[PATCH OLK-6.6 v3 11/11] samples/bpf: Add HiSock Redirect sample

28 Aug 2025

hulk inclusion
category: featrue
bugzilla: https://gitee.com/openeuler/kernel/issues/ICS15S

--------------------------------

Add End-to-End HiSock Redirect sample.

Signed-off-by: Pu Lehui <pulehui@huawei.com>
---
 samples/bpf/.gitignore          |   1 +
 samples/bpf/Makefile            |   3 +
 samples/bpf/hisock/bpf.c        | 251 ++++++++++++++++++++
 samples/bpf/hisock/hisock_cmd.c | 405 ++++++++++++++++++++++++++++++++
 4 files changed, 660 insertions(+)
 create mode 100644 samples/bpf/hisock/bpf.c
 create mode 100644 samples/bpf/hisock/hisock_cmd.c

diff --git a/samples/bpf/.gitignore b/samples/bpf/.gitignore
index 0002cd359fb1..4505e51c3f4d 100644
--- a/samples/bpf/.gitignore
+++ b/samples/bpf/.gitignore
@@ -41,6 +41,7 @@ xdp_adjust_tail
 xdp_fwd
 xdp_router_ipv4
 xdp_tx_iptunnel
+hisock/hisock_cmd
 testfile.img
 hbm_out.log
 iperf.*
diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
index 3fa16412db15..2f19faa7fb63 100644
--- a/samples/bpf/Makefile
+++ b/samples/bpf/Makefile
@@ -46,6 +46,7 @@ tprogs-y += xdp_fwd
 tprogs-y += task_fd_query
 tprogs-y += ibumad
 tprogs-y += hbm
+tprogs-y += hisock/hisock_cmd
 
 # Libbpf dependencies
 LIBBPF_SRC = $(TOOLS_PATH)/lib/bpf
@@ -96,6 +97,7 @@ xdp_fwd-objs := xdp_fwd_user.o
 task_fd_query-objs := task_fd_query_user.o $(TRACE_HELPERS)
 ibumad-objs := ibumad_user.o
 hbm-objs := hbm.o $(CGROUP_HELPERS)
+hisock_cmd-objs := hisock/hisock_cmd.o
 
 xdp_router_ipv4-objs := xdp_router_ipv4_user.o $(XDP_SAMPLE)
 
@@ -149,6 +151,7 @@ always-y += task_fd_query_kern.o
 always-y += ibumad_kern.o
 always-y += hbm_out_kern.o
 always-y += hbm_edt_kern.o
+always-y += hisock/bpf.o
 
