1bd4aed0eSJiong Wang // SPDX-License-Identifier: GPL-2.0
2bd4aed0eSJiong Wang // Copyright (c) 2017 Facebook
3bd4aed0eSJiong Wang #include <stddef.h>
4bd4aed0eSJiong Wang #include <stdbool.h>
5bd4aed0eSJiong Wang #include <string.h>
6bd4aed0eSJiong Wang #include <linux/pkt_cls.h>
7bd4aed0eSJiong Wang #include <linux/bpf.h>
8bd4aed0eSJiong Wang #include <linux/in.h>
9bd4aed0eSJiong Wang #include <linux/if_ether.h>
10bd4aed0eSJiong Wang #include <linux/ip.h>
11bd4aed0eSJiong Wang #include <linux/ipv6.h>
12bd4aed0eSJiong Wang #include <linux/icmp.h>
13bd4aed0eSJiong Wang #include <linux/icmpv6.h>
14bd4aed0eSJiong Wang #include <linux/tcp.h>
15bd4aed0eSJiong Wang #include <linux/udp.h>
163e689141SToke Høiland-Jørgensen #include <bpf/bpf_helpers.h>
17bd4aed0eSJiong Wang #include "test_iptunnel_common.h"
183e689141SToke Høiland-Jørgensen #include <bpf/bpf_endian.h>
19bd4aed0eSJiong Wang
rol32(__u32 word,unsigned int shift)20fab45be1SAndrii Nakryiko static __always_inline __u32 rol32(__u32 word, unsigned int shift)
21bd4aed0eSJiong Wang {
22bd4aed0eSJiong Wang return (word << shift) | (word >> ((-shift) & 31));
23bd4aed0eSJiong Wang }
24bd4aed0eSJiong Wang
25bd4aed0eSJiong Wang /* copy paste of jhash from kernel sources to make sure llvm
26bd4aed0eSJiong Wang * can compile it into valid sequence of bpf instructions
27bd4aed0eSJiong Wang */
28bd4aed0eSJiong Wang #define __jhash_mix(a, b, c) \
29bd4aed0eSJiong Wang { \
30bd4aed0eSJiong Wang a -= c; a ^= rol32(c, 4); c += b; \
31bd4aed0eSJiong Wang b -= a; b ^= rol32(a, 6); a += c; \
32bd4aed0eSJiong Wang c -= b; c ^= rol32(b, 8); b += a; \
33bd4aed0eSJiong Wang a -= c; a ^= rol32(c, 16); c += b; \
34bd4aed0eSJiong Wang b -= a; b ^= rol32(a, 19); a += c; \
35bd4aed0eSJiong Wang c -= b; c ^= rol32(b, 4); b += a; \
36bd4aed0eSJiong Wang }
37bd4aed0eSJiong Wang
38bd4aed0eSJiong Wang #define __jhash_final(a, b, c) \
39bd4aed0eSJiong Wang { \
40bd4aed0eSJiong Wang c ^= b; c -= rol32(b, 14); \
41bd4aed0eSJiong Wang a ^= c; a -= rol32(c, 11); \
42bd4aed0eSJiong Wang b ^= a; b -= rol32(a, 25); \
43bd4aed0eSJiong Wang c ^= b; c -= rol32(b, 16); \
44bd4aed0eSJiong Wang a ^= c; a -= rol32(c, 4); \
45bd4aed0eSJiong Wang b ^= a; b -= rol32(a, 14); \
46bd4aed0eSJiong Wang c ^= b; c -= rol32(b, 24); \
47bd4aed0eSJiong Wang }
48bd4aed0eSJiong Wang
49bd4aed0eSJiong Wang #define JHASH_INITVAL 0xdeadbeef
50bd4aed0eSJiong Wang
51bd4aed0eSJiong Wang typedef unsigned int u32;
52bd4aed0eSJiong Wang
jhash(const void * key,u32 length,u32 initval)53fab45be1SAndrii Nakryiko static __noinline u32 jhash(const void *key, u32 length, u32 initval)
54bd4aed0eSJiong Wang {
55bd4aed0eSJiong Wang u32 a, b, c;
56bd4aed0eSJiong Wang const unsigned char *k = key;
57bd4aed0eSJiong Wang
