1 // SPDX-License-Identifier: GPL-2.0
2 #include <limits.h>
3 #include <stddef.h>
4 #include <stdbool.h>
5 #include <string.h>
6 #include <linux/pkt_cls.h>
7 #include <linux/bpf.h>
8 #include <linux/in.h>
9 #include <linux/if_ether.h>
10 #include <linux/icmp.h>
11 #include <linux/ip.h>
12 #include <linux/ipv6.h>
13 #include <linux/tcp.h>
14 #include <linux/udp.h>
15 #include <linux/if_packet.h>
16 #include <sys/socket.h>
17 #include <linux/if_tunnel.h>
18 #include <linux/mpls.h>
19 #include "bpf_helpers.h"
20 #include "bpf_endian.h"
21 
22 int _version SEC("version") = 1;
23 #define PROG(F) SEC(#F) int bpf_func_##F
24 
25 /* These are the identifiers of the BPF programs that will be used in tail
26  * calls. Name is limited to 16 characters, with the terminating character and
27  * bpf_func_ above, we have only 6 to work with, anything after will be cropped.
28  */
29 enum {
30 	IP,
31 	IPV6,
32 	IPV6OP,	/* Destination/Hop-by-Hop Options IPv6 Extension header */
33 	IPV6FR,	/* Fragmentation IPv6 Extension Header */
34 	MPLS,
35 	VLAN,
36 };
37 
38 #define IP_MF		0x2000
39 #define IP_OFFSET	0x1FFF
40 #define IP6_MF		0x0001
41 #define IP6_OFFSET	0xFFF8
42 
43 struct vlan_hdr {
44 	__be16 h_vlan_TCI;
45 	__be16 h_vlan_encapsulated_proto;
46 };
47 
48 struct gre_hdr {
49 	__be16 flags;
50 	__be16 proto;
51 };
52 
53 struct frag_hdr {
54 	__u8 nexthdr;
55 	__u8 reserved;
56 	__be16 frag_off;
57 	__be32 identification;
58 };
59 
60 struct bpf_map_def SEC("maps") jmp_table = {
61 	.type = BPF_MAP_TYPE_PROG_ARRAY,
62 	.key_size = sizeof(__u32),
63 	.value_size = sizeof(__u32),
64 	.max_entries = 8
65 };
66 
67 struct bpf_map_def SEC("maps") last_dissection = {
68 	.type = BPF_MAP_TYPE_ARRAY,
69 	.key_size = sizeof(__u32),
70 	.value_size = sizeof(struct bpf_flow_keys),
71 	.max_entries = 1,
72 };
73 
74 static __always_inline int export_flow_keys(struct bpf_flow_keys *keys,
75 					    int ret)
76 {
77 	struct bpf_flow_keys *val;
78 	__u32 key = 0;
79 
80 	val = bpf_map_lookup_elem(&last_dissection, &key);
81 	if (val)
82 		memcpy(val, keys, sizeof(*val));
83 	return ret;
84 }
85 
86 static __always_inline void *bpf_flow_dissect_get_header(struct __sk_buff *skb,
87 							 __u16 hdr_size,
88 							 void *buffer)
89 {
90 	void *data_end = (void *)(long)skb->data_end;
91 	void *data = (void *)(long)skb->data;
92 	__u16 thoff = skb->flow_keys->thoff;
93 	__u8 *hdr;
94 
95 	/* Verifies this variable offset does not overflow */
96 	if (thoff > (USHRT_MAX - hdr_size))
97 		return NULL;
98 
99 	hdr = data + thoff;
100 	if (hdr + hdr_size <= data_end)
101 		return hdr;
102 
103 	if (bpf_skb_load_bytes(skb, thoff, buffer, hdr_size))
104 		return NULL;
105 
106 	return buffer;
107 }
108 
109 /* Dispatches on ETHERTYPE */
110 static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
111 {
112 	struct bpf_flow_keys *keys = skb->flow_keys;
113 
114 	switch (proto) {
115 	case bpf_htons(ETH_P_IP):
116 		bpf_tail_call(skb, &jmp_table, IP);
117 		break;
118 	case bpf_htons(ETH_P_IPV6):
119 		bpf_tail_call(skb, &jmp_table, IPV6);
120 		break;
121 	case bpf_htons(ETH_P_MPLS_MC):
122 	case bpf_htons(ETH_P_MPLS_UC):
123 		bpf_tail_call(skb, &jmp_table, MPLS);
124 		break;
125 	case bpf_htons(ETH_P_8021Q):
126 	case bpf_htons(ETH_P_8021AD):
127 		bpf_tail_call(skb, &jmp_table, VLAN);
128 		break;
129 	default:
130 		/* Protocol not supported */
131 		return export_flow_keys(keys, BPF_DROP);
132 	}
133 
134 	return export_flow_keys(keys, BPF_DROP);
135 }
136 
137 SEC("flow_dissector")
138 int _dissect(struct __sk_buff *skb)
139 {
140 	struct bpf_flow_keys *keys = skb->flow_keys;
141 
142 	return parse_eth_proto(skb, keys->n_proto);
143 }
144 
145 /* Parses on IPPROTO_* */
146 static __always_inline int parse_ip_proto(struct __sk_buff *skb, __u8 proto)
147 {
148 	struct bpf_flow_keys *keys = skb->flow_keys;
149 	void *data_end = (void *)(long)skb->data_end;
150 	struct icmphdr *icmp, _icmp;
151 	struct gre_hdr *gre, _gre;
152 	struct ethhdr *eth, _eth;
