1*cfa7b011SJoanne Koong // SPDX-License-Identifier: GPL-2.0
2*cfa7b011SJoanne Koong // Copyright (c) 2017 Facebook
3*cfa7b011SJoanne Koong #include <stddef.h>
4*cfa7b011SJoanne Koong #include <stdbool.h>
5*cfa7b011SJoanne Koong #include <string.h>
6*cfa7b011SJoanne Koong #include <linux/pkt_cls.h>
7*cfa7b011SJoanne Koong #include <linux/bpf.h>
8*cfa7b011SJoanne Koong #include <linux/in.h>
9*cfa7b011SJoanne Koong #include <linux/if_ether.h>
10*cfa7b011SJoanne Koong #include <linux/ip.h>
11*cfa7b011SJoanne Koong #include <linux/ipv6.h>
12*cfa7b011SJoanne Koong #include <linux/icmp.h>
13*cfa7b011SJoanne Koong #include <linux/icmpv6.h>
14*cfa7b011SJoanne Koong #include <linux/tcp.h>
15*cfa7b011SJoanne Koong #include <linux/udp.h>
16*cfa7b011SJoanne Koong #include <bpf/bpf_helpers.h>
17*cfa7b011SJoanne Koong #include "test_iptunnel_common.h"
18*cfa7b011SJoanne Koong #include <bpf/bpf_endian.h>
19*cfa7b011SJoanne Koong
20*cfa7b011SJoanne Koong #include "bpf_kfuncs.h"
21*cfa7b011SJoanne Koong
rol32(__u32 word,unsigned int shift)22*cfa7b011SJoanne Koong static __always_inline __u32 rol32(__u32 word, unsigned int shift)
23*cfa7b011SJoanne Koong {
24*cfa7b011SJoanne Koong return (word << shift) | (word >> ((-shift) & 31));
25*cfa7b011SJoanne Koong }
26*cfa7b011SJoanne Koong
27*cfa7b011SJoanne Koong /* copy paste of jhash from kernel sources to make sure llvm
28*cfa7b011SJoanne Koong * can compile it into valid sequence of bpf instructions
29*cfa7b011SJoanne Koong */
30*cfa7b011SJoanne Koong #define __jhash_mix(a, b, c) \
31*cfa7b011SJoanne Koong { \
32*cfa7b011SJoanne Koong a -= c; a ^= rol32(c, 4); c += b; \
33*cfa7b011SJoanne Koong b -= a; b ^= rol32(a, 6); a += c; \
34*cfa7b011SJoanne Koong c -= b; c ^= rol32(b, 8); b += a; \
35*cfa7b011SJoanne Koong a -= c; a ^= rol32(c, 16); c += b; \
36*cfa7b011SJoanne Koong b -= a; b ^= rol32(a, 19); a += c; \
37*cfa7b011SJoanne Koong c -= b; c ^= rol32(b, 4); b += a; \
38*cfa7b011SJoanne Koong }
39*cfa7b011SJoanne Koong
40*cfa7b011SJoanne Koong #define __jhash_final(a, b, c) \
41*cfa7b011SJoanne Koong { \
42*cfa7b011SJoanne Koong c ^= b; c -= rol32(b, 14); \
43*cfa7b011SJoanne Koong a ^= c; a -= rol32(c, 11); \
44*cfa7b011SJoanne Koong b ^= a; b -= rol32(a, 25); \
45*cfa7b011SJoanne Koong c ^= b; c -= rol32(b, 16); \
46*cfa7b011SJoanne Koong a ^= c; a -= rol32(c, 4); \
47*cfa7b011SJoanne Koong b ^= a; b -= rol32(a, 14); \
48*cfa7b011SJoanne Koong c ^= b; c -= rol32(b, 24); \
49*cfa7b011SJoanne Koong }
50*cfa7b011SJoanne Koong
51*cfa7b011SJoanne Koong #define JHASH_INITVAL 0xdeadbeef
52*cfa7b011SJoanne Koong
53*cfa7b011SJoanne Koong typedef unsigned int u32;
54*cfa7b011SJoanne Koong
