153 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2/* Copyright (c) 2017 Facebook3 */4#include <stddef.h>5#include <string.h>6#include <linux/bpf.h>7#include <linux/if_ether.h>8#include <linux/if_packet.h>9#include <linux/ip.h>10#include <linux/ipv6.h>11#include <linux/in.h>12#include <linux/tcp.h>13#include <linux/pkt_cls.h>14#include <bpf/bpf_helpers.h>15#include <bpf/bpf_endian.h>16#include "bpf_misc.h"17 18/* llvm will optimize both subprograms into exactly the same BPF assembly19 *20 * Disassembly of section .text:21 *22 * 0000000000000000 test_pkt_access_subprog1:23 * ; return skb->len * 2;24 * 0: 61 10 00 00 00 00 00 00 r0 = *(u32 *)(r1 + 0)25 * 1: 64 00 00 00 01 00 00 00 w0 <<= 126 * 2: 95 00 00 00 00 00 00 00 exit27 *28 * 0000000000000018 test_pkt_access_subprog2:29 * ; return skb->len * val;30 * 3: 61 10 00 00 00 00 00 00 r0 = *(u32 *)(r1 + 0)31 * 4: 64 00 00 00 01 00 00 00 w0 <<= 132 * 5: 95 00 00 00 00 00 00 00 exit33 *34 * Which makes it an interesting test for BTF-enabled verifier.35 */36static __attribute__ ((noinline))37int test_pkt_access_subprog1(volatile struct __sk_buff *skb)38{39 return skb->len * 2;40}41 42static __attribute__ ((noinline))43int test_pkt_access_subprog2(int val, volatile struct __sk_buff *skb)44{45 return skb->len * val;46}47 48#define MAX_STACK (512 - 2 * 32)49 50__attribute__ ((noinline))51int get_skb_len(struct __sk_buff *skb)52{53 volatile char buf[MAX_STACK] = {};54 55 __sink(buf[MAX_STACK - 1]);56 57 return skb->len;58}59 60__attribute__ ((noinline))61int get_constant(long val)62{63 return val - 122;64}65 66int get_skb_ifindex(int, struct __sk_buff *skb, int);67 68__attribute__ ((noinline))69int test_pkt_access_subprog3(int val, struct __sk_buff *skb)70{71 return get_skb_len(skb) * get_skb_ifindex(val, skb, get_constant(123));72}73 74__attribute__ ((noinline))75int get_skb_ifindex(int val, struct __sk_buff *skb, int var)76{77 volatile char buf[MAX_STACK] = {};78 79 __sink(buf[MAX_STACK - 1]);80 81 return skb->ifindex * val * var;82}83 84__attribute__ ((noinline))85int test_pkt_write_access_subprog(struct __sk_buff *skb, __u32 off)86{87 void *data = (void *)(long)skb->data;88 void *data_end = (void *)(long)skb->data_end;89 struct tcphdr *tcp = NULL;90 91 if (off > sizeof(struct ethhdr) + sizeof(struct ipv6hdr))92 return -1;93 94 tcp = data + off;95 if (tcp + 1 > data_end)96 return -1;97 /* make modification to the packet data */98 tcp->check++;99 return 0;100}101 102SEC("tc")103int test_pkt_access(struct __sk_buff *skb)104{105 void *data_end = (void *)(long)skb->data_end;106 void *data = (void *)(long)skb->data;107 struct ethhdr *eth = (struct ethhdr *)(data);108 struct tcphdr *tcp = NULL;109 __u8 proto = 255;110 __u64 ihl_len;111 112 if (eth + 1 > data_end)113 return TC_ACT_SHOT;114 115 if (eth->h_proto == bpf_htons(ETH_P_IP)) {116 struct iphdr *iph = (struct iphdr *)(eth + 1);117 118 if (iph + 1 > data_end)119 return TC_ACT_SHOT;120 ihl_len = iph->ihl * 4;121 proto = iph->protocol;122 tcp = (struct tcphdr *)((void *)(iph) + ihl_len);123 } else if (eth->h_proto == bpf_htons(ETH_P_IPV6)) {124 struct ipv6hdr *ip6h = (struct ipv6hdr *)(eth + 1);125 126 if (ip6h + 1 > data_end)127 return TC_ACT_SHOT;128 ihl_len = sizeof(*ip6h);129 proto = ip6h->nexthdr;130 tcp = (struct tcphdr *)((void *)(ip6h) + ihl_len);131 }132 133 if (test_pkt_access_subprog1(skb) != skb->len * 2)134 return TC_ACT_SHOT;135 if (test_pkt_access_subprog2(2, skb) != skb->len * 2)136 return TC_ACT_SHOT;137 if (test_pkt_access_subprog3(3, skb) != skb->len * 3 * skb->ifindex)138 return TC_ACT_SHOT;139 if (tcp) {140 if (test_pkt_write_access_subprog(skb, (void *)tcp - data))141 return TC_ACT_SHOT;142 if (((void *)(tcp) + 20) > data_end || proto != 6)143 return TC_ACT_SHOT;144 barrier(); /* to force ordering of checks */145 if (((void *)(tcp) + 18) > data_end)146 return TC_ACT_SHOT;147 if (tcp->urg_ptr == 123)148 return TC_ACT_OK;149 }150 151 return TC_ACT_UNSPEC;152}153