eBPF 技术介绍

// 用户空间操作
bpf_map_update_elem(map_fd, &key, &value, BPF_ANY);
bpf_map_lookup_elem(map_fd, &key, &value);
bpf_map_delete_elem(map_fd, &key);

// BPF 程序内操作
void *value = bpf_map_lookup_elem(&my_map, &key);
bpf_map_update_elem(&my_map, &key, &new_value, BPF_ANY);

// TC 程序入口（简化）
SEC("tc")
int calico_tc_main(struct __sk_buff *skb) {
    // 1. 解析数据包
    struct cali_tc_ctx ctx = {};
    if (parse_packet(&ctx, skb) != PARSING_OK) {
        return TC_ACT_UNSPEC;
    }

    // 2. 连接追踪查找
    struct ct_entry *ct = ct_lookup(&ctx);

    // 3. 策略检查
    if (!policy_allow(&ctx, ct)) {
        return TC_ACT_SHOT;  // 丢弃
    }

    // 4. NAT 处理
    if (needs_nat(&ctx)) {
        do_nat(&ctx);
    }

    // 5. 转发决策
    return forward_packet(&ctx);
}

// 连接追踪表
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, struct ct_key);
    __type(value, struct ct_entry);
    __uint(max_entries, 512000);
} cali_v4_ct_map SEC(".maps");

// NAT 前端表
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, struct nat_fe_key);
    __type(value, struct nat_fe_entry);
    __uint(max_entries, 64000);
} cali_v4_nat_fe SEC(".maps");

// 路由表
struct {
    __uint(type, BPF_MAP_TYPE_LPM_TRIE);
    __type(key, struct lpm_key);
    __type(value, struct route_entry);
    __uint(max_entries, 256000);
} cali_v4_routes SEC(".maps");

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

// 丢弃所有 ICMP 包
SEC("xdp")
int xdp_drop_icmp(struct xdp_md *ctx) {
    void *data = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;

    // 解析以太网头
    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end)
        return XDP_PASS;

    // 只处理 IPv4
    if (eth->h_proto != __constant_htons(ETH_P_IP))
        return XDP_PASS;

    // 解析 IP 头
    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end)
        return XDP_PASS;

    // 丢弃 ICMP
    if (ip->protocol == IPPROTO_ICMP) {
        bpf_printk("Dropping ICMP packet\n");
        return XDP_DROP;
    }

    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

// 定义 Map 存储计数
struct {
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
    __type(key, __u32);
    __type(value, __u64);
    __uint(max_entries, 1);
} pkt_count SEC(".maps");

SEC("xdp")
int xdp_counter(struct xdp_md *ctx) {
    __u32 key = 0;
    __u64 *count;

    count = bpf_map_lookup_elem(&pkt_count, &key);
    if (count) {
        (*count)++;
    }

    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

#!/usr/bin/env python3
from bcc import BPF
import time

# 加载程序
b = BPF(src_file="xdp_counter.c")
fn = b.load_func("xdp_counter", BPF.XDP)
b.attach_xdp("eth0", fn)

# 获取 map
pkt_count = b.get_table("pkt_count")

try:
    while True:
        total = 0
        for k, v in pkt_count.items():
            total += v.value
        print(f"Total packets: {total}")
        time.sleep(1)
except KeyboardInterrupt:
    pass

# 清理
b.remove_xdp("eth0")

// 在 BPF 程序中
bpf_printk("src=%pI4 dst=%pI4\n", &ip->saddr, &ip->daddr);

// 查看日志
sudo cat /sys/kernel/debug/tracing/trace_pipe