jhash(const void * key,u32 length,u32 initval)55*cfa7b011SJoanne Koong static __noinline u32 jhash(const void *key, u32 length, u32 initval)
56*cfa7b011SJoanne Koong {
57*cfa7b011SJoanne Koong u32 a, b, c;
58*cfa7b011SJoanne Koong const unsigned char *k = key;
59*cfa7b011SJoanne Koong
60*cfa7b011SJoanne Koong a = b = c = JHASH_INITVAL + length + initval;
61*cfa7b011SJoanne Koong
62*cfa7b011SJoanne Koong while (length > 12) {
63*cfa7b011SJoanne Koong a += *(u32 *)(k);
64*cfa7b011SJoanne Koong b += *(u32 *)(k + 4);
65*cfa7b011SJoanne Koong c += *(u32 *)(k + 8);
66*cfa7b011SJoanne Koong __jhash_mix(a, b, c);
67*cfa7b011SJoanne Koong length -= 12;
68*cfa7b011SJoanne Koong k += 12;
69*cfa7b011SJoanne Koong }
70*cfa7b011SJoanne Koong switch (length) {
71*cfa7b011SJoanne Koong case 12: c += (u32)k[11]<<24;
72*cfa7b011SJoanne Koong case 11: c += (u32)k[10]<<16;
73*cfa7b011SJoanne Koong case 10: c += (u32)k[9]<<8;
74*cfa7b011SJoanne Koong case 9: c += k[8];
75*cfa7b011SJoanne Koong case 8: b += (u32)k[7]<<24;
76*cfa7b011SJoanne Koong case 7: b += (u32)k[6]<<16;
77*cfa7b011SJoanne Koong case 6: b += (u32)k[5]<<8;
78*cfa7b011SJoanne Koong case 5: b += k[4];
79*cfa7b011SJoanne Koong case 4: a += (u32)k[3]<<24;
80*cfa7b011SJoanne Koong case 3: a += (u32)k[2]<<16;
81*cfa7b011SJoanne Koong case 2: a += (u32)k[1]<<8;
82*cfa7b011SJoanne Koong case 1: a += k[0];
83*cfa7b011SJoanne Koong __jhash_final(a, b, c);
84*cfa7b011SJoanne Koong case 0: /* Nothing left to add */
85*cfa7b011SJoanne Koong break;
86*cfa7b011SJoanne Koong }
87*cfa7b011SJoanne Koong
88*cfa7b011SJoanne Koong return c;
89*cfa7b011SJoanne Koong }
90*cfa7b011SJoanne Koong
__jhash_nwords(u32 a,u32 b,u32 c,u32 initval)91*cfa7b011SJoanne Koong static __noinline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval)
92*cfa7b011SJoanne Koong {
93*cfa7b011SJoanne Koong a += initval;
94*cfa7b011SJoanne Koong b += initval;
95*cfa7b011SJoanne Koong c += initval;
96*cfa7b011SJoanne Koong __jhash_final(a, b, c);
97*cfa7b011SJoanne Koong return c;
98*cfa7b011SJoanne Koong }
99*cfa7b011SJoanne Koong
jhash_2words(u32 a,u32 b,u32 initval)100*cfa7b011SJoanne Koong static __noinline u32 jhash_2words(u32 a, u32 b, u32 initval)
101*cfa7b011SJoanne Koong {
102*cfa7b011SJoanne Koong return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2));
103*cfa7b011SJoanne Koong }
104*cfa7b011SJoanne Koong
105*cfa7b011SJoanne Koong #define PCKT_FRAGMENTED 65343
106*cfa7b011SJoanne Koong #define IPV4_HDR_LEN_NO_OPT 20
107*cfa7b011SJoanne Koong #define IPV4_PLUS_ICMP_HDR 28
108*cfa7b011SJoanne Koong #define IPV6_PLUS_ICMP_HDR 48
109*cfa7b011SJoanne Koong #define RING_SIZE 2
110*cfa7b011SJoanne Koong #define MAX_VIPS 12