58bd4aed0eSJiong Wang a = b = c = JHASH_INITVAL + length + initval;
59bd4aed0eSJiong Wang
60bd4aed0eSJiong Wang while (length > 12) {
61bd4aed0eSJiong Wang a += *(u32 *)(k);
62bd4aed0eSJiong Wang b += *(u32 *)(k + 4);
63bd4aed0eSJiong Wang c += *(u32 *)(k + 8);
64bd4aed0eSJiong Wang __jhash_mix(a, b, c);
65bd4aed0eSJiong Wang length -= 12;
66bd4aed0eSJiong Wang k += 12;
67bd4aed0eSJiong Wang }
68bd4aed0eSJiong Wang switch (length) {
69bd4aed0eSJiong Wang case 12: c += (u32)k[11]<<24;
70bd4aed0eSJiong Wang case 11: c += (u32)k[10]<<16;
71bd4aed0eSJiong Wang case 10: c += (u32)k[9]<<8;
72bd4aed0eSJiong Wang case 9: c += k[8];
73bd4aed0eSJiong Wang case 8: b += (u32)k[7]<<24;
74bd4aed0eSJiong Wang case 7: b += (u32)k[6]<<16;
75bd4aed0eSJiong Wang case 6: b += (u32)k[5]<<8;
76bd4aed0eSJiong Wang case 5: b += k[4];
77bd4aed0eSJiong Wang case 4: a += (u32)k[3]<<24;
78bd4aed0eSJiong Wang case 3: a += (u32)k[2]<<16;
79bd4aed0eSJiong Wang case 2: a += (u32)k[1]<<8;
80bd4aed0eSJiong Wang case 1: a += k[0];
81bd4aed0eSJiong Wang __jhash_final(a, b, c);
82bd4aed0eSJiong Wang case 0: /* Nothing left to add */
83bd4aed0eSJiong Wang break;
84bd4aed0eSJiong Wang }
85bd4aed0eSJiong Wang
86bd4aed0eSJiong Wang return c;
87bd4aed0eSJiong Wang }
88bd4aed0eSJiong Wang
__jhash_nwords(u32 a,u32 b,u32 c,u32 initval)89fab45be1SAndrii Nakryiko static __noinline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval)
90bd4aed0eSJiong Wang {
91bd4aed0eSJiong Wang a += initval;
92bd4aed0eSJiong Wang b += initval;
93bd4aed0eSJiong Wang c += initval;
94bd4aed0eSJiong Wang __jhash_final(a, b, c);
95bd4aed0eSJiong Wang return c;
96bd4aed0eSJiong Wang }
97bd4aed0eSJiong Wang
jhash_2words(u32 a,u32 b,u32 initval)98fab45be1SAndrii Nakryiko static __noinline u32 jhash_2words(u32 a, u32 b, u32 initval)
99bd4aed0eSJiong Wang {
100bd4aed0eSJiong Wang return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2));
101bd4aed0eSJiong Wang }
102bd4aed0eSJiong Wang
103bd4aed0eSJiong Wang #define PCKT_FRAGMENTED 65343
104bd4aed0eSJiong Wang #define IPV4_HDR_LEN_NO_OPT 20
105bd4aed0eSJiong Wang #define IPV4_PLUS_ICMP_HDR 28
106bd4aed0eSJiong Wang #define IPV6_PLUS_ICMP_HDR 48
107bd4aed0eSJiong Wang #define RING_SIZE 2
108bd4aed0eSJiong Wang #define MAX_VIPS 12
109bd4aed0eSJiong Wang #define MAX_REALS 5
110bd4aed0eSJiong Wang #define CTL_MAP_SIZE 16
111bd4aed0eSJiong Wang #define CH_RINGS_SIZE (MAX_VIPS * RING_SIZE)
112bd4aed0eSJiong Wang #define F_IPV6 (1 << 0)
113bd4aed0eSJiong Wang #define F_HASH_NO_SRC_PORT (1 << 0)
114bd4aed0eSJiong Wang #define F_ICMP (1 << 0)
115bd4aed0eSJiong Wang #define F_SYN_SET (1 << 1)
116bd4aed0eSJiong Wang
117bd4aed0eSJiong Wang struct packet_description {
118bd4aed0eSJiong Wang union {
119bd4aed0eSJiong Wang __be32 src;
