1 // SPDX-License-Identifier: GPL-2.0 2 #define BPF_NO_KFUNC_PROTOTYPES 3 #include <vmlinux.h> 4 #include <bpf/bpf_helpers.h> 5 #include <bpf/bpf_endian.h> 6 7 #define ETH_P_IP 0x0800 8 #define ETH_P_IPV6 0x86dd 9 #define IP_MF 0x2000 /* "More Fragments" */ 10 #define IP_OFFSET 0x1fff /* "Fragment Offset" */ 11 #define AF_INET 2 12 #define AF_INET6 10 13 14 struct bpf_flowtable_opts___local { 15 s32 error; 16 }; 17 18 struct flow_offload_tuple_rhash * 19 bpf_xdp_flow_lookup(struct xdp_md *, struct bpf_fib_lookup *, 20 struct bpf_flowtable_opts___local *, u32) __ksym; 21 22 struct { 23 __uint(type, BPF_MAP_TYPE_ARRAY); 24 __type(key, __u32); 25 __type(value, __u32); 26 __uint(max_entries, 1); 27 } stats SEC(".maps"); 28 29 static bool xdp_flowtable_offload_check_iphdr(struct iphdr *iph) 30 { 31 /* ip fragmented traffic */ 32 if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET)) 33 return false; 34 35 /* ip options */ 36 if (iph->ihl * 4 != sizeof(*iph)) 37 return false; 38 39 if (iph->ttl <= 1) 40 return false; 41 42 return true; 43 } 44 45 static bool xdp_flowtable_offload_check_tcp_state(void *ports, void *data_end, 46 u8 proto) 47 { 48 if (proto == IPPROTO_TCP) { 49 struct tcphdr *tcph = ports; 50 51 if (tcph + 1 > data_end) 52 return false; 53 54 if (tcph->fin || tcph->rst) 55 return false; 56 } 57 58 return true; 59 } 60 61 SEC("xdp.frags") 62 int xdp_flowtable_do_lookup(struct xdp_md *ctx) 63 { 64 void *data_end = (void *)(long)ctx->data_end; 65 struct bpf_flowtable_opts___local opts = {}; 66 struct flow_offload_tuple_rhash *tuplehash; 67 struct bpf_fib_lookup tuple = { 68 .ifindex = ctx->ingress_ifindex, 69 }; 70 void *data = (void *)(long)ctx->data; 71 struct ethhdr *eth = data; 72 struct flow_ports *ports; 73 __u32 *val, key = 0; 74 75 if (eth + 1 > data_end) 76 return XDP_DROP; 77 78 switch (eth->h_proto) { 79 case bpf_htons(ETH_P_IP): { 80 struct iphdr *iph = data + sizeof(*eth); 81 82 ports = (struct flow_ports *)(iph + 1); 83 if (ports + 1 > data_end) 84 return XDP_PASS; 85 86 /* sanity check on ip header */ 87 if (!xdp_flowtable_offload_check_iphdr(iph)) 88 return XDP_PASS; 89 90 if (!xdp_flowtable_offload_check_tcp_state(ports, data_end, 91 iph->protocol)) 92 return XDP_PASS; 93 94 tuple.family = AF_INET; 95 tuple.tos = iph->tos; 96 tuple.l4_protocol = iph->protocol; 97 tuple.tot_len = bpf_ntohs(iph->tot_len); 98 tuple.ipv4_src = iph->saddr; 99 tuple.ipv4_dst = iph->daddr; 100 tuple.sport = ports->source; 101 tuple.dport = ports->dest; 102 break; 103 } 104 case bpf_htons(ETH_P_IPV6): { 105 struct in6_addr *src = (struct in6_addr *)tuple.ipv6_src; 106 struct in6_addr *dst = (struct in6_addr *)tuple.ipv6_dst; 107 struct ipv6hdr *ip6h = data + sizeof(*eth); 108 109 ports = (struct flow_ports *)(ip6h + 1); 110 if (ports + 1 > data_end) 111 return XDP_PASS; 112 113 if (ip6h->hop_limit <= 1) 114 return XDP_PASS; 115 116 if (!xdp_flowtable_offload_check_tcp_state(ports, data_end, 117 ip6h->nexthdr)) 118 return XDP_PASS; 119 120 tuple.family = AF_INET6; 121 tuple.l4_protocol = ip6h->nexthdr; 122 tuple.tot_len = bpf_ntohs(ip6h->payload_len); 123 *src = ip6h->saddr; 124 *dst = ip6h->daddr; 125 tuple.sport = ports->source; 126 tuple.dport = ports->dest; 127 break; 128 } 129 default: 130 return XDP_PASS; 131 } 132 133 tuplehash = bpf_xdp_flow_lookup(ctx, &tuple, &opts, sizeof(opts)); 134 if (!tuplehash) 135 return XDP_PASS; 136 137 val = bpf_map_lookup_elem(&stats, &key); 138 if (val) 139 __sync_add_and_fetch(val, 1); 140 141 return XDP_PASS; 142 } 143 144 char _license[] SEC("license") = "GPL"; 145