 ifeq ($(ARCH), arm)
 # Strip all except -D__LINUX_ARM_ARCH__ option needed to handle linux
diff --git a/samples/bpf/hisock/bpf.c b/samples/bpf/hisock/bpf.c
new file mode 100644
index 000000000000..46159c96cb18
--- /dev/null
+++ b/samples/bpf/hisock/bpf.c
@@ -0,0 +1,251 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2025-2025. All rights reserved.
+ *
+ * Description: End-to-End HiSock Redirect sample.
+ */
+#include <linux/if_vlan.h>
+#include <net/dst.h>
+
+#include <uapi/linux/in.h>
+#include <uapi/linux/if_ether.h>
+#include <uapi/linux/ip.h>
+#include <uapi/linux/tcp.h>
+#include <uapi/linux/bpf.h>
+
+#include <bpf/bpf_endian.h>
+#include <bpf/bpf_helpers.h>
+
+#define IP_MF           0x2000
+#define IP_OFFSET       0x1FFF
+#define CSUM_SHIFT_BITS	16
+
+#define SOCKOPS_SUCC	1
+#define SOCKOPS_FAIL	0
+
+#define PORT_LOCAL	1
+#define PORT_REMOTE	2
+
+#define MAX_NUMA	8
+#define MAX_CONN_NUMA	4096
+#define MAX_CONN	(MAX_CONN_NUMA * MAX_NUMA * 2)
+
+struct sock_tuple {
+	u32 saddr;
+	u32 daddr;
+	u16 sport;
+	u16 dport;
+};
+
+struct sock_value {
+	struct dst_entry *ingress_dst;
+	struct ethhdr ingress_eth;
+	bool eth_updated;
+	u32 ingress_ifindex;
+};
+
+struct {
+	__uint(type, BPF_MAP_TYPE_HASH);
+	__uint(key_size, sizeof(struct sock_tuple));
+	__uint(value_size, sizeof(struct sock_value));
+	__uint(max_entries, MAX_CONN);
+} connmap SEC(".maps");
+
+struct {
+	__uint(type, BPF_MAP_TYPE_HASH);
+	__uint(key_size, sizeof(u16));
+	__uint(value_size, sizeof(u8));
+	__uint(max_entries, 128);
+} speed_port SEC(".maps");
+
+struct dst_entry *bpf_skops_get_ingress_dst(struct bpf_sock_ops *skops) __ksym;
+int bpf_xdp_set_ingress_dst(struct xdp_md *xdp, void *dst) __ksym;
+int bpf_skb_change_dev(struct __sk_buff *skb, u32 ifindex) __ksym;
+
+static inline bool is_speed_flow(u32 local, u32 remote)
+{
+	u8 *val;
+
+	val = bpf_map_lookup_elem(&speed_port, &local);
+	if (val && *val == PORT_LOCAL)
+		return true;
+
+	val = bpf_map_lookup_elem(&speed_port, &remote);
+	if (val && *val == PORT_REMOTE)
+		return true;
+
+	return false;
+}
+
+SEC("hisock_sockops")
+int hisock_sockops_prog(struct bpf_sock_ops *skops)
+{
+	struct sock_tuple key = { 0 };
+	struct sock_value val = { 0 };
+	struct dst_entry *dst;
+
+	if (!is_speed_flow(skops->local_port, bpf_ntohl(skops->remote_port)))
+		return SOCKOPS_SUCC;
+
+	switch (skops->op) {
+	case BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB:
+	case BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB:
+		dst = bpf_skops_get_ingress_dst(skops);
+		if (!dst)
+			return SOCKOPS_FAIL;
+
+		key.saddr = skops->remote_ip4;
+		key.sport = bpf_ntohl(skops->remote_port);
+		key.daddr = skops->local_ip4;
+		key.dport = skops->local_port;
+
+		val.ingress_dst = dst;
+		bpf_map_update_elem(&connmap, &key, &val, BPF_ANY);
+
+		bpf_sock_ops_cb_flags_set(skops, BPF_SOCK_OPS_STATE_CB_FLAG);
+		break;
+	case BPF_SOCK_OPS_STATE_CB:
+		if (skops->args[1] != BPF_TCP_CLOSE_WAIT &&
+		    skops->args[1] != BPF_TCP_FIN_WAIT1 &&
+		    skops->args[1] != BPF_TCP_CLOSE)
+			break;
+
