149 lines · c
1// SPDX-License-Identifier: GPL-2.02#define BPF_NO_KFUNC_PROTOTYPES3#include <vmlinux.h>4#include <bpf/bpf_helpers.h>5#include <bpf/bpf_endian.h>6 7#define ETH_P_IP 0x08008#define ETH_P_IPV6 0x86dd9#define IP_MF 0x2000 /* "More Fragments" */10#define IP_OFFSET 0x1fff /* "Fragment Offset" */11#define AF_INET 212#define AF_INET6 1013 14struct bpf_flowtable_opts___local {15 s32 error;16};17 18struct flow_offload_tuple_rhash *19bpf_xdp_flow_lookup(struct xdp_md *, struct bpf_fib_lookup *,20 struct bpf_flowtable_opts___local *, u32) __ksym;21 22struct {23 __uint(type, BPF_MAP_TYPE_ARRAY);24 __type(key, __u32);25 __type(value, __u32);26 __uint(max_entries, 1);27} stats SEC(".maps");28 29static bool xdp_flowtable_offload_check_iphdr(struct iphdr *iph)30{31 /* ip fragmented traffic */32 if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET))33 return false;34 35 /* ip options */36 if (iph->ihl * 4 != sizeof(*iph))37 return false;38 39 if (iph->ttl <= 1)40 return false;41 42 return true;43}44 45static bool xdp_flowtable_offload_check_tcp_state(void *ports, void *data_end,46 u8 proto)47{48 if (proto == IPPROTO_TCP) {49 struct tcphdr *tcph = ports;50 51 if (tcph + 1 > data_end)52 return false;53 54 if (tcph->fin || tcph->rst)55 return false;56 }57 58 return true;59}60 61struct flow_ports___local {62 __be16 source, dest;63} __attribute__((preserve_access_index));64 65SEC("xdp.frags")66int xdp_flowtable_do_lookup(struct xdp_md *ctx)67{68 void *data_end = (void *)(long)ctx->data_end;69 struct bpf_flowtable_opts___local opts = {};70 struct flow_offload_tuple_rhash *tuplehash;71 struct bpf_fib_lookup tuple = {72 .ifindex = ctx->ingress_ifindex,73 };74 void *data = (void *)(long)ctx->data;75 struct ethhdr *eth = data;76 struct flow_ports___local *ports;77 __u32 *val, key = 0;78 79 if (eth + 1 > data_end)80 return XDP_DROP;81 82 switch (eth->h_proto) {83 case bpf_htons(ETH_P_IP): {84 struct iphdr *iph = data + sizeof(*eth);85 86 ports = (struct flow_ports___local *)(iph + 1);87 if (ports + 1 > data_end)88 return XDP_PASS;89 90 /* sanity check on ip header */91 if (!xdp_flowtable_offload_check_iphdr(iph))92 return XDP_PASS;93 94 if (!xdp_flowtable_offload_check_tcp_state(ports, data_end,95 iph->protocol))96 return XDP_PASS;97 98 tuple.family = AF_INET;99 tuple.tos = iph->tos;100 tuple.l4_protocol = iph->protocol;101 tuple.tot_len = bpf_ntohs(iph->tot_len);102 tuple.ipv4_src = iph->saddr;103 tuple.ipv4_dst = iph->daddr;104 tuple.sport = ports->source;105 tuple.dport = ports->dest;106 break;107 }108 case bpf_htons(ETH_P_IPV6): {109 struct in6_addr *src = (struct in6_addr *)tuple.ipv6_src;110 struct in6_addr *dst = (struct in6_addr *)tuple.ipv6_dst;111 struct ipv6hdr *ip6h = data + sizeof(*eth);112 113 ports = (struct flow_ports___local *)(ip6h + 1);114 if (ports + 1 > data_end)115 return XDP_PASS;116 117 if (ip6h->hop_limit <= 1)118 return XDP_PASS;119 120 if (!xdp_flowtable_offload_check_tcp_state(ports, data_end,121 ip6h->nexthdr))122 return XDP_PASS;123 124 tuple.family = AF_INET6;125 tuple.l4_protocol = ip6h->nexthdr;126 tuple.tot_len = bpf_ntohs(ip6h->payload_len);127 *src = ip6h->saddr;128 *dst = ip6h->daddr;129 tuple.sport = ports->source;130 tuple.dport = ports->dest;131 break;132 }133 default:134 return XDP_PASS;135 }136 137 tuplehash = bpf_xdp_flow_lookup(ctx, &tuple, &opts, sizeof(opts));138 if (!tuplehash)139 return XDP_PASS;140 141 val = bpf_map_lookup_elem(&stats, &key);142 if (val)143 __sync_add_and_fetch(val, 1);144 145 return XDP_PASS;146}147 148char _license[] SEC("license") = "GPL";149