1 // SPDX-License-Identifier: GPL-2.0 2 #include <limits.h> 3 #include <stddef.h> 4 #include <stdbool.h> 5 #include <string.h> 6 #include <linux/pkt_cls.h> 7 #include <linux/bpf.h> 8 #include <linux/in.h> 9 #include <linux/if_ether.h> 10 #include <linux/icmp.h> 11 #include <linux/ip.h> 12 #include <linux/ipv6.h> 13 #include <linux/tcp.h> 14 #include <linux/udp.h> 15 #include <linux/if_packet.h> 16 #include <sys/socket.h> 17 #include <linux/if_tunnel.h> 18 #include <linux/mpls.h> 19 #include "bpf_helpers.h" 20 #include "bpf_endian.h" 21 22 int _version SEC("version") = 1; 23 #define PROG(F) SEC(#F) int bpf_func_##F 24 25 /* These are the identifiers of the BPF programs that will be used in tail 26 * calls. Name is limited to 16 characters, with the terminating character and 27 * bpf_func_ above, we have only 6 to work with, anything after will be cropped. 28 */ 29 enum { 30 IP, 31 IPV6, 32 IPV6OP, /* Destination/Hop-by-Hop Options IPv6 Extension header */ 33 IPV6FR, /* Fragmentation IPv6 Extension Header */ 34 MPLS, 35 VLAN, 36 }; 37 38 #define IP_MF 0x2000 39 #define IP_OFFSET 0x1FFF 40 #define IP6_MF 0x0001 41 #define IP6_OFFSET 0xFFF8 42 43 struct vlan_hdr { 44 __be16 h_vlan_TCI; 45 __be16 h_vlan_encapsulated_proto; 46 }; 47 48 struct gre_hdr { 49 __be16 flags; 50 __be16 proto; 51 }; 52 53 struct frag_hdr { 54 __u8 nexthdr; 55 __u8 reserved; 56 __be16 frag_off; 57 __be32 identification; 58 }; 59 60 struct bpf_map_def SEC("maps") jmp_table = { 61 .type = BPF_MAP_TYPE_PROG_ARRAY, 62 .key_size = sizeof(__u32), 63 .value_size = sizeof(__u32), 64 .max_entries = 8 65 }; 66 67 struct bpf_map_def SEC("maps") last_dissection = { 68 .type = BPF_MAP_TYPE_ARRAY, 69 .key_size = sizeof(__u32), 70 .value_size = sizeof(struct bpf_flow_keys), 71 .max_entries = 1, 72 }; 73 74 static __always_inline int export_flow_keys(struct bpf_flow_keys *keys, 75 int ret) 76 { 77 struct bpf_flow_keys *val; 78 __u32 key = 0; 79 80 val = bpf_map_lookup_elem(&last_dissection, &key); 81 if (val) 82 memcpy(val, keys, sizeof(*val)); 83 return ret; 84 } 85 86 static __always_inline void *bpf_flow_dissect_get_header(struct __sk_buff *skb, 87 __u16 hdr_size, 88 void *buffer) 89 { 90 void *data_end = (void *)(long)skb->data_end; 91 void *data = (void *)(long)skb->data; 92 __u16 thoff = skb->flow_keys->thoff; 93 __u8 *hdr; 94 95 /* Verifies this variable offset does not overflow */ 96 if (thoff > (USHRT_MAX - hdr_size)) 97 return NULL; 98 99 hdr = data + thoff; 100 if (hdr + hdr_size <= data_end) 101 return hdr; 102 103 if (bpf_skb_load_bytes(skb, thoff, buffer, hdr_size)) 104 return NULL; 105 106 return buffer; 107 } 108 109 /* Dispatches on ETHERTYPE */ 110 static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto) 111 { 112 struct bpf_flow_keys *keys = skb->flow_keys; 113 114 switch (proto) { 115 case bpf_htons(ETH_P_IP): 116 bpf_tail_call(skb, &jmp_table, IP); 117 break; 118 case bpf_htons(ETH_P_IPV6): 119 bpf_tail_call(skb, &jmp_table, IPV6); 120 break; 121 case bpf_htons(ETH_P_MPLS_MC): 122 case bpf_htons(ETH_P_MPLS_UC): 123 bpf_tail_call(skb, &jmp_table, MPLS); 124 break; 125 case bpf_htons(ETH_P_8021Q): 126 case bpf_htons(ETH_P_8021AD): 127 bpf_tail_call(skb, &jmp_table, VLAN); 128 break; 129 default: 130 /* Protocol not supported */ 131 return export_flow_keys(keys, BPF_DROP); 132 } 133 134 return export_flow_keys(keys, BPF_DROP); 135 } 136 137 SEC("flow_dissector") 138 int _dissect(struct __sk_buff *skb) 139 { 140 struct bpf_flow_keys *keys = skb->flow_keys; 141 142 return parse_eth_proto(skb, keys->n_proto); 143 } 144 145 /* Parses