Use xt_bpf module to record the iface stats
To make interface packet accounting more accurately and persistent, the
xt_bpf module is implemented to record the total packets and bytes
tx/rx through each interface. The netd will load the bpf program and
set up iptable rules for the xt_bpf module at boot time and the
framework service will use them to get per interface networks stats on
supported devices. Add logcat support to bpfloader program.
Test: iface stats show up in maps. Iptable rules show up after boot.
Bug: 72111305
Change-Id: Ib33d2b165b64e130999931302dd67891c35a12e9
diff --git a/bpfloader/Android.bp b/bpfloader/Android.bp
index b334457..9a759d1 100644
--- a/bpfloader/Android.bp
+++ b/bpfloader/Android.bp
@@ -33,6 +33,7 @@
"libcutils",
"libbpf",
"libbase",
+ "liblog",
"libnetdutils",
],
srcs: [
@@ -42,6 +43,8 @@
required: [
"cgroup_bpf_ingress_prog.o",
"cgroup_bpf_egress_prog.o",
+ "xt_bpf_ingress_prog.o",
+ "xt_bpf_egress_prog.o",
],
}
diff --git a/bpfloader/Android.mk b/bpfloader/Android.mk
index f5bc0a1..005abef 100644
--- a/bpfloader/Android.mk
+++ b/bpfloader/Android.mk
@@ -21,3 +21,25 @@
LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/bpf
include $(BUILD_PREBUILT)
+
+#######################################
+# xt_bpf_ingress_prog.o
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := xt_bpf_ingress_prog.o
+LOCAL_SRC_FILES := $(LOCAL_MODULE)
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/bpf
+
+include $(BUILD_PREBUILT)
+
+#######################################
+# xt_bpf_egress_prog.o
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := xt_bpf_egress_prog.o
+LOCAL_SRC_FILES := $(LOCAL_MODULE)
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/bpf
+
+include $(BUILD_PREBUILT)
diff --git a/bpfloader/BpfLoader.cpp b/bpfloader/BpfLoader.cpp
index c3a2084..7cb4616 100644
--- a/bpfloader/BpfLoader.cpp
+++ b/bpfloader/BpfLoader.cpp
@@ -14,6 +14,10 @@
* limitations under the License.
*/
+#ifndef LOG_TAG
+#define LOG_TAG "bpfloader"
+#endif
+
#include <arpa/inet.h>
#include <elf.h>
#include <error.h>
@@ -35,6 +39,7 @@
#include <android-base/stringprintf.h>
#include <android-base/unique_fd.h>
+#include <cutils/log.h>
#include <netdutils/Misc.h>
#include <netdutils/Slice.h>
@@ -49,12 +54,14 @@
#define INGRESS_PROG BPF_PROG_PATH"/cgroup_bpf_ingress_prog.o"
#define EGRESS_PROG BPF_PROG_PATH"/cgroup_bpf_egress_prog.o"
+#define XT_BPF_INGRESS_PROG BPF_PROG_PATH "/xt_bpf_ingress_prog.o"
+#define XT_BPF_EGRESS_PROG BPF_PROG_PATH "/xt_bpf_egress_prog.o"
#define MAP_LD_CMD_HEAD 0x18
-#define FAIL(str) \
+#define FAIL(...) \
do { \
- perror((str)); \
- return -1; \
+ ((void)ALOG(LOG_ERROR, LOG_TAG, __VA_ARGS__)); \
+ exit(-1); \
} while (0)
// The BPF instruction bytes that we need to replace. x is a placeholder (e.g., COOKIE_TAG_MAP).