+		key.saddr = skops->remote_ip4;
+		key.sport = bpf_ntohl(skops->remote_port);
+		key.daddr = skops->local_ip4;
+		key.dport = skops->local_port;
+
+		bpf_map_delete_elem(&connmap, &key);
+
+		bpf_sock_ops_cb_flags_set(skops,
+			skops->bpf_sock_ops_cb_flags & ~BPF_SOCK_OPS_STATE_CB_FLAG);
+		break;
+	default:
+		break;
+	}
+
+	return SOCKOPS_SUCC;
+}
+
+SEC("hisock_ingress")
+int hisock_ingress_prog(struct xdp_md *ctx)
+{
+	void *data_end = (void *)(long)ctx->data_end;
+	void *data = (void *)(long)ctx->data;
+	struct sock_tuple key = { 0 };
+	struct sock_value *val;
+	struct ethhdr *ehdr;
+	struct tcphdr *thdr;
+	struct iphdr *ihdr;
+
+	ehdr = (struct ethhdr *)data;
+	if (ehdr + 1 > data_end)
+		return XDP_PASS;
+
+	if (ehdr->h_proto != bpf_htons(ETH_P_IP))
+		return XDP_PASS;
+
+	ihdr = (struct iphdr *)(ehdr + 1);
+	if (ihdr + 1 > data_end)
+		return XDP_PASS;
+
+	if (ihdr->ihl != 5 || ihdr->protocol != IPPROTO_TCP)
+		return XDP_PASS;
+
+	if (ihdr->frag_off & bpf_htons(IP_MF | IP_OFFSET))
+		return XDP_PASS;
+
+	thdr = (struct tcphdr *)(ihdr + 1);
+	if (thdr + 1 > data_end)
+		return XDP_PASS;
+
+	if (thdr->syn || thdr->fin || thdr->rst)
+		return XDP_PASS;
+
+	key.saddr = ihdr->saddr;
+	key.sport = bpf_ntohs(thdr->source);
+	key.daddr = ihdr->daddr;
+	key.dport = bpf_ntohs(thdr->dest);
+
+	val = bpf_map_lookup_elem(&connmap, &key);
+	if (!val)
+		return XDP_PASS;
+
+	if (unlikely(!val->eth_updated)) {
+		memcpy(val->ingress_eth.h_source, ehdr->h_dest, ETH_ALEN);
+		memcpy(val->ingress_eth.h_dest, ehdr->h_source, ETH_ALEN);
+		val->ingress_eth.h_proto = ehdr->h_proto;
+		val->eth_updated = true;
+	}
+
+	if (unlikely(!val->ingress_ifindex))
+		val->ingress_ifindex = ctx->ingress_ifindex;
+
+	if (likely(val->ingress_dst))
+		bpf_xdp_set_ingress_dst(ctx, val->ingress_dst);
+
+	return XDP_HISOCK_REDIRECT;
+}
+
+static inline void ipv4_csum(struct iphdr *ihdr)
+{
+	u32 csum = 0;
+	u16 *next_ip_u16 = (u16 *)ihdr;
+
+	ihdr->check = 0;
+	for (size_t i = 0; i < sizeof(struct iphdr) >> 1; i++)
+		csum += *next_ip_u16++;
+
+	ihdr->check = ~((csum & 0xffff) + (csum >> CSUM_SHIFT_BITS));
+}
+
+SEC("hisock_egress")
+int hisock_egress_prog(struct __sk_buff *skb)
+{
+	void *data_end = (void *)(long)skb->data_end;
+	void *data = (void *)(long)skb->data;
+	struct sock_tuple key = { 0 };
+	struct sock_value *val;
+	struct ethhdr *ehdr;
+	struct iphdr *ihdr;
+	int ret;
+
+	key.saddr = skb->remote_ip4;
+	key.sport = bpf_ntohl(skb->remote_port);
+	key.daddr = skb->local_ip4;
+	key.dport = skb->local_port;
+
+	val = bpf_map_lookup_elem(&connmap, &key);
+	if (!val)
+		return HISOCK_PASS;
+
+	if (unlikely(!val->eth_updated))
+		goto redirect;
+
+	ihdr = (struct iphdr *)data;
+	if (ihdr + 1 > data_end)
+		return HISOCK_PASS;
+
+	ihdr->tot_len = bpf_htons(skb->len);
+	ipv4_csum(ihdr);
+
+	ret = bpf_skb_change_head(skb, ETH_HLEN, 0);
+	if (ret < 0)
+		goto redirect;
+
+	data = (void *)(long)skb->data;
+	data_end = (void *)(long)skb->data_end;
+
+	ehdr = (struct ethhdr *)data;
+	if (ehdr + 1 > data_end)
+		return HISOCK_DROP;
+