153 	struct tcphdr *tcp, _tcp;
154 	struct udphdr *udp, _udp;
155 
156 	keys->ip_proto = proto;
157 	switch (proto) {
158 	case IPPROTO_ICMP:
159 		icmp = bpf_flow_dissect_get_header(skb, sizeof(*icmp), &_icmp);
160 		if (!icmp)
161 			return export_flow_keys(keys, BPF_DROP);
162 		return export_flow_keys(keys, BPF_OK);
163 	case IPPROTO_IPIP:
164 		keys->is_encap = true;
165 		return parse_eth_proto(skb, bpf_htons(ETH_P_IP));
166 	case IPPROTO_IPV6:
167 		keys->is_encap = true;
168 		return parse_eth_proto(skb, bpf_htons(ETH_P_IPV6));
169 	case IPPROTO_GRE:
170 		gre = bpf_flow_dissect_get_header(skb, sizeof(*gre), &_gre);
171 		if (!gre)
172 			return export_flow_keys(keys, BPF_DROP);
173 
174 		if (bpf_htons(gre->flags & GRE_VERSION))
175 			/* Only inspect standard GRE packets with version 0 */
176 			return export_flow_keys(keys, BPF_OK);
177 
178 		keys->thoff += sizeof(*gre); /* Step over GRE Flags and Proto */
179 		if (GRE_IS_CSUM(gre->flags))
180 			keys->thoff += 4; /* Step over chksum and Padding */
181 		if (GRE_IS_KEY(gre->flags))
182 			keys->thoff += 4; /* Step over key */
183 		if (GRE_IS_SEQ(gre->flags))
184 			keys->thoff += 4; /* Step over sequence number */
185 
186 		keys->is_encap = true;
187 
188 		if (gre->proto == bpf_htons(ETH_P_TEB)) {
189 			eth = bpf_flow_dissect_get_header(skb, sizeof(*eth),
190 							  &_eth);
191 			if (!eth)
192 				return export_flow_keys(keys, BPF_DROP);
193 
194 			keys->thoff += sizeof(*eth);
195 
196 			return parse_eth_proto(skb, eth->h_proto);
197 		} else {
198 			return parse_eth_proto(skb, gre->proto);
199 		}
200 	case IPPROTO_TCP:
201 		tcp = bpf_flow_dissect_get_header(skb, sizeof(*tcp), &_tcp);
202 		if (!tcp)
203 			return export_flow_keys(keys, BPF_DROP);
204 
205 		if (tcp->doff < 5)
206 			return export_flow_keys(keys, BPF_DROP);
207 
208 		if ((__u8 *)tcp + (tcp->doff << 2) > data_end)
209 			return export_flow_keys(keys, BPF_DROP);
210 
211 		keys->sport = tcp->source;
212 		keys->dport = tcp->dest;
213 		return export_flow_keys(keys, BPF_OK);
214 	case IPPROTO_UDP:
215 	case IPPROTO_UDPLITE:
216 		udp = bpf_flow_dissect_get_header(skb, sizeof(*udp), &_udp);
217 		if (!udp)
218 			return export_flow_keys(keys, BPF_DROP);
219 
220 		keys->sport = udp->source;
221 		keys->dport = udp->dest;
222 		return export_flow_keys(keys, BPF_OK);
223 	default:
224 		return export_flow_keys(keys, BPF_DROP);
225 	}
226 
227 	return export_flow_keys(keys, BPF_DROP);
228 }
229 
230 static __always_inline int parse_ipv6_proto(struct __sk_buff *skb, __u8 nexthdr)
231 {
232 	struct bpf_flow_keys *keys = skb->flow_keys;
233 
234 	keys->ip_proto = nexthdr;
235 	switch (nexthdr) {
236 	case IPPROTO_HOPOPTS:
237 	case IPPROTO_DSTOPTS:
238 		bpf_tail_call(skb, &jmp_table, IPV6OP);
239 		break;
240 	case IPPROTO_FRAGMENT:
241 		bpf_tail_call(skb, &jmp_table, IPV6FR);
242 		break;
243 	default:
244 		return parse_ip_proto(skb, nexthdr);
245 	}
246 
247 	return export_flow_keys(keys, BPF_DROP);
248 }
249 
250 PROG(IP)(struct __sk_buff *skb)
251 {
252 	void *data_end = (void *)(long)skb->data_end;
253 	struct bpf_flow_keys *keys = skb->flow_keys;
254 	void *data = (void *)(long)skb->data;
255 	struct iphdr *iph, _iph;
256 	bool done = false;
257 
258 	iph = bpf_flow_dissect_get_header(skb, sizeof(*iph), &_iph);
259 	if (!iph)
260 		return export_flow_keys(keys, BPF_DROP);
261 
262 	/* IP header cannot be smaller than 20 bytes */
263 	if (iph->ihl < 5)
264 		return export_flow_keys(keys, BPF_DROP);
265 
266 	keys->addr_proto = ETH_P_IP;
267 	keys->ipv4_src = iph->saddr;
268 	keys->ipv4_dst = iph->daddr;
269 
270 	keys->thoff += iph->ihl << 2;
271 	if (data + keys->thoff > data_end)
272 		return export_flow_keys(keys, BPF_DROP);
273 
274 	if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET)) {
275 		keys->is_frag = true;
276 		if (iph->frag_off & bpf_htons(IP_OFFSET))
277 			/* From second fragment on, packets do not have headers
278 			 * we can parse.
