1 // SPDX-License-Identifier: GPL-2.0 2 #define BPF_NO_KFUNC_PROTOTYPES 3 #include <vmlinux.h> 4 #include <bpf/bpf_helpers.h> 5 #include <bpf/bpf_endian.h> 6 7 #define ETH_P_IP 0x0800 8 #define ETH_P_IPV6 0x86dd 9 #define IP_MF 0x2000 /* "More Fragments" */ 10 #define IP_OFFSET 0x1fff /* "Fragment Offset" */ 11 #define AF_INET 2 12 #define AF_INET6 10 13 14 struct bpf_flowtable_opts___local { 15 s32 error; 16 }; 17 18 struct flow_offload_tuple_rhash * 19 bpf_xdp_flow_lookup(struct xdp_md *, struct bpf_fib_lookup *, 20 struct bpf_flowtable_opts___local *, u32) __ksym; 21 22 struct { 23 __uint(type, BPF_MAP_TYPE_ARRAY); 24 __type(key, __u32); 25 __type(value, __u32); 26 __uint(max_entries, 1); 27 } stats SEC(".maps"); 28 29 static bool xdp_flowtable_offload_check_iphdr(struct iphdr *iph) 30 { 31 /* ip fragmented traffic */ 32 if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET)) 33 return false; 34 35 /* ip options */ 36 if (iph->ihl * 4 != sizeof(*iph)) 37 return false; 38 39 if (iph->ttl <= 1) 40 return false; 41 42 return true; 43 } 44 45 static bool xdp_flowtable_offload_check_tcp_state(void *ports, void *data_end, 46 u8 proto) 47 { 48 if (proto == IPPROTO_TCP) { 49 struct tcphdr *tcph = ports; 50 51 if (tcph + 1 > data_end) 52 return false; 53 54 if (tcph->fin || tcph->rst) 55 return false; 56 } 57 58 return true; 59 } 60 61 struct flow_ports___local { 62 __be16 source, dest; 63 } __attribute__((preserve_access_index)); 64 65 SEC("xdp.frags") 66 int xdp_flowtable_do_lookup(struct xdp_md *ctx) 67 { 68 void *data_end = (void *)(long)ctx->data_end; 69 struct bpf_flowtable_opts___local opts = {}; 70 struct flow_offload_tuple_rhash *tuplehash; 71 struct bpf_fib_lookup tuple = { 72 .ifindex = ctx->ingress_ifindex, 73 }; 74 void *data = (void *)(long)ctx->data; 75 struct ethhdr *eth = data; 76 struct flow_ports___local *ports; 77 __u32 *val, key = 0; 78 79 if (eth + 1 > data_end) 80 return XDP_DROP; 81 82 switch (eth->h_proto) { 83 case bpf_htons(ETH_P_IP): { 84 struct iphdr *iph = data + sizeof(*eth); 85 86 ports = (struct flow_ports___local *)(iph + 1); 87 if (ports + 1 > data_end) 88 return XDP_PASS; 89 90 /* sanity check on ip header */ 91 if (!xdp_flowtable_offload_check_iphdr(iph)) 92 return XDP_PASS; 93 94 if (!xdp_flowtable_offload_check_tcp_state(ports, data_end, 95 iph->protocol)) 96 return XDP_PASS; 97 98 tuple.family = AF_INET; 99 tuple.tos = iph->tos; 100 tuple.l4_protocol = iph->protocol; 101 tuple.tot_len = bpf_ntohs(iph->tot_len); 102 tuple.ipv4_src = iph->saddr; 103 tuple.ipv4_dst = iph->daddr; 104 tuple.sport = ports->source; 105 tuple.dport = ports->dest; 106 break; 107 } 108 case bpf_htons(ETH_P_IPV6): { 109 struct in6_addr *src = (struct in6_addr *)tuple.ipv6_src; 110 struct in6_addr *dst = (struct in6_addr *)tuple.ipv6_dst; 111 struct ipv6hdr *ip6h = data + sizeof(*eth); 112 113 ports = (struct flow_ports___local *)(ip6h + 1); 114 if (ports + 1 > data_end) 115 return XDP_PASS; 116 117 if (ip6h->hop_limit <= 1) 118 return XDP_PASS; 119 120 if (!xdp_flowtable_offload_check_tcp_state(ports, data_end, 121 ip6h->nexthdr)) 122 return XDP_PASS; 123 124 tuple.family = AF_INET6; 125 tuple.l4_protocol = ip6h->nexthdr; 126 tuple.tot_len = bpf_ntohs(ip6h->payload_len); 127 *src = ip6h->saddr; 128 *dst = ip6h->daddr; 129 tuple.sport = ports->source; 130 tuple.dport = ports->dest; 131 break; 132 } 133 default: 134 return XDP_PASS; 135 } 136 137 tuplehash = bpf_xdp_flow_lookup(ctx, &tuple, &opts, sizeof(opts)); 138 if (!tuplehash) 139 return XDP_PASS; 140 141 val = bpf_map_lookup_elem(&stats, &key); 142 if (val) 143 __sync_add_and_fetch(val, 1); 144 145 return XDP_PASS; 146 } 147 148 char _license[] SEC("license") = "GPL"; 149