120bd4aed0eSJiong Wang __be32 srcv6[4];
121bd4aed0eSJiong Wang };
122bd4aed0eSJiong Wang union {
123bd4aed0eSJiong Wang __be32 dst;
124bd4aed0eSJiong Wang __be32 dstv6[4];
125bd4aed0eSJiong Wang };
126bd4aed0eSJiong Wang union {
127bd4aed0eSJiong Wang __u32 ports;
128bd4aed0eSJiong Wang __u16 port16[2];
129bd4aed0eSJiong Wang };
130bd4aed0eSJiong Wang __u8 proto;
131bd4aed0eSJiong Wang __u8 flags;
132bd4aed0eSJiong Wang };
133bd4aed0eSJiong Wang
134bd4aed0eSJiong Wang struct ctl_value {
135bd4aed0eSJiong Wang union {
136bd4aed0eSJiong Wang __u64 value;
137bd4aed0eSJiong Wang __u32 ifindex;
138bd4aed0eSJiong Wang __u8 mac[6];
139bd4aed0eSJiong Wang };
140bd4aed0eSJiong Wang };
141bd4aed0eSJiong Wang
142bd4aed0eSJiong Wang struct vip_meta {
143bd4aed0eSJiong Wang __u32 flags;
144bd4aed0eSJiong Wang __u32 vip_num;
145bd4aed0eSJiong Wang };
146bd4aed0eSJiong Wang
147bd4aed0eSJiong Wang struct real_definition {
148bd4aed0eSJiong Wang union {
149bd4aed0eSJiong Wang __be32 dst;
150bd4aed0eSJiong Wang __be32 dstv6[4];
151bd4aed0eSJiong Wang };
152bd4aed0eSJiong Wang __u8 flags;
153bd4aed0eSJiong Wang };
154bd4aed0eSJiong Wang
155bd4aed0eSJiong Wang struct vip_stats {
156bd4aed0eSJiong Wang __u64 bytes;
157bd4aed0eSJiong Wang __u64 pkts;
158bd4aed0eSJiong Wang };
159bd4aed0eSJiong Wang
160bd4aed0eSJiong Wang struct eth_hdr {
161bd4aed0eSJiong Wang unsigned char eth_dest[ETH_ALEN];
162bd4aed0eSJiong Wang unsigned char eth_source[ETH_ALEN];
163bd4aed0eSJiong Wang unsigned short eth_proto;
164bd4aed0eSJiong Wang };
165bd4aed0eSJiong Wang
166df0b7792SAndrii Nakryiko struct {
167bc7430ccSAndrii Nakryiko __uint(type, BPF_MAP_TYPE_HASH);
168bc7430ccSAndrii Nakryiko __uint(max_entries, MAX_VIPS);
169bc7430ccSAndrii Nakryiko __type(key, struct vip);
170bc7430ccSAndrii Nakryiko __type(value, struct vip_meta);
171bc7430ccSAndrii Nakryiko } vip_map SEC(".maps");
172bd4aed0eSJiong Wang
173df0b7792SAndrii Nakryiko struct {
174bc7430ccSAndrii Nakryiko __uint(type, BPF_MAP_TYPE_ARRAY);
175bc7430ccSAndrii Nakryiko __uint(max_entries, CH_RINGS_SIZE);
176bc7430ccSAndrii Nakryiko __type(key, __u32);
177bc7430ccSAndrii Nakryiko __type(value, __u32);
178bc7430ccSAndrii Nakryiko } ch_rings SEC(".maps");
179bd4aed0eSJiong Wang
180df0b7792SAndrii Nakryiko struct {
181bc7430ccSAndrii Nakryiko __uint(type, BPF_MAP_TYPE_ARRAY);
182bc7430ccSAndrii Nakryiko __uint(max_entries, MAX_REALS);
183bc7430ccSAndrii Nakryiko __type(key, __u32);
184bc7430ccSAndrii Nakryiko __type(value, struct real_definition);
185bc7430ccSAndrii Nakryiko } reals SEC(".maps");
186bd4aed0eSJiong Wang
187df0b7792SAndrii Nakryiko struct {
188bc7430ccSAndrii Nakryiko __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
189bc7430ccSAndrii Nakryiko __uint(max_entries, MAX_VIPS);
