168 lines · c
1// SPDX-License-Identifier: GPL-2.02// Copyright (c) 2018 Facebook3// Copyright (c) 2019 Cloudflare4 5#include <string.h>6 7#include <linux/bpf.h>8#include <linux/pkt_cls.h>9#include <linux/if_ether.h>10#include <linux/in.h>11#include <linux/ip.h>12#include <linux/ipv6.h>13#include <sys/socket.h>14#include <linux/tcp.h>15 16#include <bpf/bpf_helpers.h>17#include <bpf/bpf_endian.h>18 19struct {20 __uint(type, BPF_MAP_TYPE_ARRAY);21 __type(key, __u32);22 __type(value, __u32);23 __uint(max_entries, 3);24} results SEC(".maps");25 26static __always_inline __s64 gen_syncookie(void *data_end, struct bpf_sock *sk,27 void *iph, __u32 ip_size,28 struct tcphdr *tcph)29{30 __u32 thlen = tcph->doff * 4;31 32 if (tcph->syn && !tcph->ack) {33 // packet should only have an MSS option34 if (thlen != 24)35 return 0;36 37 if ((void *)tcph + thlen > data_end)38 return 0;39 40 return bpf_tcp_gen_syncookie(sk, iph, ip_size, tcph, thlen);41 }42 return 0;43}44 45static __always_inline void check_syncookie(void *ctx, void *data,46 void *data_end)47{48 struct bpf_sock_tuple tup;49 struct bpf_sock *sk;50 struct ethhdr *ethh;51 struct iphdr *ipv4h;52 struct ipv6hdr *ipv6h;53 struct tcphdr *tcph;54 int ret;55 __u32 key_mss = 2;56 __u32 key_gen = 1;57 __u32 key = 0;58 __s64 seq_mss;59 60 ethh = data;61 if (ethh + 1 > data_end)62 return;63 64 switch (bpf_ntohs(ethh->h_proto)) {65 case ETH_P_IP:66 ipv4h = data + sizeof(struct ethhdr);67 if (ipv4h + 1 > data_end)68 return;69 70 if (ipv4h->ihl != 5)71 return;72 73 tcph = data + sizeof(struct ethhdr) + sizeof(struct iphdr);74 if (tcph + 1 > data_end)75 return;76 77 tup.ipv4.saddr = ipv4h->saddr;78 tup.ipv4.daddr = ipv4h->daddr;79 tup.ipv4.sport = tcph->source;80 tup.ipv4.dport = tcph->dest;81 82 sk = bpf_skc_lookup_tcp(ctx, &tup, sizeof(tup.ipv4),83 BPF_F_CURRENT_NETNS, 0);84 if (!sk)85 return;86 87 if (sk->state != BPF_TCP_LISTEN)88 goto release;89 90 seq_mss = gen_syncookie(data_end, sk, ipv4h, sizeof(*ipv4h),91 tcph);92 93 ret = bpf_tcp_check_syncookie(sk, ipv4h, sizeof(*ipv4h),94 tcph, sizeof(*tcph));95 break;96 97 case ETH_P_IPV6:98 ipv6h = data + sizeof(struct ethhdr);99 if (ipv6h + 1 > data_end)100 return;101 102 if (ipv6h->nexthdr != IPPROTO_TCP)103 return;104 105 tcph = data + sizeof(struct ethhdr) + sizeof(struct ipv6hdr);106 if (tcph + 1 > data_end)107 return;108 109 memcpy(tup.ipv6.saddr, &ipv6h->saddr, sizeof(tup.ipv6.saddr));110 memcpy(tup.ipv6.daddr, &ipv6h->daddr, sizeof(tup.ipv6.daddr));111 tup.ipv6.sport = tcph->source;112 tup.ipv6.dport = tcph->dest;113 114 sk = bpf_skc_lookup_tcp(ctx, &tup, sizeof(tup.ipv6),115 BPF_F_CURRENT_NETNS, 0);116 if (!sk)117 return;118 119 if (sk->state != BPF_TCP_LISTEN)120 goto release;121 122 seq_mss = gen_syncookie(data_end, sk, ipv6h, sizeof(*ipv6h),123 tcph);124 125 ret = bpf_tcp_check_syncookie(sk, ipv6h, sizeof(*ipv6h),126 tcph, sizeof(*tcph));127 break;128 129 default:130 return;131 }132 133 if (seq_mss > 0) {134 __u32 cookie = (__u32)seq_mss;135 __u32 mss = seq_mss >> 32;136 137 bpf_map_update_elem(&results, &key_gen, &cookie, 0);138 bpf_map_update_elem(&results, &key_mss, &mss, 0);139 }140 141 if (ret == 0) {142 __u32 cookie = bpf_ntohl(tcph->ack_seq) - 1;143 144 bpf_map_update_elem(&results, &key, &cookie, 0);145 }146 147release:148 bpf_sk_release(sk);149}150 151SEC("tc")152int check_syncookie_clsact(struct __sk_buff *skb)153{154 check_syncookie(skb, (void *)(long)skb->data,155 (void *)(long)skb->data_end);156 return TC_ACT_OK;157}158 159SEC("xdp")160int check_syncookie_xdp(struct xdp_md *ctx)161{162 check_syncookie(ctx, (void *)(long)ctx->data,163 (void *)(long)ctx->data_end);164 return XDP_PASS;165}166 167char _license[] SEC("license") = "GPL";168