+	memcpy(ehdr, &val->ingress_eth, ETH_HLEN);
+redirect:
+	if (likely(val->ingress_ifindex))
+		bpf_skb_change_dev(skb, val->ingress_ifindex);
+
+	return HISOCK_REDIRECT;
+}
+
+char _license[] SEC("license") = "GPL";
diff --git a/samples/bpf/hisock/hisock_cmd.c b/samples/bpf/hisock/hisock_cmd.c
new file mode 100644
index 000000000000..6b64c008b6c7
--- /dev/null
+++ b/samples/bpf/hisock/hisock_cmd.c
@@ -0,0 +1,405 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) Huawei Technologies Co., Ltd. 2025-2025. All rights reserved.
+ *
+ * Description: End-to-End HiSock Redirect sample.
+ */
+#include <linux/bpf.h>
+#include <linux/if_link.h>
+#include <assert.h>
+#include <errno.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <signal.h>
+#include <libgen.h>
+#include <limits.h>
+#include <sys/mount.h>
+#include <sys/resource.h>
+#include <net/if.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include "bpf_util.h"
+#include <bpf/bpf.h>
+#include <bpf/libbpf.h>
+
+#define DEF_BPF_PATH	"bpf.o"
+#define PORT_LOCAL	1
+#define PORT_REMOTE	2
+#define MAX_IF_NUM	8
+
+struct {
+	__u32 ifindex[MAX_IF_NUM];
+	int if_num;
+	char *local_port;
+	char *remote_port;
+	char *cgrp_path;
+	char *bpf_path;
+	bool unload;
+	bool help;
+} hisock;
+
+struct hisock_prog_info {
+	const char *prog_name;
+	enum bpf_prog_type prog_type;
+	enum bpf_attach_type attach_type;
+	int attach_flag;
+	int prog_fd;
+	bool is_xdp;
+};
+
+static struct hisock_prog_info prog_infos[] = {
+	{
+		.prog_name	= "hisock_sockops_prog",
+		.prog_type	= BPF_PROG_TYPE_SOCK_OPS,
+		.attach_type	= BPF_CGROUP_SOCK_OPS,
+		.attach_flag	= 0,
+		.is_xdp		= false,
+	},
+	{
+		.prog_name	= "hisock_ingress_prog",
+		.prog_type	= BPF_PROG_TYPE_XDP,
+		.attach_type	= BPF_XDP,
+		.attach_flag	= XDP_FLAGS_SKB_MODE,
+		.is_xdp		= true,
+	},
+	{
+		.prog_name	= "hisock_egress_prog",
+		.prog_type	= BPF_PROG_TYPE_HISOCK,
+		.attach_type	= BPF_HISOCK_EGRESS,
+		.attach_flag	= 0,
+		.is_xdp		= false,
+	},
+};
+
+static int set_prog_type(struct bpf_object *obj)
+{
+	enum bpf_attach_type attach_type;
+	enum bpf_prog_type prog_type;
+	struct bpf_program *prog;
+	const char *prog_name;
+	int i;
+
+	bpf_object__for_each_program(prog, obj) {
+		prog_name = bpf_program__name(prog);
+		for (i = 0; i < ARRAY_SIZE(prog_infos); i++) {
+			if (!strcmp(prog_infos[i].prog_name, prog_name)) {
+				prog_type = prog_infos[i].prog_type;
+				attach_type = prog_infos[i].attach_type;
+				break;
+			}
+		}
+
+		if (i == ARRAY_SIZE(prog_infos))
+			return -1;
+
+		bpf_program__set_type(prog, prog_type);
+		bpf_program__set_expected_attach_type(prog, attach_type);
+	}
+
+	return 0;
+}
+
+static int find_progs(struct bpf_object *obj)
+{
+	struct hisock_prog_info *info;
+	struct bpf_program *prog;
+	int i, prog_fd;
+
+	for (i = 0; i < ARRAY_SIZE(prog_infos); i++) {
+		info = &prog_infos[i];
+		prog = bpf_object__find_program_by_name(obj, info->prog_name);
+		if (!prog) {
+			fprintf(stderr, "ERROR: failed to find prog sec %s\n", info->prog_name);
+			return -1;
+		}
+
+		prog_fd = bpf_program__fd(prog);
