Commit 59972544 authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'selftests-bpf-migrate-and-remove-cgroup-tracing-related-tests' 

Daniel T. Lee says:

====================
selftests/bpf: migrate and remove cgroup/tracing related tests

The BPF testing framework has evolved significantly over time. However,
some legacy tests in the samples/bpf directory have not kept up with
these changes. These outdated tests can cause confusion and increase
maintenance efforts.

This patchset focuses on migrating outdated cgroup and tracing-related
tests from samples/bpf to selftests/bpf, ensuring the BPF test suite
remains current and efficient. Tests that are already covered by
selftests/bpf are removed, while those not yet covered are migrated.
This includes cgroup sock create tests for setting socket attributes
and blocking socket creation, as well as the removal of redundant
cgroup and tracing tests that have been replaced by newer tests.

This patchset covers the following cgroup/tracing tests:
- test_overhead: tests the overhead of BPF programs with task_rename,
  now covered by selftests and benchmark tests (rename-*). [1]

- test_override_return: tests the return override functionality, now
  handled by kprobe_multi_override in selftests.

- test_probe_write_user: tests the probe_write_user functionality,
  now replaced by the probe_user test in selftests.

- test_cgrp2_sock: tests cgroup BPF's ability to set sk_bound_dev_if,
  mark, and priority during socket creation. Migrated to selftests as
  'sock_create' since no existing tests fully cover this.

- test_cgrp2_sock2: tests blocking socket creation for specific types
  (AF_INET{6}, SOCK_DGRAM, IPPROTO_ICMP{V6}). Migrated to selftests
  in 'sock_create' test for coverage.

- test_current_task_under_cgroup: tests bpf_current_task_under_cgroup()
  to check if a task belongs to a cgroup. Already covered by
  task_under_cgroup at selftest and other cgroup ID tests.

- test_cgrp2_tc: tests bpf_skb_under_cgroup() to filter packets based
  on cgroup. This behavior is now validated by cgroup_skb_sk_lookup,
  which uses bpf_skb_cgroup_id, making this test redundant.

[1]: https://patchwork.kernel.org/cover/13759916
---
Changes in v2:
- commit message fix
Changes in v3:
- Makefile fix
====================

Link: https://lore.kernel.org/r/20241011044847.51584-1-danieltimlee@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents ba4fb3b3 118740b8

samples/bpf/Makefile

+0 −25
Original line number Diff line number Diff line
@@ -17,20 +17,12 @@ tprogs-y += tracex3 
tprogs-y += tracex4

tprogs-y += tracex5

tprogs-y += tracex6

tprogs-y += tracex7

tprogs-y += test_probe_write_user

tprogs-y += trace_output

tprogs-y += lathist

tprogs-y += offwaketime

tprogs-y += spintest

tprogs-y += map_perf_test

tprogs-y += test_overhead

tprogs-y += test_cgrp2_array_pin

tprogs-y += test_cgrp2_attach

tprogs-y += test_cgrp2_sock

tprogs-y += test_cgrp2_sock2

tprogs-y += xdp_router_ipv4

tprogs-y += test_current_task_under_cgroup

tprogs-y += trace_event

tprogs-y += sampleip

tprogs-y += tc_l2_redirect
@@ -66,20 +58,12 @@ tracex3-objs := tracex3_user.o 
tracex4-objs := tracex4_user.o

tracex5-objs := tracex5_user.o $(TRACE_HELPERS)

tracex6-objs := tracex6_user.o

tracex7-objs := tracex7_user.o

test_probe_write_user-objs := test_probe_write_user_user.o

trace_output-objs := trace_output_user.o

lathist-objs := lathist_user.o

offwaketime-objs := offwaketime_user.o $(TRACE_HELPERS)

spintest-objs := spintest_user.o $(TRACE_HELPERS)

map_perf_test-objs := map_perf_test_user.o

test_overhead-objs := test_overhead_user.o

test_cgrp2_array_pin-objs := test_cgrp2_array_pin.o

test_cgrp2_attach-objs := test_cgrp2_attach.o

test_cgrp2_sock-objs := test_cgrp2_sock.o

test_cgrp2_sock2-objs := test_cgrp2_sock2.o

test_current_task_under_cgroup-objs := $(CGROUP_HELPERS) \

				       test_current_task_under_cgroup_user.o

trace_event-objs := trace_event_user.o $(TRACE_HELPERS)