111*cfa7b011SJoanne Koong #define MAX_REALS 5
112*cfa7b011SJoanne Koong #define CTL_MAP_SIZE 16
113*cfa7b011SJoanne Koong #define CH_RINGS_SIZE (MAX_VIPS * RING_SIZE)
114*cfa7b011SJoanne Koong #define F_IPV6 (1 << 0)
115*cfa7b011SJoanne Koong #define F_HASH_NO_SRC_PORT (1 << 0)
116*cfa7b011SJoanne Koong #define F_ICMP (1 << 0)
117*cfa7b011SJoanne Koong #define F_SYN_SET (1 << 1)
118*cfa7b011SJoanne Koong
119*cfa7b011SJoanne Koong struct packet_description {
120*cfa7b011SJoanne Koong union {
121*cfa7b011SJoanne Koong __be32 src;
122*cfa7b011SJoanne Koong __be32 srcv6[4];
123*cfa7b011SJoanne Koong };
124*cfa7b011SJoanne Koong union {
125*cfa7b011SJoanne Koong __be32 dst;
126*cfa7b011SJoanne Koong __be32 dstv6[4];
127*cfa7b011SJoanne Koong };
128*cfa7b011SJoanne Koong union {
129*cfa7b011SJoanne Koong __u32 ports;
130*cfa7b011SJoanne Koong __u16 port16[2];
131*cfa7b011SJoanne Koong };
132*cfa7b011SJoanne Koong __u8 proto;
133*cfa7b011SJoanne Koong __u8 flags;
134*cfa7b011SJoanne Koong };
135*cfa7b011SJoanne Koong
136*cfa7b011SJoanne Koong struct ctl_value {
137*cfa7b011SJoanne Koong union {
138*cfa7b011SJoanne Koong __u64 value;
139*cfa7b011SJoanne Koong __u32 ifindex;
140*cfa7b011SJoanne Koong __u8 mac[6];
141*cfa7b011SJoanne Koong };
142*cfa7b011SJoanne Koong };
143*cfa7b011SJoanne Koong
144*cfa7b011SJoanne Koong struct vip_meta {
145*cfa7b011SJoanne Koong __u32 flags;
146*cfa7b011SJoanne Koong __u32 vip_num;
147*cfa7b011SJoanne Koong };
148*cfa7b011SJoanne Koong
149*cfa7b011SJoanne Koong struct real_definition {
150*cfa7b011SJoanne Koong union {
151*cfa7b011SJoanne Koong __be32 dst;
152*cfa7b011SJoanne Koong __be32 dstv6[4];
153*cfa7b011SJoanne Koong };
154*cfa7b011SJoanne Koong __u8 flags;
155*cfa7b011SJoanne Koong };
156*cfa7b011SJoanne Koong
157*cfa7b011SJoanne Koong struct vip_stats {
158*cfa7b011SJoanne Koong __u64 bytes;
159*cfa7b011SJoanne Koong __u64 pkts;
160*cfa7b011SJoanne Koong };
161*cfa7b011SJoanne Koong
162*cfa7b011SJoanne Koong struct eth_hdr {
163*cfa7b011SJoanne Koong unsigned char eth_dest[ETH_ALEN];
164*cfa7b011SJoanne Koong unsigned char eth_source[ETH_ALEN];
165*cfa7b011SJoanne Koong unsigned short eth_proto;
166*cfa7b011SJoanne Koong };
167*cfa7b011SJoanne Koong
168*cfa7b011SJoanne Koong struct {
169*cfa7b011SJoanne Koong __uint(type, BPF_MAP_TYPE_HASH);
170*cfa7b011SJoanne Koong __uint(max_entries, MAX_VIPS);
171*cfa7b011SJoanne Koong __type(key, struct vip);
172*cfa7b011SJoanne Koong __type(value, struct vip_meta);
173*cfa7b011SJoanne Koong } vip_map SEC(".maps");
174*cfa7b011SJoanne Koong
175*cfa7b011SJoanne Koong struct {
176*cfa7b011SJoanne Koong __uint(type, BPF_MAP_TYPE_ARRAY);
177*cfa7b011SJoanne Koong __uint(max_entries, CH_RINGS_SIZE);
