1 // SPDX-License-Identifier: GPL-2.0 2 // Copyright (c) 2018 Facebook 3 4 #include <string.h> 5 6 #include <linux/stddef.h> 7 #include <linux/bpf.h> 8 #include <linux/in.h> 9 #include <linux/in6.h> 10 #include <linux/tcp.h> 11 #include <linux/if.h> 12 #include <errno.h> 13 14 #include <bpf/bpf_helpers.h> 15 #include <bpf/bpf_endian.h> 16 17 #define SRC_REWRITE_IP4 0x7f000004U 18 #define DST_REWRITE_IP4 0x7f000001U 19 #define DST_REWRITE_PORT4 4444 20 21 #ifndef TCP_CA_NAME_MAX 22 #define TCP_CA_NAME_MAX 16 23 #endif 24 25 #ifndef TCP_NOTSENT_LOWAT 26 #define TCP_NOTSENT_LOWAT 25 27 #endif 28 29 #ifndef IFNAMSIZ 30 #define IFNAMSIZ 16 31 #endif 32 33 #ifndef SOL_TCP 34 #define SOL_TCP 6 35 #endif 36 37 __attribute__ ((noinline)) __weak 38 int do_bind(struct bpf_sock_addr *ctx) 39 { 40 struct sockaddr_in sa = {}; 41 42 sa.sin_family = AF_INET; 43 sa.sin_port = bpf_htons(0); 44 sa.sin_addr.s_addr = bpf_htonl(SRC_REWRITE_IP4); 45 46 if (bpf_bind(ctx, (struct sockaddr *)&sa, sizeof(sa)) != 0) 47 return 0; 48 49 return 1; 50 } 51 52 static __inline int verify_cc(struct bpf_sock_addr *ctx, 53 char expected[TCP_CA_NAME_MAX]) 54 { 55 char buf[TCP_CA_NAME_MAX]; 56 int i; 57 58 if (bpf_getsockopt(ctx, SOL_TCP, TCP_CONGESTION, &buf, sizeof(buf))) 59 return 1; 60 61 for (i = 0; i < TCP_CA_NAME_MAX; i++) { 62 if (buf[i] != expected[i]) 63 return 1; 64 if (buf[i] == 0) 65 break; 66 } 67 68 return 0; 69 } 70 71 static __inline int set_cc(struct bpf_sock_addr *ctx) 72 { 73 char reno[TCP_CA_NAME_MAX] = "reno"; 74 char cubic[TCP_CA_NAME_MAX] = "cubic"; 75 76 if (bpf_setsockopt(ctx, SOL_TCP, TCP_CONGESTION, &reno, sizeof(reno))) 77 return 1; 78 if (verify_cc(ctx, reno)) 79 return 1; 80 81 if (bpf_setsockopt(ctx, SOL_TCP, TCP_CONGESTION, &cubic, sizeof(cubic))) 82 return 1; 83 if (verify_cc(ctx, cubic)) 84 return 1; 85 86 return 0; 87 } 88 89 static __inline int bind_to_device(struct bpf_sock_addr *ctx) 90 { 91 char veth1[IFNAMSIZ] = "test_sock_addr1"; 92 char veth2[IFNAMSIZ] = "test_sock_addr2"; 93 char missing[IFNAMSIZ] = "nonexistent_dev"; 94 char del_bind[IFNAMSIZ] = ""; 95 96 if (bpf_setsockopt(ctx, SOL_SOCKET, SO_BINDTODEVICE, 97 &veth1, sizeof(veth1))) 98 return 1; 99 if (bpf_setsockopt(ctx, SOL_SOCKET, SO_BINDTODEVICE, 100 &veth2, sizeof(veth2))) 101 return 1; 102 if (bpf_setsockopt(ctx, SOL_SOCKET, SO_BINDTODEVICE, 103 &missing, sizeof(missing)) != -ENODEV) 104 return 1; 105 if (bpf_setsockopt(ctx, SOL_SOCKET, SO_BINDTODEVICE, 106 &del_bind, sizeof(del_bind))) 107 return 1; 108 109 return 0; 110 } 111 112 static __inline int set_keepalive(struct