tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0
2#define BPF_NO_KFUNC_PROTOTYPES
3#include <vmlinux.h>
4#include <bpf/bpf_helpers.h>
5#include <bpf/bpf_endian.h>
6
7#define ETH_P_IP 0x0800
8#define ETH_P_IPV6 0x86dd
9#define IP_MF 0x2000 /* "More Fragments" */
10#define IP_OFFSET 0x1fff /* "Fragment Offset" */
11#define AF_INET 2
12#define AF_INET6 10
13
14struct bpf_flowtable_opts___local {
15 s32 error;
16};
17
18struct flow_offload_tuple_rhash *
19bpf_xdp_flow_lookup(struct xdp_md *, struct bpf_fib_lookup *,
20 struct bpf_flowtable_opts___local *, u32) __ksym;
21
22struct {
23 __uint(type, BPF_MAP_TYPE_ARRAY);
24 __type(key, __u32);
25 __type(value, __u32);
26 __uint(max_entries, 1);
27} stats SEC(".maps");
28
29static bool xdp_flowtable_offload_check_iphdr(struct iphdr *iph)
30{
31 /* ip fragmented traffic */
32 if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET))
33 return false;
34
35 /* ip options */
36 if (iph->ihl * 4 != sizeof(*iph))
37 return false;
38
39 if (iph->ttl <= 1)
40 return false;
41
42 return true;
43}
44
45static bool xdp_flowtable_offload_check_tcp_state(void *ports, void *data_end,
46 u8 proto)
47{
48 if (proto == IPPROTO_TCP) {
49 struct tcphdr *tcph = ports;
50
51 if (tcph + 1 > data_end)
52 return false;
53
54 if (tcph->fin || tcph->rst)
55 return false;
56 }
57
58 return true;
59}
60
61struct flow_ports___local {
62 __be16 source, dest;
63} __attribute__((preserve_access_index));
64
65SEC("xdp.frags")
66int xdp_flowtable_do_lookup(struct xdp_md *ctx)
67{
68 void *data_end = (void *)(long)ctx->data_end;
69 struct bpf_flowtable_opts___local opts = {};
70 struct flow_offload_tuple_rhash *tuplehash;
71 struct bpf_fib_lookup tuple = {
72 .ifindex = ctx->ingress_ifindex,
73 };
74 void *data = (void *)(long)ctx->data;
75 struct ethhdr *eth = data;
76 struct flow_ports___local *ports;
77 __u32 *val, key = 0;
78
79 if (eth + 1 > data_end)
80 return XDP_DROP;
81
82 switch (eth->h_proto) {
83 case bpf_htons(ETH_P_IP): {
84 struct iphdr *iph = data + sizeof(*eth);
85
86 ports = (struct flow_ports___local *)(iph + 1);
87 if (ports + 1 > data_end)
88 return XDP_PASS;
89
90 /* sanity check on ip header */
91 if (!xdp_flowtable_offload_check_iphdr(iph))
92 return XDP_PASS;
93
94 if (!xdp_flowtable_offload_check_tcp_state(ports, data_end,
95 iph->protocol))
96 return XDP_PASS;
97
98 tuple.family = AF_INET;
99 tuple.tos = iph->tos;
100 tuple.l4_protocol = iph->protocol;
101 tuple.tot_len = bpf_ntohs(iph->tot_len);
102 tuple.ipv4_src = iph->saddr;
103 tuple.ipv4_dst = iph->daddr;
104 tuple.sport = ports->source;
105 tuple.dport = ports->dest;
106 break;
107 }
108 case bpf_htons(ETH_P_IPV6): {
109 struct in6_addr *src = (struct in6_addr *)tuple.ipv6_src;
110 struct in6_addr *dst = (struct in6_addr *)tuple.ipv6_dst;
111 struct ipv6hdr *ip6h = data + sizeof(*eth);
112
113 ports = (struct flow_ports___local *)(ip6h + 1);
114 if (ports + 1 > data_end)
115 return XDP_PASS;
116
117 if (ip6h->hop_limit <= 1)
118 return XDP_PASS;
119
120 if (!xdp_flowtable_offload_check_tcp_state(ports, data_end,
121 ip6h->nexthdr))
122 return XDP_PASS;
123
124 tuple.family = AF_INET6;
125 tuple.l4_protocol = ip6h->nexthdr;
126 tuple.tot_len = bpf_ntohs(ip6h->payload_len);
127 *src = ip6h->saddr;
128 *dst = ip6h->daddr;
129 tuple.sport = ports->source;
130 tuple.dport = ports->dest;
131 break;
132 }
133 default:
134 return XDP_PASS;
135 }
136
137 tuplehash = bpf_xdp_flow_lookup(ctx, &tuple, &opts, sizeof(opts));
138 if (!tuplehash)
139 return XDP_PASS;
140
141 val = bpf_map_lookup_elem(&stats, &key);
142 if (val)
143 __sync_add_and_fetch(val, 1);
144
145 return XDP_PASS;
146}
147
148char _license[] SEC("license") = "GPL";