178*cfa7b011SJoanne Koong __type(key, __u32);
179*cfa7b011SJoanne Koong __type(value, __u32);
180*cfa7b011SJoanne Koong } ch_rings SEC(".maps");
181*cfa7b011SJoanne Koong
182*cfa7b011SJoanne Koong struct {
183*cfa7b011SJoanne Koong __uint(type, BPF_MAP_TYPE_ARRAY);
184*cfa7b011SJoanne Koong __uint(max_entries, MAX_REALS);
185*cfa7b011SJoanne Koong __type(key, __u32);
186*cfa7b011SJoanne Koong __type(value, struct real_definition);
187*cfa7b011SJoanne Koong } reals SEC(".maps");
188*cfa7b011SJoanne Koong
189*cfa7b011SJoanne Koong struct {
190*cfa7b011SJoanne Koong __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
191*cfa7b011SJoanne Koong __uint(max_entries, MAX_VIPS);
192*cfa7b011SJoanne Koong __type(key, __u32);
193*cfa7b011SJoanne Koong __type(value, struct vip_stats);
194*cfa7b011SJoanne Koong } stats SEC(".maps");
195*cfa7b011SJoanne Koong
196*cfa7b011SJoanne Koong struct {
197*cfa7b011SJoanne Koong __uint(type, BPF_MAP_TYPE_ARRAY);
198*cfa7b011SJoanne Koong __uint(max_entries, CTL_MAP_SIZE);
199*cfa7b011SJoanne Koong __type(key, __u32);
200*cfa7b011SJoanne Koong __type(value, struct ctl_value);
201*cfa7b011SJoanne Koong } ctl_array SEC(".maps");
202*cfa7b011SJoanne Koong
get_packet_hash(struct packet_description * pckt,bool ipv6)203*cfa7b011SJoanne Koong static __noinline __u32 get_packet_hash(struct packet_description *pckt, bool ipv6)
204*cfa7b011SJoanne Koong {
205*cfa7b011SJoanne Koong if (ipv6)
206*cfa7b011SJoanne Koong return jhash_2words(jhash(pckt->srcv6, 16, MAX_VIPS),
207*cfa7b011SJoanne Koong pckt->ports, CH_RINGS_SIZE);
208*cfa7b011SJoanne Koong else
209*cfa7b011SJoanne Koong return jhash_2words(pckt->src, pckt->ports, CH_RINGS_SIZE);
210*cfa7b011SJoanne Koong }
211*cfa7b011SJoanne Koong
get_packet_dst(struct real_definition ** real,struct packet_description * pckt,struct vip_meta * vip_info,bool is_ipv6)212*cfa7b011SJoanne Koong static __noinline bool get_packet_dst(struct real_definition **real,
213*cfa7b011SJoanne Koong struct packet_description *pckt,
214*cfa7b011SJoanne Koong struct vip_meta *vip_info,
215*cfa7b011SJoanne Koong bool is_ipv6)
216*cfa7b011SJoanne Koong {
217*cfa7b011SJoanne Koong __u32 hash = get_packet_hash(pckt, is_ipv6);
218*cfa7b011SJoanne Koong __u32 key = RING_SIZE * vip_info->vip_num + hash % RING_SIZE;
219*cfa7b011SJoanne Koong __u32 *real_pos;
220*cfa7b011SJoanne Koong
221*cfa7b011SJoanne Koong if (hash != 0x358459b7 /* jhash of ipv4 packet */ &&
222*cfa7b011SJoanne Koong hash != 0x2f4bc6bb /* jhash of ipv6 packet */)
223*cfa7b011SJoanne Koong return false;
224*cfa7b011SJoanne Koong
225*cfa7b011SJoanne Koong real_pos = bpf_map_lookup_elem(&ch_rings, &key);