bpf_sock_addr *ctx) 113 { 114 int zero = 0, one = 1; 115 116 if (bpf_setsockopt(ctx, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one))) 117 return 1; 118 if (ctx->type == SOCK_STREAM) { 119 if (bpf_setsockopt(ctx, SOL_TCP, TCP_KEEPIDLE, &one, sizeof(one))) 120 return 1; 121 if (bpf_setsockopt(ctx, SOL_TCP, TCP_KEEPINTVL, &one, sizeof(one))) 122 return 1; 123 if (bpf_setsockopt(ctx, SOL_TCP, TCP_KEEPCNT, &one, sizeof(one))) 124 return 1; 125 if (bpf_setsockopt(ctx, SOL_TCP, TCP_SYNCNT, &one, sizeof(one))) 126 return 1; 127 if (bpf_setsockopt(ctx, SOL_TCP, TCP_USER_TIMEOUT, &one, sizeof(one))) 128 return 1; 129 } 130 if (bpf_setsockopt(ctx, SOL_SOCKET, SO_KEEPALIVE, &zero, sizeof(zero))) 131 return 1; 132 133 return 0; 134 } 135 136 static __inline int set_notsent_lowat(struct bpf_sock_addr *ctx) 137 { 138 int lowat = 65535; 139 140 if (ctx->type == SOCK_STREAM) { 141 if (bpf_setsockopt(ctx, SOL_TCP, TCP_NOTSENT_LOWAT, &lowat, sizeof(lowat))) 142 return 1; 143 } 144 145 return 0; 146 } 147 148 SEC("cgroup/connect4") 149 int connect_v4_prog(struct bpf_sock_addr *ctx) 150 { 151 struct bpf_sock_tuple tuple = {}; 152 struct bpf_sock *sk; 153 154 /* Verify that new destination is available. */ 155 memset(&tuple.ipv4.saddr, 0, sizeof(tuple.ipv4.saddr)); 156 memset(&tuple.ipv4.sport, 0, sizeof(tuple.ipv4.sport)); 157 158 tuple.ipv4.daddr = bpf_htonl(DST_REWRITE_IP4); 159 tuple.ipv4.dport = bpf_htons(DST_REWRITE_PORT4); 160 161 /* Bind to device and unbind it. */ 162 if (bind_to_device(ctx)) 163 return 0; 164 165 if (set_keepalive(ctx)) 166 return 0; 167 168 if (set_notsent_lowat(ctx)) 169 return 0; 170 171 if (ctx->type != SOCK_STREAM && ctx->type != SOCK_DGRAM) 172 return 0; 173 else if (ctx->type == SOCK_STREAM) 174 sk = bpf_sk_lookup_tcp(ctx, &tuple, sizeof(tuple.ipv4), 175 BPF_F_CURRENT_NETNS, 0); 176 else 177 sk = bpf_sk_lookup_udp(ctx, &tuple, sizeof(tuple.ipv4), 178 BPF_F_CURRENT_NETNS, 0); 179 180 if (!sk) 181 return 0; 182 183 if (sk->src_ip4 != tuple.ipv4.daddr || 184 sk->src_port != DST_REWRITE_PORT4) { 185 bpf_sk_release(sk); 186 return 0; 187 } 188 189 bpf_sk_release(sk); 190 191 /* Rewrite congestion control. */ 192 if (ctx->type == SOCK_STREAM && set_cc(ctx)) 193 return 0; 194 195 /* Rewrite destination. */ 196 ctx->user_ip4 = bpf_htonl(DST_REWRITE_IP4); 197 ctx->user_port = bpf_htons(DST_REWRITE_PORT4); 198 199 return do_bind(ctx) ? 1 : 0; 200 } 201 202 SEC("cgroup/connect4") 203 int connect_v4_deny_prog(struct bpf_sock_addr *ctx) 204 { 205 return 0; 206 } 207 208 char _license[] SEC("license") = "GPL"; 209