on IPPROTO_* */ 146 static __always_inline int parse_ip_proto(struct __sk_buff *skb, __u8 proto) 147 { 148 struct bpf_flow_keys *keys = skb->flow_keys; 149 void *data_end = (void *)(long)skb->data_end; 150 struct icmphdr *icmp, _icmp; 151 struct gre_hdr *gre, _gre; 152 struct ethhdr *eth, _eth; 153 struct tcphdr *tcp, _tcp; 154 struct udphdr *udp, _udp; 155 156 keys->ip_proto = proto; 157 switch (proto) { 158 case IPPROTO_ICMP: 159 icmp = bpf_flow_dissect_get_header(skb, sizeof(*icmp), &_icmp); 160 if (!icmp) 161 return export_flow_keys(keys, BPF_DROP); 162 return export_flow_keys(keys, BPF_OK); 163 case IPPROTO_IPIP: 164 keys->is_encap = true; 165 return parse_eth_proto(skb, bpf_htons(ETH_P_IP)); 166 case IPPROTO_IPV6: 167 keys->is_encap = true; 168 return parse_eth_proto(skb, bpf_htons(ETH_P_IPV6)); 169 case IPPROTO_GRE: 170 gre = bpf_flow_dissect_get_header(skb, sizeof(*gre), &_gre); 171 if (!gre) 172 return export_flow_keys(keys, BPF_DROP); 173 174 if (bpf_htons(gre->flags & GRE_VERSION)) 175 /* Only inspect standard GRE packets with version 0 */ 176 return export_flow_keys(keys, BPF_OK); 177 178 keys->thoff += sizeof(*gre); /* Step over GRE Flags and Proto */ 179 if (GRE_IS_CSUM(gre->flags)) 180 keys->thoff += 4; /* Step over chksum and Padding */ 181 if (GRE_IS_KEY(gre->flags)) 182 keys->thoff += 4; /* Step over key */ 183 if (GRE_IS_SEQ(gre->flags)) 184 keys->thoff += 4; /* Step over sequence number */ 185 186 keys->is_encap = true; 187 188 if (gre->proto == bpf_htons(ETH_P_TEB)) { 189 eth = bpf_flow_dissect_get_header(skb, sizeof(*eth), 190 &_eth); 191 if (!eth) 192 return export_flow_keys(keys, BPF_DROP); 193 194 keys->thoff += sizeof(*eth); 195 196 return parse_eth_proto(skb, eth->h_proto); 197 } else { 198 return parse_eth_proto(skb, gre->proto); 199 } 200 case IPPROTO_TCP: 201 tcp = bpf_flow_dissect_get_header(skb, sizeof(*tcp), &_tcp); 202 if (!tcp) 203 return export_flow_keys(keys, BPF_DROP); 204 205 if (tcp->doff < 5) 206 return export_flow_keys(keys, BPF_DROP); 207 208 if ((__u8 *)tcp + (tcp->doff << 2) > data_end) 209 return export_flow_keys(keys, BPF_DROP); 210 211 keys->sport = tcp->source; 212 keys->dport = tcp->dest; 213 return export_flow_keys(keys, BPF_OK); 214 case IPPROTO_UDP: 215 case IPPROTO_UDPLITE: 216 udp = bpf_flow_dissect_get_header(skb, sizeof(*udp), &_udp); 217 if (!udp) 218 return export_flow_keys(keys, BPF_DROP); 219 220 keys->sport = udp->source; 221 keys->dport = udp->dest; 222 return export_flow_keys(keys, BPF_OK); 223 default: 224 return export_flow_keys(keys, BPF_DROP); 225 } 226 227 return export_flow_keys(keys, BPF_DROP); 228 } 229 230 static __always_inline int parse_ipv6_proto(struct __sk_buff *skb, __u8 nexthdr) 231 { 232 struct bpf_flow_keys *keys = skb->flow_keys; 233 234 keys->ip_proto = nexthdr; 235 switch (nexthdr) { 236 case IPPROTO_HOPOPTS: 237 case IPPROTO_DSTOPTS: 238 bpf_tail_call(skb, &jmp_table, IPV6OP); 239 break; 240 case IPPROTO_FRAGMENT: 241 bpf_tail_call(skb, &jmp_table, IPV6FR); 242 break; 243 default: 244 return parse_ip_proto(skb, nexthdr); 245 } 246 247 return export_flow_keys(keys, BPF_DROP); 248 } 249 250 PROG(IP)(struct __sk_buff *skb) 251 { 252 void *data_end = (void *)(long)skb->data_end; 253 struct bpf_flow_keys *keys = skb->flow_keys; 254 void *data = (void *)(long)skb->data; 255 struct iphdr *iph, _iph; 256 bool done = false; 257 258 iph = bpf_flow_dissect_get_header(skb, sizeof(*iph), &_iph); 259 if (!iph) 260 return export_flow_keys(keys, BPF_DROP); 261 262 /* IP header cannot be smaller than 20 bytes */ 263 if (iph->ihl < 5) 264 return export_flow_keys(keys, BPF_DROP); 265 266 keys->addr_proto = ETH_P_IP; 267 keys->ipv4_src = iph->saddr; 268 keys->ipv4_dst = iph->daddr; 269 270 keys->thoff += iph->ihl << 2; 271 if (data + keys->thoff > data_end) 272 return export_flow_keys(keys, BPF_DROP); 273 274 if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET)) { 275 keys->is_frag = true; 276 if (iph->frag_off & bpf_htons(IP_OFFSET)) 277 /* From second fragment on, packets do not have headers 278 * we can parse. 