226*cfa7b011SJoanne Koong if (!real_pos)
227*cfa7b011SJoanne Koong return false;
228*cfa7b011SJoanne Koong key = *real_pos;
229*cfa7b011SJoanne Koong *real = bpf_map_lookup_elem(&reals, &key);
230*cfa7b011SJoanne Koong if (!(*real))
231*cfa7b011SJoanne Koong return false;
232*cfa7b011SJoanne Koong return true;
233*cfa7b011SJoanne Koong }
234*cfa7b011SJoanne Koong
parse_icmpv6(struct bpf_dynptr * skb_ptr,__u64 off,struct packet_description * pckt)235*cfa7b011SJoanne Koong static __noinline int parse_icmpv6(struct bpf_dynptr *skb_ptr, __u64 off,
236*cfa7b011SJoanne Koong struct packet_description *pckt)
237*cfa7b011SJoanne Koong {
238*cfa7b011SJoanne Koong __u8 buffer[sizeof(struct ipv6hdr)] = {};
239*cfa7b011SJoanne Koong struct icmp6hdr *icmp_hdr;
240*cfa7b011SJoanne Koong struct ipv6hdr *ip6h;
241*cfa7b011SJoanne Koong
242*cfa7b011SJoanne Koong icmp_hdr = bpf_dynptr_slice(skb_ptr, off, buffer, sizeof(buffer));
243*cfa7b011SJoanne Koong if (!icmp_hdr)
244*cfa7b011SJoanne Koong return TC_ACT_SHOT;
245*cfa7b011SJoanne Koong
246*cfa7b011SJoanne Koong if (icmp_hdr->icmp6_type != ICMPV6_PKT_TOOBIG)
247*cfa7b011SJoanne Koong return TC_ACT_OK;
248*cfa7b011SJoanne Koong off += sizeof(struct icmp6hdr);
249*cfa7b011SJoanne Koong ip6h = bpf_dynptr_slice(skb_ptr, off, buffer, sizeof(buffer));
250*cfa7b011SJoanne Koong if (!ip6h)
251*cfa7b011SJoanne Koong return TC_ACT_SHOT;
252*cfa7b011SJoanne Koong pckt->proto = ip6h->nexthdr;
253*cfa7b011SJoanne Koong pckt->flags |= F_ICMP;
254*cfa7b011SJoanne Koong memcpy(pckt->srcv6, ip6h->daddr.s6_addr32, 16);
255*cfa7b011SJoanne Koong memcpy(pckt->dstv6, ip6h->saddr.s6_addr32, 16);
256*cfa7b011SJoanne Koong return TC_ACT_UNSPEC;
257*cfa7b011SJoanne Koong }
258*cfa7b011SJoanne Koong
parse_icmp(struct bpf_dynptr * skb_ptr,__u64 off,struct packet_description * pckt)259*cfa7b011SJoanne Koong static __noinline int parse_icmp(struct bpf_dynptr *skb_ptr, __u64 off,
260*cfa7b011SJoanne Koong struct packet_description *pckt)
261*cfa7b011SJoanne Koong {
262*cfa7b011SJoanne Koong __u8 buffer_icmp[sizeof(struct iphdr)] = {};
263*cfa7b011SJoanne Koong __u8 buffer_ip[sizeof(struct iphdr)] = {};
264*cfa7b011SJoanne Koong struct icmphdr *icmp_hdr;
265*cfa7b011SJoanne Koong struct iphdr *iph;
266*cfa7b011SJoanne Koong
267*cfa7b011SJoanne Koong icmp_hdr = bpf_dynptr_slice(skb_ptr, off, buffer_icmp, sizeof(buffer_icmp));
268*cfa7b011SJoanne Koong if (!icmp_hdr)
269*cfa7b011SJoanne Koong return TC_ACT_SHOT;
270*cfa7b011SJoanne Koong if (icmp_hdr->type != ICMP_DEST_UNREACH ||
271*cfa7b011SJoanne Koong icmp_hdr->code != ICMP_FRAG_NEEDED)
272*cfa7b011SJoanne Koong return TC_ACT_OK;
273*cfa7b011SJoanne Koong off += sizeof(struct icmphdr);