sampleip-objs := sampleip_user.o $(TRACE_HELPERS)

tc_l2_redirect-objs := tc_l2_redirect_user.o
@@ -107,9 +91,6 @@ always-y += tracex3.bpf.o 
always-y += tracex4.bpf.o

always-y += tracex5.bpf.o

always-y += tracex6.bpf.o

always-y += tracex7.bpf.o

always-y += sock_flags.bpf.o

always-y += test_probe_write_user.bpf.o

always-y += trace_output.bpf.o

always-y += tcbpf1_kern.o

always-y += tc_l2_redirect_kern.o
@@ -117,12 +98,7 @@ always-y += lathist_kern.o 
always-y += offwaketime.bpf.o

always-y += spintest.bpf.o

always-y += map_perf_test.bpf.o

always-y += test_overhead_tp.bpf.o

always-y += test_overhead_raw_tp.bpf.o

always-y += test_overhead_kprobe.bpf.o

always-y += parse_varlen.o parse_simple.o parse_ldabs.o

always-y += test_cgrp2_tc.bpf.o

always-y += test_current_task_under_cgroup.bpf.o

always-y += trace_event_kern.o

always-y += sampleip_kern.o

always-y += lwt_len_hist.bpf.o
@@ -195,7 +171,6 @@ TPROGLDLIBS_xdp_router_ipv4 += -lm -pthread 
TPROGLDLIBS_tracex4		+= -lrt

TPROGLDLIBS_trace_output	+= -lrt

TPROGLDLIBS_map_perf_test	+= -lrt

TPROGLDLIBS_test_overhead	+= -lrt



# Allows pointing LLC/CLANG to a LLVM backend with bpf support, redefine on cmdline:

# make M=samples/bpf LLC=~/git/llvm-project/llvm/build/bin/llc CLANG=~/git/llvm-project/llvm/build/bin/clang

samples/bpf/sock_flags.bpf.c

deleted100644 → 0
+0 −47
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

#include "vmlinux.h"

#include "net_shared.h"

#include <bpf/bpf_helpers.h>



SEC("cgroup/sock")

int bpf_prog1(struct bpf_sock *sk)

{

	char fmt[] = "socket: family %d type %d protocol %d\n";

	char fmt2[] = "socket: uid %u gid %u\n";

	__u64 gid_uid = bpf_get_current_uid_gid();

	__u32 uid = gid_uid & 0xffffffff;

	__u32 gid = gid_uid >> 32;



	bpf_trace_printk(fmt, sizeof(fmt), sk->family, sk->type, sk->protocol);

	bpf_trace_printk(fmt2, sizeof(fmt2), uid, gid);



	/* block AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6 sockets

	 * ie., make ping6 fail

	 */

	if (sk->family == AF_INET6 &&

	    sk->type == SOCK_DGRAM   &&

	    sk->protocol == IPPROTO_ICMPV6)

		return 0;



	return 1;

}



SEC("cgroup/sock")

int bpf_prog2(struct bpf_sock *sk)

{

	char fmt[] = "socket: family %d type %d protocol %d\n";



	bpf_trace_printk(fmt, sizeof(fmt), sk->family, sk->type, sk->protocol);



	/* block AF_INET, SOCK_DGRAM, IPPROTO_ICMP sockets

	 * ie., make ping fail

	 */

	if (sk->family == AF_INET &&

	    sk->type == SOCK_DGRAM  &&

	    sk->protocol == IPPROTO_ICMP)

		return 0;



	return 1;

}



char _license[] SEC("license") = "GPL";

samples/bpf/test_cgrp2_array_pin.c

deleted100644 → 0
+0 −106
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/* Copyright (c) 2016 Facebook

 */

#include <linux/unistd.h>

#include <linux/bpf.h>



#include <stdio.h>

#include <stdint.h>

#include <unistd.h>

#include <string.h>

#include <errno.h>

#include <fcntl.h>



#include <bpf/bpf.h>



static void usage(void)