279 			 */
280 			done = true;
281 		else
282 			keys->is_first_frag = true;
283 	}
284 
285 	if (done)
286 		return export_flow_keys(keys, BPF_OK);
287 
288 	return parse_ip_proto(skb, iph->protocol);
289 }
290 
291 PROG(IPV6)(struct __sk_buff *skb)
292 {
293 	struct bpf_flow_keys *keys = skb->flow_keys;
294 	struct ipv6hdr *ip6h, _ip6h;
295 
296 	ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
297 	if (!ip6h)
298 		return export_flow_keys(keys, BPF_DROP);
299 
300 	keys->addr_proto = ETH_P_IPV6;
301 	memcpy(&keys->ipv6_src, &ip6h->saddr, 2*sizeof(ip6h->saddr));
302 
303 	keys->thoff += sizeof(struct ipv6hdr);
304 
305 	return parse_ipv6_proto(skb, ip6h->nexthdr);
306 }
307 
308 PROG(IPV6OP)(struct __sk_buff *skb)
309 {
310 	struct bpf_flow_keys *keys = skb->flow_keys;
311 	struct ipv6_opt_hdr *ip6h, _ip6h;
312 
313 	ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
314 	if (!ip6h)
315 		return export_flow_keys(keys, BPF_DROP);
316 
317 	/* hlen is in 8-octets and does not include the first 8 bytes
318 	 * of the header
319 	 */
320 	skb->flow_keys->thoff += (1 + ip6h->hdrlen) << 3;
321 
322 	return parse_ipv6_proto(skb, ip6h->nexthdr);
323 }
324 
325 PROG(IPV6FR)(struct __sk_buff *skb)
326 {
327 	struct bpf_flow_keys *keys = skb->flow_keys;
328 	struct frag_hdr *fragh, _fragh;
329 
330 	fragh = bpf_flow_dissect_get_header(skb, sizeof(*fragh), &_fragh);
331 	if (!fragh)
332 		return export_flow_keys(keys, BPF_DROP);
333 
334 	keys->thoff += sizeof(*fragh);
335 	keys->is_frag = true;
336 	if (!(fragh->frag_off & bpf_htons(IP6_OFFSET)))
337 		keys->is_first_frag = true;
338 
339 	return parse_ipv6_proto(skb, fragh->nexthdr);
340 }
341 
342 PROG(MPLS)(struct __sk_buff *skb)
343 {
344 	struct bpf_flow_keys *keys = skb->flow_keys;
345 	struct mpls_label *mpls, _mpls;
346 
347 	mpls = bpf_flow_dissect_get_header(skb, sizeof(*mpls), &_mpls);
348 	if (!mpls)
349 		return export_flow_keys(keys, BPF_DROP);
350 
351 	return export_flow_keys(keys, BPF_OK);
352 }
353 
354 PROG(VLAN)(struct __sk_buff *skb)
355 {
356 	struct bpf_flow_keys *keys = skb->flow_keys;
357 	struct vlan_hdr *vlan, _vlan;
358 
359 	/* Account for double-tagging */
360 	if (keys->n_proto == bpf_htons(ETH_P_8021AD)) {
361 		vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
362 		if (!vlan)
363 			return export_flow_keys(keys, BPF_DROP);
364 
365 		if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q))
366 			return export_flow_keys(keys, BPF_DROP);
367 
368 		keys->nhoff += sizeof(*vlan);
369 		keys->thoff += sizeof(*vlan);
370 	}
371 
372 	vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
373 	if (!vlan)
374 		return export_flow_keys(keys, BPF_DROP);
375 
376 	keys->nhoff += sizeof(*vlan);
377 	keys->thoff += sizeof(*vlan);
378 	/* Only allow 8021AD + 8021Q double tagging and no triple tagging.*/
379 	if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) ||
380 	    vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q))
381 		return export_flow_keys(keys, BPF_DROP);
382 
383 	keys->n_proto = vlan->h_vlan_encapsulated_proto;
384 	return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto);
385 }
386 
387 char __license[] SEC("license") = "GPL";
388