Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 | // SPDX-License-Identifier: GPL-2.0 // Copyright (c) 2019 Facebook #include <stddef.h> #include <string.h> #include <linux/bpf.h> #include <linux/if_ether.h> #include <linux/if_packet.h> #include <linux/ip.h> #include <linux/ipv6.h> #include <linux/in.h> #include <linux/udp.h> #include <linux/tcp.h> #include <linux/pkt_cls.h> #include <sys/socket.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> #include "test_iptunnel_common.h" #include "bpf_compiler.h" struct { __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); __uint(max_entries, 256); __type(key, __u32); __type(value, __u64); } rxcnt SEC(".maps"); struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, MAX_IPTNL_ENTRIES); __type(key, struct vip); __type(value, struct iptnl_info); } vip2tnl SEC(".maps"); static __always_inline void count_tx(__u32 protocol) { __u64 *rxcnt_count; rxcnt_count = bpf_map_lookup_elem(&rxcnt, &protocol); if (rxcnt_count) *rxcnt_count += 1; } static __always_inline int get_dport(void *trans_data, void *data_end, __u8 protocol) { struct tcphdr *th; struct udphdr *uh; switch (protocol) { case IPPROTO_TCP: th = (struct tcphdr *)trans_data; if (th + 1 > data_end) return -1; return th->dest; case IPPROTO_UDP: uh = (struct udphdr *)trans_data; if (uh + 1 > data_end) return -1; return uh->dest; default: return 0; } } static __always_inline void set_ethhdr(struct ethhdr *new_eth, const struct ethhdr *old_eth, const struct iptnl_info *tnl, __be16 h_proto) { memcpy(new_eth->h_source, old_eth->h_dest, sizeof(new_eth->h_source)); memcpy(new_eth->h_dest, tnl->dmac, sizeof(new_eth->h_dest)); new_eth->h_proto = h_proto; } static __always_inline int handle_ipv4(struct xdp_md *xdp) { void *data_end = (void *)(long)xdp->data_end; void *data = (void *)(long)xdp->data; struct iptnl_info *tnl; struct ethhdr *new_eth; struct ethhdr *old_eth; struct iphdr *iph = data + sizeof(struct ethhdr); __u16 *next_iph; __u16 payload_len; struct vip vip = {}; int dport; __u32 csum = 0; int i; if (iph + 1 > data_end) return XDP_DROP; dport = get_dport(iph + 1, data_end, iph->protocol); if (dport == -1) return XDP_DROP; vip.protocol = iph->protocol; vip.family = AF_INET; vip.daddr.v4 = iph->daddr; vip.dport = dport; payload_len = bpf_ntohs(iph->tot_len); tnl = bpf_map_lookup_elem(&vip2tnl, &vip); /* It only does v4-in-v4 */ if (!tnl || tnl->family != AF_INET) return XDP_PASS; if (bpf_xdp_adjust_head(xdp, 0 - (int)sizeof(struct iphdr))) return XDP_DROP; data = (void *)(long)xdp->data; data_end = (void *)(long)xdp->data_end; new_eth = data; iph = data + sizeof(*new_eth); old_eth = data + sizeof(*iph); if (new_eth + 1 > data_end || old_eth + 1 > data_end || iph + 1 > data_end) return XDP_DROP; set_ethhdr(new_eth, old_eth, tnl, bpf_htons(ETH_P_IP)); iph->version = 4; iph->ihl = sizeof(*iph) >> 2; iph->frag_off = 0; iph->protocol = IPPROTO_IPIP; iph->check = 0; iph->tos = 0; iph->tot_len = bpf_htons(payload_len + sizeof(*iph)); iph->daddr = tnl->daddr.v4; iph->saddr = tnl->saddr.v4; iph->ttl = 8; next_iph = (__u16 *)iph; __pragma_loop_no_unroll for (i = 0; i < sizeof(*iph) >> 1; i++) csum += *next_iph++; iph->check = ~((csum & 0xffff) + (csum >> 16)); count_tx(vip.protocol); return XDP_TX; } static __always_inline int handle_ipv6(struct xdp_md *xdp) { void *data_end = (void *)(long)xdp->data_end; void *data = (void *)(long)xdp->data; struct iptnl_info *tnl; struct ethhdr *new_eth; struct ethhdr *old_eth; struct ipv6hdr *ip6h = data + sizeof(struct ethhdr); __u16 payload_len; struct vip vip = {}; int dport; if (ip6h + 1 > data_end) return XDP_DROP; dport = get_dport(ip6h + 1, data_end, ip6h->nexthdr); if (dport == -1) return XDP_DROP; vip.protocol = ip6h->nexthdr; vip.family = AF_INET6; memcpy(vip.daddr.v6, ip6h->daddr.s6_addr32, sizeof(vip.daddr)); vip.dport = dport; payload_len = ip6h->payload_len; tnl = bpf_map_lookup_elem(&vip2tnl, &vip); /* It only does v6-in-v6 */ if (!tnl || tnl->family != AF_INET6) return XDP_PASS; if (bpf_xdp_adjust_head(xdp, 0 - (int)sizeof(struct ipv6hdr))) return XDP_DROP; data = (void *)(long)xdp->data; data_end = (void *)(long)xdp->data_end; new_eth = data; ip6h = data + sizeof(*new_eth); old_eth = data + sizeof(*ip6h); if (new_eth + 1 > data_end || old_eth + 1 > data_end || ip6h + 1 > data_end) return XDP_DROP; set_ethhdr(new_eth, old_eth, tnl, bpf_htons(ETH_P_IPV6)); ip6h->version = 6; ip6h->priority = 0; memset(ip6h->flow_lbl, 0, sizeof(ip6h->flow_lbl)); ip6h->payload_len = bpf_htons(bpf_ntohs(payload_len) + sizeof(*ip6h)); ip6h->nexthdr = IPPROTO_IPV6; ip6h->hop_limit = 8; memcpy(ip6h->saddr.s6_addr32, tnl->saddr.v6, sizeof(tnl->saddr.v6)); memcpy(ip6h->daddr.s6_addr32, tnl->daddr.v6, sizeof(tnl->daddr.v6)); count_tx(vip.protocol); return XDP_TX; } SEC("xdp") int _xdp_tx_iptunnel(struct xdp_md *xdp) { void *data_end = (void *)(long)xdp->data_end; void *data = (void *)(long)xdp->data; struct ethhdr *eth = data; __u16 h_proto; if (eth + 1 > data_end) return XDP_DROP; h_proto = eth->h_proto; if (h_proto == bpf_htons(ETH_P_IP)) return handle_ipv4(xdp); else if (h_proto == bpf_htons(ETH_P_IPV6)) return handle_ipv6(xdp); else return XDP_DROP; } char _license[] SEC("license") = "GPL"; |