@@ -99,11 +106,10 @@
}
int loadProg(const char* path, int cookieTagMap, int uidStatsMap, int tagStatsMap,
- int uidCounterSetMap) {
+ int uidCounterSetMap, int ifaceStatsMap) {
int fd = open(path, O_RDONLY);
if (fd == -1) {
- fprintf(stderr, "Failed to open %s program: %s", path, strerror(errno));
- return -1;
+ FAIL("Failed to open %s program: %s", path, strerror(errno));
}
struct stat stat;
@@ -171,6 +177,11 @@
char uidStatsMapFdLoadByte[MAP_CMD_SIZE];
makeFdReplacePattern(UID_STATS_MAP, uidStatsMap, uidStatsMapFdPattern, uidStatsMapFdLoadByte);
+ char ifaceStatsMapFdPattern[MAP_CMD_SIZE];
+ char ifaceStatsMapFdLoadByte[MAP_CMD_SIZE];
+ makeFdReplacePattern(IFACE_STATS_MAP, ifaceStatsMap, ifaceStatsMapFdPattern,
+ ifaceStatsMapFdLoadByte);
+
char* mapHead = prog;
while ((uint64_t)(mapHead - prog + MAP_CMD_SIZE) < progSize) {
// Scan the program, examining all possible places that might be the start of a map load
@@ -193,6 +204,9 @@
} else if (!memcmp(mapHead, uidStatsMapFdPattern, MAP_CMD_SIZE)) {
memcpy(mapHead, uidStatsMapFdLoadByte, MAP_CMD_SIZE);
mapHead += MAP_CMD_SIZE;
+ } else if (!memcmp(mapHead, ifaceStatsMapFdPattern, MAP_CMD_SIZE)) {
+ memcpy(mapHead, ifaceStatsMapFdLoadByte, MAP_CMD_SIZE);
+ mapHead += MAP_CMD_SIZE;
}
}
mapHead++;
@@ -200,42 +214,52 @@
Slice insns = Slice(prog, progSize);
char bpf_log_buf[LOG_BUF_SIZE];
Slice bpfLog = Slice(bpf_log_buf, sizeof(bpf_log_buf));
- return bpfProgLoad(BPF_PROG_TYPE_CGROUP_SKB, insns, "Apache 2.0", 0, bpfLog);
+ if (strcmp(path, XT_BPF_INGRESS_PROG) && strcmp(path, XT_BPF_EGRESS_PROG)) {
+ return bpfProgLoad(BPF_PROG_TYPE_CGROUP_SKB, insns, "Apache 2.0", 0, bpfLog);
+ }
+ return bpfProgLoad(BPF_PROG_TYPE_SOCKET_FILTER, insns, "Apache 2.0", 0, bpfLog);
}
int loadAndAttachProgram(bpf_attach_type type, const char* path, const char* name,
const unique_fd& cookieTagMap, const unique_fd& uidCounterSetMap,
- const unique_fd& uidStatsMap, const unique_fd& tagStatsMap) {
+ const unique_fd& uidStatsMap, const unique_fd& tagStatsMap,
+ const unique_fd& ifaceStatsMap) {
unique_fd cg_fd(open(CGROUP_ROOT_PATH, O_DIRECTORY | O_RDONLY | O_CLOEXEC));
if (cg_fd < 0) {
- perror("Failed to open the cgroup directory");
- return -1;
+ FAIL("Failed to open the cgroup directory");
}
unique_fd fd;
if (type == BPF_CGROUP_INET_EGRESS) {
fd.reset(loadProg(INGRESS_PROG, cookieTagMap.get(), uidStatsMap.get(), tagStatsMap.get(),
- uidCounterSetMap.get()));
- } else {
+ uidCounterSetMap.get(), ifaceStatsMap.get()));
+ } else if (type == BPF_CGROUP_INET_INGRESS) {
fd.reset(loadProg(EGRESS_PROG, cookieTagMap.get(), uidStatsMap.get(), tagStatsMap.get(),
- uidCounterSetMap.get()));
+ uidCounterSetMap.get(), ifaceStatsMap.get()));
+ } else if (!strcmp(name, "xt_bpf_ingress_prog")) {
+ fd.reset(loadProg(XT_BPF_INGRESS_PROG, cookieTagMap.get(), uidStatsMap.get(),
+ tagStatsMap.get(), uidCounterSetMap.get(), ifaceStatsMap.get()));
+ } else if (!strcmp(name, "xt_bpf_egress_prog")) {
+ fd.reset(loadProg(XT_BPF_EGRESS_PROG, cookieTagMap.get(), uidStatsMap.get(),
+ tagStatsMap.get(), uidCounterSetMap.get(), ifaceStatsMap.get()));
+ } else {
+ FAIL("Unrecognized program type: %s", name);
}
if (fd < 0) {
- fprintf(stderr, "load %s failed: %s", name, strerror(errno));
- return -1;
+ FAIL("load %s failed: %s", name, strerror(errno));
}
-
- int ret = attachProgram(type, fd, cg_fd);
- if (ret) {