{

	printf("Usage: test_cgrp2_array_pin [...]\n");

	printf("       -F <file>   File to pin an BPF cgroup array\n");

	printf("       -U <file>   Update an already pinned BPF cgroup array\n");

	printf("       -v <value>  Full path of the cgroup2\n");

	printf("       -h          Display this help\n");

}



int main(int argc, char **argv)

{

	const char *pinned_file = NULL, *cg2 = NULL;

	int create_array = 1;

	int array_key = 0;

	int array_fd = -1;

	int cg2_fd = -1;

	int ret = -1;

	int opt;



	while ((opt = getopt(argc, argv, "F:U:v:")) != -1) {

		switch (opt) {

		/* General args */

		case 'F':

			pinned_file = optarg;

			break;

		case 'U':

			pinned_file = optarg;

			create_array = 0;

			break;

		case 'v':

			cg2 = optarg;

			break;

		default:

			usage();

			goto out;

		}

	}



	if (!cg2 || !pinned_file) {

		usage();

		goto out;

	}



	cg2_fd = open(cg2, O_RDONLY);

	if (cg2_fd < 0) {

		fprintf(stderr, "open(%s,...): %s(%d)\n",

			cg2, strerror(errno), errno);

		goto out;

	}



	if (create_array) {

		array_fd = bpf_map_create(BPF_MAP_TYPE_CGROUP_ARRAY, NULL,

					  sizeof(uint32_t), sizeof(uint32_t),

					  1, NULL);

		if (array_fd < 0) {

			fprintf(stderr,

				"bpf_create_map(BPF_MAP_TYPE_CGROUP_ARRAY,...): %s(%d)\n",

				strerror(errno), errno);

			goto out;

		}

	} else {

		array_fd = bpf_obj_get(pinned_file);

		if (array_fd < 0) {

			fprintf(stderr, "bpf_obj_get(%s): %s(%d)\n",

				pinned_file, strerror(errno), errno);

			goto out;

		}

	}



	ret = bpf_map_update_elem(array_fd, &array_key, &cg2_fd, 0);

	if (ret) {

		perror("bpf_map_update_elem");

		goto out;

	}



	if (create_array) {

		ret = bpf_obj_pin(array_fd, pinned_file);

		if (ret) {

			fprintf(stderr, "bpf_obj_pin(..., %s): %s(%d)\n",

				pinned_file, strerror(errno), errno);

			goto out;

		}

	}



out:

	if (array_fd != -1)

		close(array_fd);

	if (cg2_fd != -1)

		close(cg2_fd);

	return ret;

}

samples/bpf/test_cgrp2_attach.c

deleted100644 → 0
+0 −177
Original line number Diff line number Diff line 
/* eBPF example program:

 *

 * - Creates arraymap in kernel with 4 bytes keys and 8 byte values

 *

 * - Loads eBPF program

 *

 *   The eBPF program accesses the map passed in to store two pieces of

 *   information. The number of invocations of the program, which maps

 *   to the number of packets received, is stored to key 0. Key 1 is

 *   incremented on each iteration by the number of bytes stored in

 *   the skb.

 *

 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH

 *

 * - Every second, reads map[0] and map[1] to see how many bytes and

 *   packets were seen on any socket of tasks in the given cgroup.

 */



#define _GNU_SOURCE



#include <stdio.h>

#include <stdlib.h>

#include <stddef.h>

#include <string.h>

#include <unistd.h>

#include <assert.h>

#include <errno.h>

#include <fcntl.h>



#include <linux/bpf.h>

#include <bpf/bpf.h>



#include "bpf_insn.h"

#include "bpf_util.h"



enum {

	MAP_KEY_PACKETS,

	MAP_KEY_BYTES,

};



char bpf_log_buf[BPF_LOG_BUF_SIZE];



static int prog_load(int map_fd, int verdict)

{

	struct bpf_insn prog[] = {

		BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), /* save r6 so it's not clobbered by BPF_CALL */