190bc7430ccSAndrii Nakryiko __type(key, __u32);
191bc7430ccSAndrii Nakryiko __type(value, struct vip_stats);
192bc7430ccSAndrii Nakryiko } stats SEC(".maps");
193bd4aed0eSJiong Wang
194df0b7792SAndrii Nakryiko struct {
195bc7430ccSAndrii Nakryiko __uint(type, BPF_MAP_TYPE_ARRAY);
196bc7430ccSAndrii Nakryiko __uint(max_entries, CTL_MAP_SIZE);
197bc7430ccSAndrii Nakryiko __type(key, __u32);
198bc7430ccSAndrii Nakryiko __type(value, struct ctl_value);
199bc7430ccSAndrii Nakryiko } ctl_array SEC(".maps");
200bd4aed0eSJiong Wang
get_packet_hash(struct packet_description * pckt,bool ipv6)201fab45be1SAndrii Nakryiko static __noinline __u32 get_packet_hash(struct packet_description *pckt, bool ipv6)
202bd4aed0eSJiong Wang {
203bd4aed0eSJiong Wang if (ipv6)
204bd4aed0eSJiong Wang return jhash_2words(jhash(pckt->srcv6, 16, MAX_VIPS),
205bd4aed0eSJiong Wang pckt->ports, CH_RINGS_SIZE);
206bd4aed0eSJiong Wang else
207bd4aed0eSJiong Wang return jhash_2words(pckt->src, pckt->ports, CH_RINGS_SIZE);
208bd4aed0eSJiong Wang }
209bd4aed0eSJiong Wang
get_packet_dst(struct real_definition ** real,struct packet_description * pckt,struct vip_meta * vip_info,bool is_ipv6)210fab45be1SAndrii Nakryiko static __noinline bool get_packet_dst(struct real_definition **real,
211bd4aed0eSJiong Wang struct packet_description *pckt,
212bd4aed0eSJiong Wang struct vip_meta *vip_info,
213bd4aed0eSJiong Wang bool is_ipv6)
214bd4aed0eSJiong Wang {
215bd4aed0eSJiong Wang __u32 hash = get_packet_hash(pckt, is_ipv6);
216bd4aed0eSJiong Wang __u32 key = RING_SIZE * vip_info->vip_num + hash % RING_SIZE;
217bd4aed0eSJiong Wang __u32 *real_pos;
218bd4aed0eSJiong Wang
219bd4aed0eSJiong Wang if (hash != 0x358459b7 /* jhash of ipv4 packet */ &&
220bd4aed0eSJiong Wang hash != 0x2f4bc6bb /* jhash of ipv6 packet */)
221*f6d60facSHaowen Bai return false;
222bd4aed0eSJiong Wang
223bd4aed0eSJiong Wang real_pos = bpf_map_lookup_elem(&ch_rings, &key);
224bd4aed0eSJiong Wang if (!real_pos)
225bd4aed0eSJiong Wang return false;
226bd4aed0eSJiong Wang key = *real_pos;
227bd4aed0eSJiong Wang *real = bpf_map_lookup_elem(&reals, &key);
228bd4aed0eSJiong Wang if (!(*real))
229bd4aed0eSJiong Wang return false;
230bd4aed0eSJiong Wang return true;
231bd4aed0eSJiong Wang }
232bd4aed0eSJiong Wang
parse_icmpv6(void * data,void * data_end,__u64 off,struct packet_description * pckt)233fab45be1SAndrii Nakryiko static __noinline int parse_icmpv6(void *data, void *data_end, __u64 off,
234bd4aed0eSJiong Wang struct packet_description *pckt)
235bd4aed0eSJiong Wang {
236bd4aed0eSJiong Wang struct icmp6hdr *icmp_hdr;
237bd4aed0eSJiong Wang struct ipv6hdr *ip6h;
238bd4aed0eSJiong Wang
239bd4aed0eSJiong Wang icmp_hdr = data + off;
240bd4aed0eSJiong Wang if (icmp_hdr + 1 > data_end)
