bpf/progs/bpf_iter_netlink.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /* Copyright (c) 2020 Facebook */
0003 #include "bpf_iter.h"
0004 #include "bpf_tracing_net.h"
0005 #include <bpf/bpf_helpers.h>
0006
0007 char _license[] SEC("license") = "GPL";
0008
0009 static __attribute__((noinline)) struct inode *SOCK_INODE(struct socket *socket)
0010 {
0011     return &container_of(socket, struct socket_alloc, socket)->vfs_inode;
0012 }
0013
0014 SEC("iter/netlink")
0015 int dump_netlink(struct bpf_iter__netlink *ctx)
0016 {
0017     struct seq_file *seq = ctx->meta->seq;
0018     struct netlink_sock *nlk = ctx->sk;
0019     unsigned long group, ino;
0020     struct inode *inode;
0021     struct socket *sk;
0022     struct sock *s;
0023
0024     if (nlk == (void *)0)
0025         return 0;
0026
0027     if (ctx->meta->seq_num == 0)
0028         BPF_SEQ_PRINTF(seq, "sk               Eth Pid        Groups   "
0029                     "Rmem     Wmem     Dump  Locks    Drops    "
0030                     "Inode\n");
0031
0032     s = &nlk->sk;
0033     BPF_SEQ_PRINTF(seq, "%pK %-3d ", s, s->sk_protocol);
0034
0035     if (!nlk->groups)  {
0036         group = 0;
0037     } else {
0038         /* FIXME: temporary use bpf_probe_read_kernel here, needs
0039          * verifier support to do direct access.
0040          */
0041         bpf_probe_read_kernel(&group, sizeof(group), &nlk->groups[0]);
0042     }
0043     BPF_SEQ_PRINTF(seq, "%-10u %08x %-8d %-8d %-5d %-8d ",
0044                nlk->portid, (u32)group,
0045                s->sk_rmem_alloc.counter,
0046                s->sk_wmem_alloc.refs.counter - 1,
0047                nlk->cb_running, s->sk_refcnt.refs.counter);
0048
0049     sk = s->sk_socket;
0050     if (!sk) {
0051         ino = 0;
0052     } else {
0053         /* FIXME: container_of inside SOCK_INODE has a forced
0054          * type conversion, and direct access cannot be used
0055          * with current verifier.
0056          */
0057         inode = SOCK_INODE(sk);
0058         bpf_probe_read_kernel(&ino, sizeof(ino), &inode->i_ino);
0059     }
0060     BPF_SEQ_PRINTF(seq, "%-8u %-8lu\n", s->sk_drops.counter, ino);
0061
0062     return 0;
0063 }