274*cfa7b011SJoanne Koong iph = bpf_dynptr_slice(skb_ptr, off, buffer_ip, sizeof(buffer_ip));
275*cfa7b011SJoanne Koong if (!iph || iph->ihl != 5)
276*cfa7b011SJoanne Koong return TC_ACT_SHOT;
277*cfa7b011SJoanne Koong pckt->proto = iph->protocol;
278*cfa7b011SJoanne Koong pckt->flags |= F_ICMP;
279*cfa7b011SJoanne Koong pckt->src = iph->daddr;
280*cfa7b011SJoanne Koong pckt->dst = iph->saddr;
281*cfa7b011SJoanne Koong return TC_ACT_UNSPEC;
282*cfa7b011SJoanne Koong }
283*cfa7b011SJoanne Koong
parse_udp(struct bpf_dynptr * skb_ptr,__u64 off,struct packet_description * pckt)284*cfa7b011SJoanne Koong static __noinline bool parse_udp(struct bpf_dynptr *skb_ptr, __u64 off,
285*cfa7b011SJoanne Koong struct packet_description *pckt)
286*cfa7b011SJoanne Koong {
287*cfa7b011SJoanne Koong __u8 buffer[sizeof(struct udphdr)] = {};
288*cfa7b011SJoanne Koong struct udphdr *udp;
289*cfa7b011SJoanne Koong
290*cfa7b011SJoanne Koong udp = bpf_dynptr_slice(skb_ptr, off, buffer, sizeof(buffer));
291*cfa7b011SJoanne Koong if (!udp)
292*cfa7b011SJoanne Koong return false;
293*cfa7b011SJoanne Koong
294*cfa7b011SJoanne Koong if (!(pckt->flags & F_ICMP)) {
295*cfa7b011SJoanne Koong pckt->port16[0] = udp->source;
296*cfa7b011SJoanne Koong pckt->port16[1] = udp->dest;
297*cfa7b011SJoanne Koong } else {
298*cfa7b011SJoanne Koong pckt->port16[0] = udp->dest;
299*cfa7b011SJoanne Koong pckt->port16[1] = udp->source;
300*cfa7b011SJoanne Koong }
301*cfa7b011SJoanne Koong return true;
302*cfa7b011SJoanne Koong }
303*cfa7b011SJoanne Koong
parse_tcp(struct bpf_dynptr * skb_ptr,__u64 off,struct packet_description * pckt)304*cfa7b011SJoanne Koong static __noinline bool parse_tcp(struct bpf_dynptr *skb_ptr, __u64 off,
305*cfa7b011SJoanne Koong struct packet_description *pckt)
306*cfa7b011SJoanne Koong {
307*cfa7b011SJoanne Koong __u8 buffer[sizeof(struct tcphdr)] = {};
308*cfa7b011SJoanne Koong struct tcphdr *tcp;
309*cfa7b011SJoanne Koong
310*cfa7b011SJoanne Koong tcp = bpf_dynptr_slice(skb_ptr, off, buffer, sizeof(buffer));
311*cfa7b011SJoanne Koong if (!tcp)
312*cfa7b011SJoanne Koong return false;
313*cfa7b011SJoanne Koong
314*cfa7b011SJoanne Koong if (tcp->syn)
315*cfa7b011SJoanne Koong pckt->flags |= F_SYN_SET;
316*cfa7b011SJoanne Koong
317*cfa7b011SJoanne Koong if (!(pckt->flags & F_ICMP)) {
318*cfa7b011SJoanne Koong pckt->port16[0] = tcp->source;
319*cfa7b011SJoanne Koong pckt->port16[1] = tcp->dest;
320*cfa7b011SJoanne Koong } else {
321*cfa7b011SJoanne Koong pckt->port16[0] = tcp->dest;
322*cfa7b011SJoanne Koong pckt->port16[1] = tcp->source;
323*cfa7b011SJoanne Koong }
324*cfa7b011SJoanne Koong return true;
325*cfa7b011SJoanne Koong }
326*cfa7b011SJoanne Koong