241bd4aed0eSJiong Wang return TC_ACT_SHOT;
242bd4aed0eSJiong Wang if (icmp_hdr->icmp6_type != ICMPV6_PKT_TOOBIG)
243bd4aed0eSJiong Wang return TC_ACT_OK;
244bd4aed0eSJiong Wang off += sizeof(struct icmp6hdr);
245bd4aed0eSJiong Wang ip6h = data + off;
246bd4aed0eSJiong Wang if (ip6h + 1 > data_end)
247bd4aed0eSJiong Wang return TC_ACT_SHOT;
248bd4aed0eSJiong Wang pckt->proto = ip6h->nexthdr;
249bd4aed0eSJiong Wang pckt->flags |= F_ICMP;
250bd4aed0eSJiong Wang memcpy(pckt->srcv6, ip6h->daddr.s6_addr32, 16);
251bd4aed0eSJiong Wang memcpy(pckt->dstv6, ip6h->saddr.s6_addr32, 16);
252bd4aed0eSJiong Wang return TC_ACT_UNSPEC;
253bd4aed0eSJiong Wang }
254bd4aed0eSJiong Wang
parse_icmp(void * data,void * data_end,__u64 off,struct packet_description * pckt)255fab45be1SAndrii Nakryiko static __noinline int parse_icmp(void *data, void *data_end, __u64 off,
256bd4aed0eSJiong Wang struct packet_description *pckt)
257bd4aed0eSJiong Wang {
258bd4aed0eSJiong Wang struct icmphdr *icmp_hdr;
259bd4aed0eSJiong Wang struct iphdr *iph;
260bd4aed0eSJiong Wang
261bd4aed0eSJiong Wang icmp_hdr = data + off;
262bd4aed0eSJiong Wang if (icmp_hdr + 1 > data_end)
263bd4aed0eSJiong Wang return TC_ACT_SHOT;
264bd4aed0eSJiong Wang if (icmp_hdr->type != ICMP_DEST_UNREACH ||
265bd4aed0eSJiong Wang icmp_hdr->code != ICMP_FRAG_NEEDED)
266bd4aed0eSJiong Wang return TC_ACT_OK;
267bd4aed0eSJiong Wang off += sizeof(struct icmphdr);
268bd4aed0eSJiong Wang iph = data + off;
269bd4aed0eSJiong Wang if (iph + 1 > data_end)
270bd4aed0eSJiong Wang return TC_ACT_SHOT;
271bd4aed0eSJiong Wang if (iph->ihl != 5)
272bd4aed0eSJiong Wang return TC_ACT_SHOT;
273bd4aed0eSJiong Wang pckt->proto = iph->protocol;
274bd4aed0eSJiong Wang pckt->flags |= F_ICMP;
275bd4aed0eSJiong Wang pckt->src = iph->daddr;
276bd4aed0eSJiong Wang pckt->dst = iph->saddr;
277bd4aed0eSJiong Wang return TC_ACT_UNSPEC;
278bd4aed0eSJiong Wang }
279bd4aed0eSJiong Wang
parse_udp(void * data,__u64 off,void * data_end,struct packet_description * pckt)280fab45be1SAndrii Nakryiko static __noinline bool parse_udp(void *data, __u64 off, void *data_end,
281bd4aed0eSJiong Wang struct packet_description *pckt)
282bd4aed0eSJiong Wang {
283bd4aed0eSJiong Wang struct udphdr *udp;
284bd4aed0eSJiong Wang udp = data + off;
285bd4aed0eSJiong Wang
286bd4aed0eSJiong Wang if (udp + 1 > data_end)
287bd4aed0eSJiong Wang return false;
288bd4aed0eSJiong Wang
289bd4aed0eSJiong Wang if (!(pckt->flags & F_ICMP)) {
290bd4aed0eSJiong Wang pckt->port16[0] = udp->source;
291bd4aed0eSJiong Wang pckt->port16[1] = udp->dest;
292bd4aed0eSJiong Wang } else {
293bd4aed0eSJiong Wang pckt->port16[0] = udp->dest;
294bd4aed0eSJiong Wang pckt->port16[1] = udp->source;
295bd4aed0eSJiong Wang }
