get_prandom_u32 (v4.1)

Summary

The get_prandom_u32 helper function generates a pseudo-random 32-bit unsigned integer. This can be useful for various purposes, such as generating random keys, randomizing behavior, or creating unique identifiers within an eBPF program.

Kernel Code

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

SEC("socket")
int bpf_prog(struct __sk_buff *skb) {
    __u32 random_value = bpf_get_prandom_u32();
    bpf_printk("Generated random value: %u\n", random_value);
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

Summary:

• The eBPF program generates a pseudo-random 32-bit unsigned integer using bpf_get_prandom_u32.

• The generated random value is printed to the BPF trace pipe using bpf_printk.

Userland Code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <bpf/bpf.h>
#include <bpf/libbpf.h>

#define PATH_TO_BPF_OBJ "my_bpf.o"

int load_bpf_program(const char *filename) {
    int fd = bpf_obj_get(filename);
    if (fd < 0) {
        perror("bpf_obj_get");
        return -1;
    }
    return fd;
}

int attach_program(int prog_fd, int sock_fd) {
    int ret = setsockopt(sock_fd, SOL_SOCKET, SO_ATTACH_BPF, &prog_fd, sizeof(prog_fd));
    if (ret < 0) {
        perror("setsockopt");
        return -1;
    }
    return 0;
}

int main(int argc, char **argv) {
    int prog_fd, sock_fd;
    struct bpf_object *obj;
    struct bpf_program *prog;

    // Load BPF object file
    obj = bpf_object__open(PATH_TO_BPF_OBJ);
    if (!obj) {
        perror("bpf_object__open");
        return 1;
    }

    // Load BPF programs and maps
    if (bpf_object__load(obj) < 0) {
        fprintf(stderr, "Failed to load BPF object\n");
        goto cleanup;
    }

    // Get file descriptor for the BPF program
    prog = bpf_object__find_program_by_name(obj, "bpf_prog");
    if (!prog) {
        fprintf(stderr, "Failed to find BPF program\n");
        goto cleanup;
    }
    prog_fd = bpf_program__fd(prog);
    if (prog_fd < 0) {
        fprintf(stderr, "Failed to get BPF program FD\n");
        goto cleanup;
    }

    // Create socket
    sock_fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
    if (sock_fd < 0) {
        perror("socket");
        goto cleanup;
    }

    // Attach BPF program to socket
    if (attach_program(prog_fd, sock_fd) < 0) {
        fprintf(stderr, "Failed to attach BPF program\n");
        goto cleanup;
    }

    printf("Attached BPF program. Press Ctrl+C to exit.\n");
    getchar();

cleanup:
    close(sock_fd);
    bpf_object__close(obj);
    return 0;
}

Summary:

• The userland program loads the BPF object file using bpf_object__open and bpf_object__load.

• It retrieves the file descriptor for the BPF program using bpf_program__fd.

• A raw socket is created and the BPF program is attached to it using setsockopt.

• The program waits for user input to keep the BPF program running, allowing it to execute.

• Resources are cleaned up when the program exits.

Conclusions

• The example demonstrates the use of the get_prandom_u32 helper function to generate a pseudo-random 32-bit unsigned integer within an eBPF program.

• The userland code uses full libbpf functions to load, attach programs, and manage resources without using the skeleton generated by bpftool.

• The output from bpf_printk can be viewed using bpftool by running bpftool prog trace.