+		if (prog_fd < 0) {
+			fprintf(stderr, "ERROR: failed to get fd of prog %s\n", info->prog_name);
+			return -1;
+		}
+
+		info->prog_fd = prog_fd;
+	}
+
+	return 0;
+}
+
+static int parse_port_range(const char *port_str, __u8 status, int map_fd)
+{
+	char *str = strdup(port_str);
+	char *token, *rest = str;
+	__u16 port;
+
+	while ((token = strtok_r(rest, ",", &rest))) {
+		char *dash = strchr(token, '-');
+
+		if (dash) {
+			*dash = '\0';
+			__u16 start = atoi(token);
+			__u16 end = atoi(dash + 1);
+
+			if (start > end || start == 0 || end > 65535) {
+				fprintf(stderr, "Invalid port range: %s\n", token);
+				return -1;
+			}
+
+			for (port = start; port <= end; port++)
+				bpf_map_update_elem(map_fd, &port, &status, BPF_ANY);
+
+			printf("Speed port range %u-%u:%u\n", start, end, status);
+		} else {
+			port = atoi(token);
+			if (port == 0 || port > 65535) {
+				fprintf(stderr, "Invalid port: %s\n", token);
+				return -1;
+			}
+			bpf_map_update_elem(map_fd, &port, &status, BPF_ANY);
+			printf("Speed port %u:%u\n", port, status);
+		}
+	}
+
+	free(str);
+	return 0;
+}
+
+static int set_speed_port(struct bpf_object *obj)
+{
+	int map_fd;
+
+	map_fd = bpf_object__find_map_fd_by_name(obj, "speed_port");
+	if (map_fd < 0) {
+		fprintf(stderr, "ERROR: failed to find map fd\n");
+		return -1;
+	}
+
+	if (hisock.local_port &&
+	    parse_port_range(hisock.local_port, PORT_LOCAL, map_fd)) {
+		fprintf(stderr, "ERROR: failed to update local port\n");
+		return -1;
+	}
+
+	if (hisock.remote_port &&
+	    parse_port_range(hisock.remote_port, PORT_REMOTE, map_fd)) {
+		fprintf(stderr, "ERROR: failed to update remote port\n");
+		return -1;
+	}
+
+	return 0;
+}
+
+static int detach_progs(void)
+{
+	struct hisock_prog_info *info;
+	int i, j, cgrp_fd;
+	int err_cnt = 0;
+
+	cgrp_fd = open(hisock.cgrp_path, O_DIRECTORY, O_RDONLY);
+	if (cgrp_fd < 0) {
+		fprintf(stderr, "ERROR: failed to open cgrp %s\n", hisock.cgrp_path);
+		return -1;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(prog_infos); i++) {
+		info = &prog_infos[i];
+		if (info->is_xdp) {
+			for (j = 0; j < hisock.if_num; j++) {
+				if (bpf_xdp_detach(hisock.ifindex[j],
+						   info->attach_flag, NULL)) {
+					fprintf(stderr,
+						"ERROR: failed to detach prog %s\n",
+						info->prog_name);
+					err_cnt++;
+				}
+			}
+			continue;
+		}
+
+		if (bpf_prog_detach(cgrp_fd, info->attach_type)) {
+			fprintf(stderr, "ERROR: failed to detach prog %s\n", info->prog_name);
+			err_cnt++;
+		}
+	}
+
+	close(cgrp_fd);
+	return -err_cnt;
+}
+
+static int attach_progs(void)
+{
+	struct hisock_prog_info *info;
+	int i, j, cgrp_fd;
+
+	cgrp_fd = open(hisock.cgrp_path, O_DIRECTORY, O_RDONLY);
+	if (cgrp_fd < 0) {
+		fprintf(stderr, "ERROR: failed to open cgrp %s\n", hisock.cgrp_path);
+		return -1;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(prog_infos); i++) {
+		info = &prog_infos[i];
+		if (info->is_xdp) {
+			for (j = 0; j < hisock.if_num; j++) {
+				if (bpf_xdp_attach(hisock.ifindex[j], info->prog_fd,
+						   info->attach_flag, NULL))