		/* Count packets */

		BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */

		BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */

		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */

		BPF_LD_MAP_FD(BPF_REG_1, map_fd), /* load map fd to r1 */

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),

		BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */

		BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),



		/* Count bytes */

		BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */

		BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */

		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */

		BPF_LD_MAP_FD(BPF_REG_1, map_fd),

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

		BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),

		BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */



		BPF_ATOMIC_OP(BPF_DW, BPF_ADD, BPF_REG_0, BPF_REG_1, 0),



		BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */

		BPF_EXIT_INSN(),

	};

	size_t insns_cnt = ARRAY_SIZE(prog);

	LIBBPF_OPTS(bpf_prog_load_opts, opts,

		.log_buf = bpf_log_buf,

		.log_size = BPF_LOG_BUF_SIZE,

	);



	return bpf_prog_load(BPF_PROG_TYPE_CGROUP_SKB, NULL, "GPL",

			     prog, insns_cnt, &opts);

}



static int usage(const char *argv0)

{

	printf("Usage: %s [-d] [-D] <cg-path> <egress|ingress>\n", argv0);

	printf("	-d	Drop Traffic\n");

	printf("	-D	Detach filter, and exit\n");

	return EXIT_FAILURE;

}



static int attach_filter(int cg_fd, int type, int verdict)

{

	int prog_fd, map_fd, ret, key;

	long long pkt_cnt, byte_cnt;



	map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, NULL,

				sizeof(key), sizeof(byte_cnt),

				256, NULL);

	if (map_fd < 0) {

		printf("Failed to create map: '%s'\n", strerror(errno));

		return EXIT_FAILURE;

	}



	prog_fd = prog_load(map_fd, verdict);

	printf("Output from kernel verifier:\n%s\n-------\n", bpf_log_buf);



	if (prog_fd < 0) {

		printf("Failed to load prog: '%s'\n", strerror(errno));

		return EXIT_FAILURE;

	}



	ret = bpf_prog_attach(prog_fd, cg_fd, type, 0);

	if (ret < 0) {

		printf("Failed to attach prog to cgroup: '%s'\n",

		       strerror(errno));

		return EXIT_FAILURE;

	}

	while (1) {

		key = MAP_KEY_PACKETS;

		assert(bpf_map_lookup_elem(map_fd, &key, &pkt_cnt) == 0);



		key = MAP_KEY_BYTES;

		assert(bpf_map_lookup_elem(map_fd, &key, &byte_cnt) == 0);



		printf("cgroup received %lld packets, %lld bytes\n",

		       pkt_cnt, byte_cnt);

		sleep(1);

	}



	return EXIT_SUCCESS;

}



int main(int argc, char **argv)

{

	int detach_only = 0, verdict = 1;

	enum bpf_attach_type type;

	int opt, cg_fd, ret;



	while ((opt = getopt(argc, argv, "Dd")) != -1) {

		switch (opt) {

		case 'd':

			verdict = 0;

			break;

		case 'D':

			detach_only = 1;

			break;

		default:

			return usage(argv[0]);

		}

	}



	if (argc - optind < 2)

		return usage(argv[0]);



	if (strcmp(argv[optind + 1], "ingress") == 0)

		type = BPF_CGROUP_INET_INGRESS;

	else if (strcmp(argv[optind + 1], "egress") == 0)

		type = BPF_CGROUP_INET_EGRESS;

	else

		return usage(argv[0]);



	cg_fd = open(argv[optind], O_DIRECTORY | O_RDONLY);

	if (cg_fd < 0) {

		printf("Failed to open cgroup path: '%s'\n", strerror(errno));

		return EXIT_FAILURE;

	}



	if (detach_only) {

		ret = bpf_prog_detach(cg_fd, type);

		printf("bpf_prog_detach() returned '%s' (%d)\n",

		       strerror(errno), errno);

	} else

		ret = attach_filter(cg_fd, type, verdict);



	return ret;

}

samples/bpf/test_cgrp2_sock.c

deleted100644 → 0
+0 −296
Original line number Diff line number Diff line 
/* eBPF example program:

 *

 * - Loads eBPF program

 *

 *   The eBPF program sets the sk_bound_dev_if index in new AF_INET{6}

 *   sockets opened by processes in the cgroup.

