1
2#include <stdio.h>
3#include <assert.h>
4#include <linux/bpf.h>
5#include "libbpf.h"
6#include "bpf_load.h"
7#include "sock_example.h"
8#include <unistd.h>
9#include <arpa/inet.h>
10#include <sys/resource.h>
11
12#define PARSE_IP 3
13#define PARSE_IP_PROG_FD (prog_fd[0])
14#define PROG_ARRAY_FD (map_fd[0])
15
16struct bpf_flow_keys {
17 __be32 src;
18 __be32 dst;
19 union {
20 __be32 ports;
21 __be16 port16[2];
22 };
23 __u32 ip_proto;
24};
25
26struct pair {
27 __u64 packets;
28 __u64 bytes;
29};
30
31int main(int argc, char **argv)
32{
33 struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
34 char filename[256];
35 FILE *f;
36 int i, sock, err, id, key = PARSE_IP;
37 struct bpf_prog_info info = {};
38 uint32_t info_len = sizeof(info);
39
40 snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
41 setrlimit(RLIMIT_MEMLOCK, &r);
42
43 if (load_bpf_file(filename)) {
44 printf("%s", bpf_log_buf);
45 return 1;
46 }
47
48
49 err = bpf_obj_get_info_by_fd(PARSE_IP_PROG_FD, &info, &info_len);
50 assert(!err);
51 err = bpf_map_lookup_elem(PROG_ARRAY_FD, &key, &id);
52 assert(!err);
53 assert(id == info.id);
54
55 sock = open_raw_sock("lo");
56
57 assert(setsockopt(sock, SOL_SOCKET, SO_ATTACH_BPF, &prog_fd[4],
58 sizeof(__u32)) == 0);
59
60 if (argc > 1)
61 f = popen("ping -c5 localhost", "r");
62 else
63 f = popen("netperf -l 4 localhost", "r");
64 (void) f;
65
66 for (i = 0; i < 5; i++) {
67 struct bpf_flow_keys key = {}, next_key;
68 struct pair value;
69
70 sleep(1);
71 printf("IP src.port -> dst.port bytes packets\n");
72 while (bpf_map_get_next_key(map_fd[2], &key, &next_key) == 0) {
73 bpf_map_lookup_elem(map_fd[2], &next_key, &value);
74 printf("%s.%05d -> %s.%05d %12lld %12lld\n",
75 inet_ntoa((struct in_addr){htonl(next_key.src)}),
76 next_key.port16[0],
77 inet_ntoa((struct in_addr){htonl(next_key.dst)}),
78 next_key.port16[1],
79 value.bytes, value.packets);
80 key = next_key;
81 }
82 }
83 return 0;
84}
85