279 */ 280 done = true; 281 else 282 keys->is_first_frag = true; 283 } 284 285 if (done) 286 return export_flow_keys(keys, BPF_OK); 287 288 return parse_ip_proto(skb, iph->protocol); 289 } 290 291 PROG(IPV6)(struct __sk_buff *skb) 292 { 293 struct bpf_flow_keys *keys = skb->flow_keys; 294 struct ipv6hdr *ip6h, _ip6h; 295 296 ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h); 297 if (!ip6h) 298 return export_flow_keys(keys, BPF_DROP); 299 300 keys->addr_proto = ETH_P_IPV6; 301 memcpy(&keys->ipv6_src, &ip6h->saddr, 2*sizeof(ip6h->saddr)); 302 303 keys->thoff += sizeof(struct ipv6hdr); 304 305 return parse_ipv6_proto(skb, ip6h->nexthdr); 306 } 307 308 PROG(IPV6OP)(struct __sk_buff *skb) 309 { 310 struct bpf_flow_keys *keys = skb->flow_keys; 311 struct ipv6_opt_hdr *ip6h, _ip6h; 312 313 ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h); 314 if (!ip6h) 315 return export_flow_keys(keys, BPF_DROP); 316 317 /* hlen is in 8-octets and does not include the first 8 bytes 318 * of the header 319 */ 320 skb->flow_keys->thoff += (1 + ip6h->hdrlen) << 3; 321 322 return parse_ipv6_proto(skb, ip6h->nexthdr); 323 } 324 325 PROG(IPV6FR)(struct __sk_buff *skb) 326 { 327 struct bpf_flow_keys *keys = skb->flow_keys; 328 struct frag_hdr *fragh, _fragh; 329 330 fragh = bpf_flow_dissect_get_header(skb, sizeof(*fragh), &_fragh); 331 if (!fragh) 332 return export_flow_keys(keys, BPF_DROP); 333 334 keys->thoff += sizeof(*fragh); 335 keys->is_frag = true; 336 if (!(fragh->frag_off & bpf_htons(IP6_OFFSET))) 337 keys->is_first_frag = true; 338 339 return parse_ipv6_proto(skb, fragh->nexthdr); 340 } 341 342 PROG(MPLS)(struct __sk_buff *skb) 343 { 344 struct bpf_flow_keys *keys = skb->flow_keys; 345 struct mpls_label *mpls, _mpls; 346 347 mpls = bpf_flow_dissect_get_header(skb, sizeof(*mpls), &_mpls); 348 if (!mpls) 349 return export_flow_keys(keys, BPF_DROP); 350 351 return export_flow_keys(keys, BPF_OK); 352 } 353 354 PROG(VLAN)(struct __sk_buff *skb) 355 { 356 struct bpf_flow_keys *keys = skb->flow_keys; 357 struct vlan_hdr *vlan, _vlan; 358 359 /* Account for double-tagging */ 360 if (keys->n_proto == bpf_htons(ETH_P_8021AD)) { 361 vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan); 362 if (!vlan) 363 return export_flow_keys(keys, BPF_DROP); 364 365 if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q)) 366 return export_flow_keys(keys, BPF_DROP); 367 368 keys->nhoff += sizeof(*vlan); 369 keys->thoff += sizeof(*vlan); 370 } 371 372 vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan); 373 if (!vlan) 374 return export_flow_keys(keys, BPF_DROP); 375 376 keys->nhoff += sizeof(*vlan); 377 keys->thoff += sizeof(*vlan); 378 /* Only allow 8021AD + 8021Q double tagging and no triple tagging.*/ 379 if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) || 380 vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q)) 381 return export_flow_keys(keys, BPF_DROP); 382 383 keys->n_proto = vlan->h_vlan_encapsulated_proto; 384 return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto); 385 } 386 387 char __license[] SEC("license") = "GPL"; 388