+					goto fail;
+			}
+			continue;
+		}
+
+		if (bpf_prog_attach(info->prog_fd, cgrp_fd, info->attach_type,
+				    info->attach_flag))
+			goto fail;
+	}
+
+	close(cgrp_fd);
+	return 0;
+fail:
+	fprintf(stderr, "ERROR: failed to attach prog %s\n", info->prog_name);
+	close(cgrp_fd);
+	detach_progs();
+	return -1;
+}
+
+static int do_hisock(void)
+{
+	struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
+	struct bpf_object *obj;
+
+	setrlimit(RLIMIT_MEMLOCK, &r);
+
+	obj = bpf_object__open(hisock.bpf_path);
+	if (libbpf_get_error(obj)) {
+		fprintf(stderr, "ERROR: failed to open bpf file\n");
+		return -1;
+	}
+
+	if (set_prog_type(obj)) {
+		fprintf(stderr, "ERROR: failed to set prog type\n");
+		bpf_object__close(obj);
+		return -1;
+	}
+
+	if (bpf_object__load(obj)) {
+		fprintf(stderr, "ERROR: failed to load bpf obj\n");
+		bpf_object__close(obj);
+		return -1;
+	}
+
+	if (find_progs(obj)) {
+		fprintf(stderr, "ERROR: failed to find progs\n");
+		bpf_object__close(obj);
+		return -1;
+	}
+
+	if (set_speed_port(obj)) {
+		fprintf(stderr, "ERROR: failed to set speed port\n");
+		bpf_object__close(obj);
+		return -1;
+	}
+
+	if (attach_progs()) {
+		fprintf(stderr, "ERROR: failed to attach progs\n");
+		bpf_object__close(obj);
+		return -1;
+	}
+
+	bpf_object__close(obj);
+	return 0;
+}
+
+static void do_help(void)
+{
+	fprintf(stderr,
+		"Load:   hisock_cmd [-f BPF_FILE] [-c CGRP_PATH] "
+		"[-p LOCAL_PORT] [-r REMOTE_PORT] [-i INTERFACE]\n"
+		"Unload: hisock_cmd -u [-c CGRP_PATH] [-i INTERFACE]\n");
+}
+
+static int parse_args(int argc, char **argv)
+{
+	char *ifname;
+	int opt;
+
+	hisock.bpf_path = DEF_BPF_PATH;
+	hisock.if_num = 0;
+
+	while ((opt = getopt(argc, argv, "f:c:p:r:i:uh")) != -1) {
+		switch (opt) {
+		case 'f':
+			hisock.bpf_path = optarg;
+			break;
+		case 'c':
+			hisock.cgrp_path = optarg;
+			break;
+		case 'p':
+			hisock.local_port = optarg;
+			break;
+		case 'r':
+			hisock.remote_port = optarg;
+			break;
+		case 'i':
+			ifname = optarg;
+			hisock.ifindex[hisock.if_num] = if_nametoindex(ifname);
+			hisock.if_num++;
+			break;
+		case 'u':
+			hisock.unload = true;
+			break;
+		case 'h':
+			hisock.help = true;
+			break;
+		default:
+			fprintf(stderr, "ERROR: unknown option %c\n", opt);
+			return -1;
+		}
+	}
+
+	if (hisock.cgrp_path == NULL ||
+	    hisock.if_num == 0 ||
+	    (!hisock.unload &&
+	     hisock.local_port == NULL &&
+	     hisock.remote_port == NULL)) {
+		do_help();
+		return -1;
+	}
+
+	return 0;
+}
+
+int main(int argc, char **argv)
+{
+	if (parse_args(argc, argv)) {
+		fprintf(stderr, "ERROR: failed to parse args\n");
+		return -1;
+	}
+
+	if (hisock.help) {
+		do_help();
+		return 0;
+	}
+
+	if (hisock.unload) {
+		if (detach_progs()) {
+			fprintf(stderr, "ERROR: failed to detach progs\n");
+			return -1;
+		}
+
+		printf("Unload HiSock successfully\n");
+		return 0;
+	}
+
+	if (do_hisock()) {
+		fprintf(stderr, "ERROR: failed to do hisock\n");
+		return -1;
+	}
+
+	printf("Load HiSock successfully\n");
+	return 0;
+}
-- 
2.34.1

    