 *

 * - Attaches the new program to a cgroup using BPF_PROG_ATTACH

 */



#define _GNU_SOURCE



#include <stdio.h>

#include <stdlib.h>

#include <stddef.h>

#include <string.h>

#include <unistd.h>

#include <assert.h>

#include <errno.h>

#include <fcntl.h>

#include <net/if.h>

#include <inttypes.h>

#include <linux/bpf.h>

#include <bpf/bpf.h>



#include "bpf_insn.h"



char bpf_log_buf[BPF_LOG_BUF_SIZE];



static int prog_load(__u32 idx, __u32 mark, __u32 prio)

{

	/* save pointer to context */

	struct bpf_insn prog_start[] = {

		BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

	};

	struct bpf_insn prog_end[] = {

		BPF_MOV64_IMM(BPF_REG_0, 1), /* r0 = verdict */

		BPF_EXIT_INSN(),

	};



	/* set sk_bound_dev_if on socket */

	struct bpf_insn prog_dev[] = {

		BPF_MOV64_IMM(BPF_REG_3, idx),

		BPF_MOV64_IMM(BPF_REG_2, offsetof(struct bpf_sock, bound_dev_if)),

		BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, offsetof(struct bpf_sock, bound_dev_if)),

	};



	/* set mark on socket */

	struct bpf_insn prog_mark[] = {

		/* get uid of process */

		BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

			     BPF_FUNC_get_current_uid_gid),

		BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffffffff),



		/* if uid is 0, use given mark, else use the uid as the mark */

		BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),

		BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),

		BPF_MOV64_IMM(BPF_REG_3, mark),



		/* set the mark on the new socket */

		BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),

		BPF_MOV64_IMM(BPF_REG_2, offsetof(struct bpf_sock, mark)),

		BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, offsetof(struct bpf_sock, mark)),

	};



	/* set priority on socket */

	struct bpf_insn prog_prio[] = {

		BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),

		BPF_MOV64_IMM(BPF_REG_3, prio),

		BPF_MOV64_IMM(BPF_REG_2, offsetof(struct bpf_sock, priority)),

		BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, offsetof(struct bpf_sock, priority)),

	};

	LIBBPF_OPTS(bpf_prog_load_opts, opts,

		.log_buf = bpf_log_buf,

		.log_size = BPF_LOG_BUF_SIZE,

	);



	struct bpf_insn *prog;

	size_t insns_cnt;

	void *p;

	int ret;



	insns_cnt = sizeof(prog_start) + sizeof(prog_end);

	if (idx)

		insns_cnt += sizeof(prog_dev);



	if (mark)

		insns_cnt += sizeof(prog_mark);



	if (prio)

		insns_cnt += sizeof(prog_prio);



	p = prog = malloc(insns_cnt);

	if (!prog) {

		fprintf(stderr, "Failed to allocate memory for instructions\n");

		return EXIT_FAILURE;

	}



	memcpy(p, prog_start, sizeof(prog_start));

	p += sizeof(prog_start);



	if (idx) {

		memcpy(p, prog_dev, sizeof(prog_dev));

		p += sizeof(prog_dev);

	}



	if (mark) {

		memcpy(p, prog_mark, sizeof(prog_mark));

		p += sizeof(prog_mark);

	}



	if (prio) {

		memcpy(p, prog_prio, sizeof(prog_prio));

		p += sizeof(prog_prio);

	}



	memcpy(p, prog_end, sizeof(prog_end));

	p += sizeof(prog_end);



	insns_cnt /= sizeof(struct bpf_insn);



	ret = bpf_prog_load(BPF_PROG_TYPE_CGROUP_SOCK, NULL, "GPL",

			    prog, insns_cnt, &opts);



	free(prog);



	return ret;

}



static int get_bind_to_device(int sd, char *name, size_t len)

{

	socklen_t optlen = len;

	int rc;



	name[0] = '\0';

	rc = getsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, name, &optlen);

	if (rc < 0)

		perror("setsockopt(SO_BINDTODEVICE)");



	return rc;

}



static unsigned int get_somark(int sd)

