![Alexei Starovoitov](/assets/img/avatar_default.png)
this example does the same task as previous socket example in assembler, but this one does it in C. eBPF program in kernel does: /* assume that packet is IPv4, load one byte of IP->proto */ int index = load_byte(skb, ETH_HLEN + offsetof(struct iphdr, protocol)); long *value; value = bpf_map_lookup_elem(&my_map, &index); if (value) __sync_fetch_and_add(value, 1); Corresponding user space reads map[tcp], map[udp], map[icmp] and prints protocol stats every second Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Signed-off-by: David S. Miller <davem@davemloft.net>
26 lines
553 B
C
26 lines
553 B
C
#include <uapi/linux/bpf.h>
|
|
#include <uapi/linux/if_ether.h>
|
|
#include <uapi/linux/ip.h>
|
|
#include "bpf_helpers.h"
|
|
|
|
struct bpf_map_def SEC("maps") my_map = {
|
|
.type = BPF_MAP_TYPE_ARRAY,
|
|
.key_size = sizeof(u32),
|
|
.value_size = sizeof(long),
|
|
.max_entries = 256,
|
|
};
|
|
|
|
SEC("socket1")
|
|
int bpf_prog1(struct sk_buff *skb)
|
|
{
|
|
int index = load_byte(skb, ETH_HLEN + offsetof(struct iphdr, protocol));
|
|
long *value;
|
|
|
|
value = bpf_map_lookup_elem(&my_map, &index);
|
|
if (value)
|
|
__sync_fetch_and_add(value, 1);
|
|
|
|
return 0;
|
|
}
|
|
char _license[] SEC("license") = "GPL";
|