296bd4aed0eSJiong Wang return true;
297bd4aed0eSJiong Wang }
298bd4aed0eSJiong Wang
parse_tcp(void * data,__u64 off,void * data_end,struct packet_description * pckt)299fab45be1SAndrii Nakryiko static __noinline bool parse_tcp(void *data, __u64 off, void *data_end,
300bd4aed0eSJiong Wang struct packet_description *pckt)
301bd4aed0eSJiong Wang {
302bd4aed0eSJiong Wang struct tcphdr *tcp;
303bd4aed0eSJiong Wang
304bd4aed0eSJiong Wang tcp = data + off;
305bd4aed0eSJiong Wang if (tcp + 1 > data_end)
306bd4aed0eSJiong Wang return false;
307bd4aed0eSJiong Wang
308bd4aed0eSJiong Wang if (tcp->syn)
309bd4aed0eSJiong Wang pckt->flags |= F_SYN_SET;
310bd4aed0eSJiong Wang
311bd4aed0eSJiong Wang if (!(pckt->flags & F_ICMP)) {
312bd4aed0eSJiong Wang pckt->port16[0] = tcp->source;
313bd4aed0eSJiong Wang pckt->port16[1] = tcp->dest;
314bd4aed0eSJiong Wang } else {
315bd4aed0eSJiong Wang pckt->port16[0] = tcp->dest;
316bd4aed0eSJiong Wang pckt->port16[1] = tcp->source;
317bd4aed0eSJiong Wang }
318bd4aed0eSJiong Wang return true;
319bd4aed0eSJiong Wang }
320bd4aed0eSJiong Wang
process_packet(void * data,__u64 off,void * data_end,bool is_ipv6,struct __sk_buff * skb)321fab45be1SAndrii Nakryiko static __noinline int process_packet(void *data, __u64 off, void *data_end,
322bd4aed0eSJiong Wang bool is_ipv6, struct __sk_buff *skb)
323bd4aed0eSJiong Wang {
324bd4aed0eSJiong Wang void *pkt_start = (void *)(long)skb->data;
325bd4aed0eSJiong Wang struct packet_description pckt = {};
326bd4aed0eSJiong Wang struct eth_hdr *eth = pkt_start;
327bd4aed0eSJiong Wang struct bpf_tunnel_key tkey = {};
328bd4aed0eSJiong Wang struct vip_stats *data_stats;
329bd4aed0eSJiong Wang struct real_definition *dst;
330bd4aed0eSJiong Wang struct vip_meta *vip_info;
331bd4aed0eSJiong Wang struct ctl_value *cval;
332bd4aed0eSJiong Wang __u32 v4_intf_pos = 1;
333bd4aed0eSJiong Wang __u32 v6_intf_pos = 2;
334bd4aed0eSJiong Wang struct ipv6hdr *ip6h;
335bd4aed0eSJiong Wang struct vip vip = {};
336bd4aed0eSJiong Wang struct iphdr *iph;
337bd4aed0eSJiong Wang int tun_flag = 0;
338bd4aed0eSJiong Wang __u16 pkt_bytes;
339bd4aed0eSJiong Wang __u64 iph_len;
340bd4aed0eSJiong Wang __u32 ifindex;
341bd4aed0eSJiong Wang __u8 protocol;
342bd4aed0eSJiong Wang __u32 vip_num;
343bd4aed0eSJiong Wang int action;
344bd4aed0eSJiong Wang
345bd4aed0eSJiong Wang tkey.tunnel_ttl = 64;
346bd4aed0eSJiong Wang if (is_ipv6) {
347bd4aed0eSJiong Wang ip6h = data + off;
348bd4aed0eSJiong Wang if (ip6h + 1 > data_end)
349bd4aed0eSJiong Wang return TC_ACT_SHOT;
350bd4aed0eSJiong Wang
351bd4aed0eSJiong Wang iph_len = sizeof(struct ipv6hdr);
352bd4aed0eSJiong Wang protocol = ip6h->nexthdr;
353bd4aed0eSJiong Wang pckt.proto = protocol;
354bd4aed0eSJiong Wang pkt_bytes = bpf_ntohs(ip6h->payload_len);
