Alexei Starovoitov 03f4723ed7 samples: bpf: example of stateful socket filtering ... this socket filter example does: - creates arraymap in kernel with key 4 bytes and value 8 bytes - loads eBPF program which assumes that packet is IPv4 and loads one byte of IP->proto from the packet and uses it as a key in a map r0 = skb->data[ETH_HLEN + offsetof(struct iphdr, protocol)]; *(u32*)(fp - 4) = r0; value = bpf_map_lookup_elem(map_fd, fp - 4); if (value) (*(u64*)value) += 1; - attaches this program to raw socket - every second user space reads map[IPPROTO_TCP], map[IPPROTO_UDP], map[IPPROTO_ICMP] to see how many packets of given protocol were seen on loopback interface Usage: $sudo samples/bpf/sock_example TCP 0 UDP 0 ICMP 0 packets TCP 187600 UDP 0 ICMP 4 packets TCP 376504 UDP 0 ICMP 8 packets TCP 563116 UDP 0 ICMP 12 packets TCP 753144 UDP 0 ICMP 16 packets Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2014-12-05 21:47:32 -08:00
..
libbpf.c	samples: bpf: example of stateful socket filtering	2014-12-05 21:47:32 -08:00
libbpf.h	samples: bpf: example of stateful socket filtering	2014-12-05 21:47:32 -08:00
Makefile	samples: bpf: example of stateful socket filtering	2014-12-05 21:47:32 -08:00
sock_example.c	samples: bpf: example of stateful socket filtering	2014-12-05 21:47:32 -08:00
test_maps.c	bpf: add a testsuite for eBPF maps	2014-11-18 13:43:59 -05:00
test_verifier.c	bpf: remove test map scaffolding and user proper types	2014-11-18 13:44:00 -05:00