{

	unsigned int mark = 0;

	socklen_t optlen = sizeof(mark);

	int rc;



	rc = getsockopt(sd, SOL_SOCKET, SO_MARK, &mark, &optlen);

	if (rc < 0)

		perror("getsockopt(SO_MARK)");



	return mark;

}



static unsigned int get_priority(int sd)

{

	unsigned int prio = 0;

	socklen_t optlen = sizeof(prio);

	int rc;



	rc = getsockopt(sd, SOL_SOCKET, SO_PRIORITY, &prio, &optlen);

	if (rc < 0)

		perror("getsockopt(SO_PRIORITY)");



	return prio;

}



static int show_sockopts(int family)

{

	unsigned int mark, prio;

	char name[16];

	int sd;



	sd = socket(family, SOCK_DGRAM, 17);

	if (sd < 0) {

		perror("socket");

		return 1;

	}



	if (get_bind_to_device(sd, name, sizeof(name)) < 0) {

		close(sd);

		return 1;

	}



	mark = get_somark(sd);

	prio = get_priority(sd);



	close(sd);



	printf("sd %d: dev %s, mark %u, priority %u\n", sd, name, mark, prio);



	return 0;

}



static int usage(const char *argv0)

{

	printf("Usage:\n");

	printf("  Attach a program\n");

	printf("  %s -b bind-to-dev -m mark -p prio cg-path\n", argv0);

	printf("\n");

	printf("  Detach a program\n");

	printf("  %s -d cg-path\n", argv0);

	printf("\n");

	printf("  Show inherited socket settings (mark, priority, and device)\n");

	printf("  %s [-6]\n", argv0);

	return EXIT_FAILURE;

}



int main(int argc, char **argv)

{

	__u32 idx = 0, mark = 0, prio = 0;

	const char *cgrp_path = NULL;

	int cg_fd, prog_fd, ret;

	int family = PF_INET;

	int do_attach = 1;

	int rc;



	while ((rc = getopt(argc, argv, "db:m:p:6")) != -1) {

		switch (rc) {

		case 'd':

			do_attach = 0;

			break;

		case 'b':

			idx = if_nametoindex(optarg);

			if (!idx) {

				idx = strtoumax(optarg, NULL, 0);

				if (!idx) {

					printf("Invalid device name\n");

					return EXIT_FAILURE;

				}

			}

			break;

		case 'm':

			mark = strtoumax(optarg, NULL, 0);

			break;

		case 'p':

			prio = strtoumax(optarg, NULL, 0);

			break;

		case '6':

			family = PF_INET6;

			break;

		default:

			return usage(argv[0]);

		}

	}



	if (optind == argc)

		return show_sockopts(family);



	cgrp_path = argv[optind];

	if (!cgrp_path) {

		fprintf(stderr, "cgroup path not given\n");

		return EXIT_FAILURE;

	}



	if (do_attach && !idx && !mark && !prio) {

		fprintf(stderr,

			"One of device, mark or priority must be given\n");

		return EXIT_FAILURE;

	}



	cg_fd = open(cgrp_path, O_DIRECTORY | O_RDONLY);

	if (cg_fd < 0) {

		printf("Failed to open cgroup path: '%s'\n", strerror(errno));

		return EXIT_FAILURE;

	}



	if (do_attach) {

		prog_fd = prog_load(idx, mark, prio);

		if (prog_fd < 0) {

			printf("Failed to load prog: '%s'\n", strerror(errno));

			printf("Output from kernel verifier:\n%s\n-------\n",

			       bpf_log_buf);

			return EXIT_FAILURE;

		}



		ret = bpf_prog_attach(prog_fd, cg_fd,

				      BPF_CGROUP_INET_SOCK_CREATE, 0);

		if (ret < 0) {

			printf("Failed to attach prog to cgroup: '%s'\n",

			       strerror(errno));

			return EXIT_FAILURE;

		}

	} else {

		ret = bpf_prog_detach(cg_fd, BPF_CGROUP_INET_SOCK_CREATE);

		if (ret < 0) {

			printf("Failed to detach prog from cgroup: '%s'\n",

			       strerror(errno));

			return EXIT_FAILURE;

		}

	}



	close(cg_fd);

	return EXIT_SUCCESS;

}