- fprintf(stderr, "%s attach failed: %s", name, strerror(errno));
- return -1;
+ int ret = 0;
+ if (type == BPF_CGROUP_INET_EGRESS || type == BPF_CGROUP_INET_INGRESS) {
+ ret = attachProgram(type, fd, cg_fd);
+ if (ret) {
+ FAIL("%s attach failed: %s", name, strerror(errno));
+ }
}
ret = mapPin(fd, path);
if (ret) {
- fprintf(stderr, "Pin %s as file %s failed: %s", name, path, strerror(errno));
- return -1;
+ FAIL("Pin %s as file %s failed: %s", name, path, strerror(errno));
}
return 0;
}
@@ -246,45 +270,51 @@
using android::bpf::BPF_EGRESS_PROG_PATH;
using android::bpf::BPF_INGRESS_PROG_PATH;
using android::bpf::COOKIE_UID_MAP_PATH;
+using android::bpf::IFACE_STATS_MAP_PATH;
using android::bpf::TAG_STATS_MAP_PATH;
using android::bpf::UID_COUNTERSET_MAP_PATH;
using android::bpf::UID_STATS_MAP_PATH;
+using android::bpf::XT_BPF_EGRESS_PROG_PATH;
+using android::bpf::XT_BPF_INGRESS_PROG_PATH;
static void usage(void) {
- fprintf(stderr,
- "Usage: ./bpfloader [-i] [-e]\n"
- " -i load ingress bpf program\n"
- " -e load egress bpf program\n");
+ ALOGE( "Usage: ./bpfloader [-i] [-e]\n"
+ " -i load ingress bpf program\n"
+ " -e load egress bpf program\n"
+ " -p load prerouting xt_bpf program\n"
+ " -m load mangle xt_bpf program\n");
}
int main(int argc, char** argv) {
int ret = 0;
unique_fd cookieTagMap(android::bpf::mapRetrieve(COOKIE_UID_MAP_PATH, 0));
if (cookieTagMap < 0) {
- perror("Failed to get cookieTagMap");
- exit(-1);
+ FAIL("Failed to get cookieTagMap");
}
unique_fd uidCounterSetMap(android::bpf::mapRetrieve(UID_COUNTERSET_MAP_PATH, 0));
if (uidCounterSetMap < 0) {
- perror("Failed to get uidCounterSetMap");
- exit(-1);
+ FAIL("Failed to get uidCounterSetMap");
}
unique_fd uidStatsMap(android::bpf::mapRetrieve(UID_STATS_MAP_PATH, 0));
if (uidStatsMap < 0) {
- perror("Failed to get uidStatsMap");
- exit(-1);
+ FAIL("Failed to get uidStatsMap");
}
unique_fd tagStatsMap(android::bpf::mapRetrieve(TAG_STATS_MAP_PATH, 0));
if (tagStatsMap < 0) {
- perror("Failed to get tagStatsMap");
- exit(-1);
+ FAIL("Failed to get tagStatsMap");
}
+
+ unique_fd ifaceStatsMap(android::bpf::mapRetrieve(IFACE_STATS_MAP_PATH, 0));
+ if (ifaceStatsMap < 0) {
+ FAIL("Failed to get ifaceStatsMap");
+ }
+
int opt;
- bool doIngress = false, doEgress = false;
- while ((opt = getopt(argc, argv, "ie")) != -1) {
+ bool doIngress = false, doEgress = false, doPrerouting = false, doMangle = false;
+ while ((opt = getopt(argc, argv, "iepm")) != -1) {
switch (opt) {
case 'i':
doIngress = true;
@@ -292,28 +322,47 @@
case 'e':
doEgress = true;
break;
+ case 'p':
+ doPrerouting = true;
+ break;
+ case 'm':
+ doMangle = true;
+ break;
default:
- fprintf(stderr, "unknown argument %c", opt);
usage();
- exit(-1);
+ FAIL("unknown argument %c", opt);
}
}
if (doIngress) {
ret = android::bpf::loadAndAttachProgram(BPF_CGROUP_INET_INGRESS, BPF_INGRESS_PROG_PATH,
"ingress_prog", cookieTagMap, uidCounterSetMap,
- uidStatsMap, tagStatsMap);
+ uidStatsMap, tagStatsMap, ifaceStatsMap);
if (ret) {
- fprintf(stderr, "Failed to set up ingress program");
- return ret;
+ FAIL("Failed to set up ingress program");
}
}
if (doEgress) {
ret = android::bpf::loadAndAttachProgram(BPF_CGROUP_INET_EGRESS, BPF_EGRESS_PROG_PATH,
"egress_prog", cookieTagMap, uidCounterSetMap,
- uidStatsMap, tagStatsMap);
+ uidStatsMap, tagStatsMap, ifaceStatsMap);
if (ret) {
- fprintf(stderr, "Failed to set up ingress program");