355bd4aed0eSJiong Wang off += iph_len;
356bd4aed0eSJiong Wang if (protocol == IPPROTO_FRAGMENT) {
357bd4aed0eSJiong Wang return TC_ACT_SHOT;
358bd4aed0eSJiong Wang } else if (protocol == IPPROTO_ICMPV6) {
359bd4aed0eSJiong Wang action = parse_icmpv6(data, data_end, off, &pckt);
360bd4aed0eSJiong Wang if (action >= 0)
361bd4aed0eSJiong Wang return action;
362bd4aed0eSJiong Wang off += IPV6_PLUS_ICMP_HDR;
363bd4aed0eSJiong Wang } else {
364bd4aed0eSJiong Wang memcpy(pckt.srcv6, ip6h->saddr.s6_addr32, 16);
365bd4aed0eSJiong Wang memcpy(pckt.dstv6, ip6h->daddr.s6_addr32, 16);
366bd4aed0eSJiong Wang }
367bd4aed0eSJiong Wang } else {
368bd4aed0eSJiong Wang iph = data + off;
369bd4aed0eSJiong Wang if (iph + 1 > data_end)
370bd4aed0eSJiong Wang return TC_ACT_SHOT;
371bd4aed0eSJiong Wang if (iph->ihl != 5)
372bd4aed0eSJiong Wang return TC_ACT_SHOT;
373bd4aed0eSJiong Wang
374bd4aed0eSJiong Wang protocol = iph->protocol;
375bd4aed0eSJiong Wang pckt.proto = protocol;
376bd4aed0eSJiong Wang pkt_bytes = bpf_ntohs(iph->tot_len);
377bd4aed0eSJiong Wang off += IPV4_HDR_LEN_NO_OPT;
378bd4aed0eSJiong Wang
379bd4aed0eSJiong Wang if (iph->frag_off & PCKT_FRAGMENTED)
380bd4aed0eSJiong Wang return TC_ACT_SHOT;
381bd4aed0eSJiong Wang if (protocol == IPPROTO_ICMP) {
382bd4aed0eSJiong Wang action = parse_icmp(data, data_end, off, &pckt);
383bd4aed0eSJiong Wang if (action >= 0)
384bd4aed0eSJiong Wang return action;
385bd4aed0eSJiong Wang off += IPV4_PLUS_ICMP_HDR;
386bd4aed0eSJiong Wang } else {
387bd4aed0eSJiong Wang pckt.src = iph->saddr;
388bd4aed0eSJiong Wang pckt.dst = iph->daddr;
389bd4aed0eSJiong Wang }
390bd4aed0eSJiong Wang }
391bd4aed0eSJiong Wang protocol = pckt.proto;
392bd4aed0eSJiong Wang
393bd4aed0eSJiong Wang if (protocol == IPPROTO_TCP) {
394bd4aed0eSJiong Wang if (!parse_tcp(data, off, data_end, &pckt))
395bd4aed0eSJiong Wang return TC_ACT_SHOT;
396bd4aed0eSJiong Wang } else if (protocol == IPPROTO_UDP) {
397bd4aed0eSJiong Wang if (!parse_udp(data, off, data_end, &pckt))
398bd4aed0eSJiong Wang return TC_ACT_SHOT;
399bd4aed0eSJiong Wang } else {
400bd4aed0eSJiong Wang return TC_ACT_SHOT;
401bd4aed0eSJiong Wang }
402bd4aed0eSJiong Wang
403bd4aed0eSJiong Wang if (is_ipv6)
404bd4aed0eSJiong Wang memcpy(vip.daddr.v6, pckt.dstv6, 16);
405bd4aed0eSJiong Wang else
406bd4aed0eSJiong Wang vip.daddr.v4 = pckt.dst;
407bd4aed0eSJiong Wang
408bd4aed0eSJiong Wang vip.dport = pckt.port16[1];
409bd4aed0eSJiong Wang vip.protocol = pckt.proto;
410bd4aed0eSJiong Wang vip_info = bpf_map_lookup_elem(&vip_map, &vip);
411bd4aed0eSJiong Wang if (!vip_info) {
412bd4aed0eSJiong Wang vip.dport = 0;
413bd4aed0eSJiong Wang vip_info = bpf_map_lookup_elem(&vip_map, &vip);
414bd4aed0eSJiong Wang if (!vip_info)
