8000 fix socket-bypass-tcpip demo · lx1036/code@dba1f6d · GitHub
[go: up one dir, main page]
Skip to content

Commit dba1f6d

Browse files
author
shenming
committed
fix socket-bypass-tcpip demo
1 parent 42f6fff commit dba1f6d

File tree

2 files changed

+18
-48
lines changed

2 files changed

+18
-48
lines changed

‎go/k8s/bpf/xdp-l4lb/xdp-cilium-l4lb/cilium/test/tproxy/socket-bypass-tcpip/socket_bypass_tcpip_test.go

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ const (
2929
)
3030

3131
/**
32-
没有验证成功!!!
32+
貌似验证成功，sockops 和 sk_msg bpf 程序都运行了，但是怎么判断 bypass TCP/IP netfilter???
3333
*/
3434

3535
func init() {
@@ -312,14 +312,14 @@ func tcpEcho(clientFd, serverFd int, echoData string) {
312312
}
313313

314314
type ProgAttachSkMsg struct {
315-
mapId ebpf.MapID
315+
mapFd int
316316
program *ebpf.Program
317317
attachType ebpf.AttachType
318318
}
319319

320320
func (skMsg *ProgAttachSkMsg) Close() error {
321321
err := link.RawDetachProgram(link.RawDetachProgramOptions{
322-
Target: int(skMsg.mapId),
322+
Target: skMsg.mapFd,
323323
Program: skMsg.program,
324324
Attach: skMsg.attachType,
325325
})
@@ -329,29 +329,26 @@ func (skMsg *ProgAttachSkMsg) Close() error {
329329
return nil
330330
}
331331

332+
// 直接使用 bpftool attach: https://github.com/cyralinc/os-eBPF/blob/develop/sockredir/load.sh
332333
func AttachSkMsg(prog *ebpf.Program, bpfMap *ebpf.Map) (*ProgAttachSkMsg, error) {
333334
if t := prog.Type(); t != ebpf.SkMsg {
334335
return nil, fmt.Errorf("invalid program type %s, expected SkMsg", t)
335336
}
336337

337-
info, err := bpfMap.Info()
338-
if err != nil {
339-
return nil, err
340-
}
341-
mapId, ok := info.ID()
342-
if !ok {
343-
return nil, fmt.Errorf("invalid map id: %d", mapId)
344-
}
345-
346-
err = link.RawAttachProgram(link.RawAttachProgramOptions{
347-
Target: int(mapId),
338+
err := link.RawAttachProgram(link.RawAttachProgramOptions{
339+
// 是 mapFd 不是 mapId, @see /root/linux-5.10.142/tools/testing/selftests/bpf/test_sockmap.c::run_options()
340+
Target: bpfMap.FD(),
348341
Program: prog,
349342
Attach: ebpf.AttachSkMsgVerdict,
350343
Flags: 0,
351344
})
345+
if err != nil {
346+
logrus.Errorf("AttachSkMsgVerdict err: %v", err)
347+
return nil, err
348+
}
352349

353350
skMsg := &ProgAttachSkMsg{
354-
mapId: mapId,
351+
mapFd: bpfMap.FD(),
355352
program: prog,
356353
attachType: ebpf.AttachSkMsgVerdict,
357354
}

‎go/k8s/bpf/xdp-l4lb/xdp-cilium-l4lb/cilium/test/tproxy/socket-bypass-tcpip/test_socket_bypass_tcpip.c

Lines changed: 6 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -5,40 +5,16 @@
55
#include <bpf/bpf_helpers.h>
66
#include <bpf/bpf_endian.h>
77

8-
#ifndef barrier
9-
# define barrier() asm volatile("": : :"memory")
10-
#endif
11-
12-
static __always_inline void bpf_barrier(void)
13-
{
14-
/* Workaround to avoid verifier complaint:
15-
* "dereference of modified ctx ptr R5 off=48+0, ctx+const is allowed,
16-
* ctx+const+const is not"
17-
*/
18-
barrier();
19-
}
20-
21-
#ifndef __READ_ONCE
22-
# define __READ_ONCE(X) (*(volatile typeof(X) *)&X)
23-
#endif
24-
25-
#ifndef READ_ONCE
26-
# define READ_ONCE(X) \
27-
({ typeof(X) __val = __READ_ONCE(X); \
28-
bpf_barrier(); \
29-
__val; })
30-
#endif
31-
328
struct sock_key {
339
__u32 sip4;
3410
__u32 dip4;
3511
__u8 family;
36-
__u8 pad1;
37-
__u16 pad2;
12+
// __u8 pad1;
13+
// __u16 pad2;
3814
// // this padding required for 64bit alignment
3915
// // else ebpf kernel verifier rejects loading
4016
// // of the program
41-
__u32 pad3;
17+
// __u32 pad3;
4218
__u32 sport;
4319
__u32 dport;
4420
//};
@@ -75,7 +51,9 @@ int bpf_tcpip_bypass(struct sk_msg_md *msg)
7551
struct sock_key key = {};
7652
sk_msg_extract4_key(msg, &key);
7753
// bpf_msg_redirect_map()
78-
bpf_printk("total size of sk_msg is %d, port %d --> %d", msg->size, bpf_ntohl(msg->remote_port), msg->local_port);
54+
// total size of sk_msg is 7, port 5432 --> 7007
55+
// total size of sk_msg is 7, port 7007 --> 5432
56+
bpf_printk("total size of sk_msg is %d, port %d --> %d", msg->size, msg->local_port, bpf_ntohl(msg->remote_port));
7957
return (int)bpf_msg_redirect_hash(msg, &sock_ops_map, &key, BPF_F_INGRESS);
8058
// return SK_PASS;
8159
}
@@ -90,11 +68,6 @@ static __always_inline void bpf_sock_ops_ipv4(struct bpf_sock_ops *skops) {
9068
// key.dip4 = skops->remote_ip4;
9169
// // local_port is in host byte order, and remote_port is in network byte order
9270
// key.sport = (bpf_htonl(skops->local_port) >> 16); // ???
93-
// /* clang-7.1 or higher seems to think it can do a 16-bit read here
94-
// * which unfortunately most kernels (as of October 2019) do not
95-
// * support, which leads to verifier failures. Insert a READ_ONCE
96-
// * to make sure that a 32-bit read followed by shift is generated.
97-
// */
9871
// key.dport = (skops->remote_port) >> 16;
9972

10073

0 commit comments

Comments
 (0)
0