- return ret;
+ FAIL("Failed to set up ingress program");
+ }
+ }
+ if (doPrerouting) {
+ ret = android::bpf::loadAndAttachProgram(
+ MAX_BPF_ATTACH_TYPE, XT_BPF_INGRESS_PROG_PATH, "xt_bpf_ingress_prog", cookieTagMap,
+ uidCounterSetMap, uidStatsMap, tagStatsMap, ifaceStatsMap);
+ if (ret) {
+ FAIL("Failed to set up xt_bpf program");
+ }
+ }
+ if (doMangle) {
+ ret = android::bpf::loadAndAttachProgram(
+ MAX_BPF_ATTACH_TYPE, XT_BPF_EGRESS_PROG_PATH, "xt_bpf_egress_prog", cookieTagMap,
+ uidCounterSetMap, uidStatsMap, tagStatsMap, ifaceStatsMap);
+ if (ret) {
+ FAIL("Failed to set up xt_bpf program");
}
}
return ret;
diff --git a/bpfloader/bpf_kern.h b/bpfloader/bpf_kern.h
index ee818f8..2a2ef8c 100644
--- a/bpfloader/bpf_kern.h
+++ b/bpfloader/bpf_kern.h
@@ -16,6 +16,7 @@
#include <linux/bpf.h>
#include <stdint.h>
+#include "bpf_shared.h"
#define ELF_SEC(NAME) __attribute__((section(NAME), used))
@@ -50,3 +51,27 @@
#define BPF_PASS 1
#define BPF_DROP 0
+#define BPF_EGRESS 0
+#define BPF_INGRESS 1
+
+static __always_inline int xt_bpf_count(struct __sk_buff* skb, int type) {
+ uint32_t key = skb->ifindex;
+ struct stats_value* value;
+
+ value = find_map_entry(IFACE_STATS_MAP, &key);
+ if (!value) {
+ struct stats_value newValue = {};
+ write_to_map_entry(IFACE_STATS_MAP, &key, &newValue, BPF_NOEXIST);
+ value = find_map_entry(IFACE_STATS_MAP, &key);
+ }
+ if (value) {
+ if (type == BPF_EGRESS) {
+ __sync_fetch_and_add(&value->txPackets, 1);
+ __sync_fetch_and_add(&value->txBytes, skb->len);
+ } else if (type == BPF_INGRESS) {
+ __sync_fetch_and_add(&value->rxPackets, 1);
+ __sync_fetch_and_add(&value->rxBytes, skb->len);
+ }
+ }
+ return BPF_PASS;
+}
diff --git a/bpfloader/bpf_shared.h b/bpfloader/bpf_shared.h
index c314c2b..448867a 100644
--- a/bpfloader/bpf_shared.h
+++ b/bpfloader/bpf_shared.h
@@ -22,3 +22,4 @@
#define UID_COUNTERSET_MAP 0xbfdceeafffffffff
#define UID_STATS_MAP 0xbfdaafffffffffff
#define TAG_STATS_MAP 0xbfaaafffffffffff
+#define IFACE_STATS_MAP 0xbf1faceaafffffff
diff --git a/bpfloader/xt_bpf_egress_prog.c b/bpfloader/xt_bpf_egress_prog.c
new file mode 100644
index 0000000..8109030
--- /dev/null
+++ b/bpfloader/xt_bpf_egress_prog.c
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <linux/bpf.h>
+#include <linux/if_ether.h>
+#include <linux/if_packet.h>
+#include <linux/ip.h>
+#include "bpf_kern.h"
+#include "bpf_shared.h"
+
+ELF_SEC(BPF_PROG_SEC_NAME)
+int xt_bpf_egress_prog(struct __sk_buff* skb) {
+ return xt_bpf_count(skb, BPF_EGRESS);
+}
diff --git a/bpfloader/xt_bpf_egress_prog.o b/bpfloader/xt_bpf_egress_prog.o
new file mode 100644
index 0000000..59ff564
--- /dev/null
+++ b/bpfloader/xt_bpf_egress_prog.o
Binary files differ
diff --git a/bpfloader/xt_bpf_ingress_prog.c b/bpfloader/xt_bpf_ingress_prog.c
new file mode 100644
index 0000000..f9852b2
--- /dev/null
+++ b/bpfloader/xt_bpf_ingress_prog.c
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <linux/bpf.h>
+#include <linux/if_ether.h>
+#include <linux/if_packet.h>
+#include <linux/ip.h>
+#include "bpf_kern.h"
+#include "bpf_shared.h"
+
+ELF_SEC(BPF_PROG_SEC_NAME)
+int xt_bpf_ingress_prog(struct __sk_buff* skb) {
+ return xt_bpf_count(skb, BPF_INGRESS);
+}
diff --git a/bpfloader/xt_bpf_ingress_prog.o b/bpfloader/xt_bpf_ingress_prog.o
new file mode 100644
index 0000000..8c29a32
--- /dev/null
+++ b/bpfloader/xt_bpf_ingress_prog.o
Binary files differ