415bd4aed0eSJiong Wang return TC_ACT_SHOT;
416bd4aed0eSJiong Wang pckt.port16[1] = 0;
417bd4aed0eSJiong Wang }
418bd4aed0eSJiong Wang
419bd4aed0eSJiong Wang if (vip_info->flags & F_HASH_NO_SRC_PORT)
420bd4aed0eSJiong Wang pckt.port16[0] = 0;
421bd4aed0eSJiong Wang
422bd4aed0eSJiong Wang if (!get_packet_dst(&dst, &pckt, vip_info, is_ipv6))
423bd4aed0eSJiong Wang return TC_ACT_SHOT;
424bd4aed0eSJiong Wang
425bd4aed0eSJiong Wang if (dst->flags & F_IPV6) {
426bd4aed0eSJiong Wang cval = bpf_map_lookup_elem(&ctl_array, &v6_intf_pos);
427bd4aed0eSJiong Wang if (!cval)
428bd4aed0eSJiong Wang return TC_ACT_SHOT;
429bd4aed0eSJiong Wang ifindex = cval->ifindex;
430bd4aed0eSJiong Wang memcpy(tkey.remote_ipv6, dst->dstv6, 16);
431bd4aed0eSJiong Wang tun_flag = BPF_F_TUNINFO_IPV6;
432bd4aed0eSJiong Wang } else {
433bd4aed0eSJiong Wang cval = bpf_map_lookup_elem(&ctl_array, &v4_intf_pos);
434bd4aed0eSJiong Wang if (!cval)
435bd4aed0eSJiong Wang return TC_ACT_SHOT;
436bd4aed0eSJiong Wang ifindex = cval->ifindex;
437bd4aed0eSJiong Wang tkey.remote_ipv4 = dst->dst;
438bd4aed0eSJiong Wang }
439bd4aed0eSJiong Wang vip_num = vip_info->vip_num;
440bd4aed0eSJiong Wang data_stats = bpf_map_lookup_elem(&stats, &vip_num);
441bd4aed0eSJiong Wang if (!data_stats)
442bd4aed0eSJiong Wang return TC_ACT_SHOT;
443bd4aed0eSJiong Wang data_stats->pkts++;
444bd4aed0eSJiong Wang data_stats->bytes += pkt_bytes;
445bd4aed0eSJiong Wang bpf_skb_set_tunnel_key(skb, &tkey, sizeof(tkey), tun_flag);
446bd4aed0eSJiong Wang *(u32 *)eth->eth_dest = tkey.remote_ipv4;
447bd4aed0eSJiong Wang return bpf_redirect(ifindex, 0);
448bd4aed0eSJiong Wang }
449bd4aed0eSJiong Wang
4503d1d6239SAndrii Nakryiko SEC("tc")
balancer_ingress(struct __sk_buff * ctx)451bd4aed0eSJiong Wang int balancer_ingress(struct __sk_buff *ctx)
452bd4aed0eSJiong Wang {
453bd4aed0eSJiong Wang void *data_end = (void *)(long)ctx->data_end;
454bd4aed0eSJiong Wang void *data = (void *)(long)ctx->data;
455bd4aed0eSJiong Wang struct eth_hdr *eth = data;
456bd4aed0eSJiong Wang __u32 eth_proto;
457bd4aed0eSJiong Wang __u32 nh_off;
458bd4aed0eSJiong Wang
459bd4aed0eSJiong Wang nh_off = sizeof(struct eth_hdr);
460bd4aed0eSJiong Wang if (data + nh_off > data_end)
461bd4aed0eSJiong Wang return TC_ACT_SHOT;
462bd4aed0eSJiong Wang eth_proto = eth->eth_proto;
463bd4aed0eSJiong Wang if (eth_proto == bpf_htons(ETH_P_IP))
464bd4aed0eSJiong Wang return process_packet(data, nh_off, data_end, false, ctx);
465bd4aed0eSJiong Wang else if (eth_proto == bpf_htons(ETH_P_IPV6))
466bd4aed0eSJiong Wang return process_packet(data, nh_off, data_end, true, ctx);
467bd4aed0eSJiong Wang else
468bd4aed0eSJiong Wang return TC_ACT_SHOT;
469bd4aed0eSJiong Wang }
470bd4aed0eSJiong Wang char _license[] SEC("license") = "GPL";
471