为什么样本/bpf中的ebpf程序不起作用? [英] Why ebpf program inside samples/bpf doesn't work?
问题描述
目标:在内核源代码树4.18.0的samples/bpf
目录中编写一个新的ebpf
示例,对其进行编译和执行.
GOAL: write a new ebpf
example within samples/bpf
directory in the kernel source tree of 4.18.0, compile and execute it.
问题::在我运行sudo ./mine
时将其编译后,它将终止.
PROBLEM: after compiling it when I run sudo ./mine
it just terminates.
mine_kern.c
#include <uapi/linux/bpf.h>
#include <uapi/linux/if_ether.h>
#include <uapi/linux/ip.h>
#include <linux/in.h>
#include <linux/if_packet.h>
#include "bpf_helpers.h"
int icmp_filter(struct __sk_buff *skb){
int proto = load_byte(skb, ETH_HLEN + offsetof(struct iphdr, protocol));
if(proto == IPPROTO_ICMP && skb->pkt_type == PACKET_OUTGOING){
return -1;
} else {
return 0;
}
}
char _license[] SEC("license") = "GPL";
mine_user.c
#include <stdio.h>
#include <assert.h>
#include <linux/bpf.h>
#include <bpf/bpf.h>
#include "bpf_load.h"
#include "sock_example.h"
#include <unistd.h>
#include <arpa/inet.h>
int main(int ac, char **argv)
{
char filename[256];
FILE *f;
int i, sock;
snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
if (load_bpf_file(filename)) {
printf("%s", bpf_log_buf);
return 1;
}
sock = open_raw_sock("lo");
assert(setsockopt(sock, SOL_SOCKET, SO_ATTACH_BPF, prog_fd,
sizeof(prog_fd[0])) == 0);
f = popen("ping -c5 localhost", "r");
(void) f;
char buf[65535];
for(i=0; i<20; i++){
int res = recvfrom(sock, buf, sizeof(buf), 0, NULL, 0);
printf("res=%d\n", res);
}
return 0;
}
我还修改了samples/bpf
内的Makefile
,并在需要时添加了mine_user.c
和mine_kern.c
.
问题:此代码有什么问题?
I've also modified the Makefile
inside samples/bpf
adding mine_user.c
and mine_kern.c
where required.
QUESTIONS: what is wrong with this code?
推荐答案
由于load_bpf_file()
加载函数的方式,您需要将BPF程序函数放在单独的ELF节中.例如,我可以用以下命令加载程序:
Because of the way load_bpf_file()
loads the function, you need to put your BPF program function in a separate ELF section. For example, I could load the program with:
SEC("socket")
int icmp_filter(struct __sk_buff *skb){
...
}
在那之后,我在运行程序时看到连续的res=-1
.这是因为open_raw_sock()
从sock_example.h
将您的套接字设置为非阻塞:
After that, I see a succession of res=-1
when running the program. This is because your socket is set as non-blocking by open_raw_sock()
, from sock_example.h
:
sock = socket(PF_PACKET, SOCK_RAW|SOCK_NONBLOCK|SOCK_CLOEXEC, htons(ETH_P_ALL));
因此,当没有要接收的数据包时,recvfrom()
只需返回-1
(并将errno
设置为-EGAIN
-您应该考虑打印strerror(errno)
),而不是等待数据包.因此,您可能也想更改它.
So when there is no packet to receive, recvfrom()
simply returns with -1
(and sets errno
to -EGAIN
-- you should consider printing strerror(errno)
by the way) instead of waiting for a packet. So you may want to change that too.
这篇关于为什么样本/bpf中的ebpf程序不起作用?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!