile
# kbuild trick to avoid linker error. Can be omitted if a module is built.
|
|
obj- := dummy.o
|
|
|
|
# List of programs to build
|
|
hostprogs-y := test_verifier test_maps
|
|
hostprogs-y += sock_example
|
|
|
|
test_verifier-objs := test_verifier.o libbpf.o
|
|
test_maps-objs := test_maps.o libbpf.o
|
|
sock_example-objs := sock_example.o libbpf.o
|
|
|
|
# Tell kbuild to always build the programs
|
|
always := $(hostprogs-y)
|
|
|
|
HOSTCFLAGS += -I$(objtree)/usr/include
|