process_packet(struct bpf_dynptr * skb_ptr,struct eth_hdr * eth,__u64 off,bool is_ipv6,struct __sk_buff * skb)327*cfa7b011SJoanne Koong static __noinline int process_packet(struct bpf_dynptr *skb_ptr,
328*cfa7b011SJoanne Koong struct eth_hdr *eth, __u64 off,
329*cfa7b011SJoanne Koong bool is_ipv6, struct __sk_buff *skb)
330*cfa7b011SJoanne Koong {
331*cfa7b011SJoanne Koong struct packet_description pckt = {};
332*cfa7b011SJoanne Koong struct bpf_tunnel_key tkey = {};
333*cfa7b011SJoanne Koong struct vip_stats *data_stats;
334*cfa7b011SJoanne Koong struct real_definition *dst;
335*cfa7b011SJoanne Koong struct vip_meta *vip_info;
336*cfa7b011SJoanne Koong struct ctl_value *cval;
337*cfa7b011SJoanne Koong __u32 v4_intf_pos = 1;
338*cfa7b011SJoanne Koong __u32 v6_intf_pos = 2;
339*cfa7b011SJoanne Koong struct ipv6hdr *ip6h;
340*cfa7b011SJoanne Koong struct vip vip = {};
341*cfa7b011SJoanne Koong struct iphdr *iph;
342*cfa7b011SJoanne Koong int tun_flag = 0;
343*cfa7b011SJoanne Koong __u16 pkt_bytes;
344*cfa7b011SJoanne Koong __u64 iph_len;
345*cfa7b011SJoanne Koong __u32 ifindex;
346*cfa7b011SJoanne Koong __u8 protocol;
347*cfa7b011SJoanne Koong __u32 vip_num;
348*cfa7b011SJoanne Koong int action;
349*cfa7b011SJoanne Koong
350*cfa7b011SJoanne Koong tkey.tunnel_ttl = 64;
351*cfa7b011SJoanne Koong if (is_ipv6) {
352*cfa7b011SJoanne Koong __u8 buffer[sizeof(struct ipv6hdr)] = {};
353*cfa7b011SJoanne Koong
354*cfa7b011SJoanne Koong ip6h = bpf_dynptr_slice(skb_ptr, off, buffer, sizeof(buffer));
355*cfa7b011SJoanne Koong if (!ip6h)
356*cfa7b011SJoanne Koong return TC_ACT_SHOT;
357*cfa7b011SJoanne Koong
358*cfa7b011SJoanne Koong iph_len = sizeof(struct ipv6hdr);
359*cfa7b011SJoanne Koong protocol = ip6h->nexthdr;
360*cfa7b011SJoanne Koong pckt.proto = protocol;
361*cfa7b011SJoanne Koong pkt_bytes = bpf_ntohs(ip6h->payload_len);
362*cfa7b011SJoanne Koong off += iph_len;
363*cfa7b011SJoanne Koong if (protocol == IPPROTO_FRAGMENT) {
364*cfa7b011SJoanne Koong return TC_ACT_SHOT;
365*cfa7b011SJoanne Koong } else if (protocol == IPPROTO_ICMPV6) {
366*cfa7b011SJoanne Koong action = parse_icmpv6(skb_ptr, off, &pckt);
367*cfa7b011SJoanne Koong if (action >= 0)
368*cfa7b011SJoanne Koong return action;
369*cfa7b011SJoanne Koong off += IPV6_PLUS_ICMP_HDR;
370*cfa7b011SJoanne Koong } else {
371*cfa7b011SJoanne Koong memcpy(pckt.srcv6, ip6h->saddr.s6_addr32, 16);
372*cfa7b011SJoanne Koong memcpy(pckt.dstv6, ip6h->daddr.s6_addr32, 16);
373*cfa7b011SJoanne Koong }
374*cfa7b011SJoanne Koong } else {
375*cfa7b011SJoanne Koong __u8 buffer[sizeof(struct iphdr)] = {};
376*cfa7b011SJoanne Koong
377*cfa7b011SJoanne Koong iph = bpf_dynptr_slice(skb_ptr, off, buffer, sizeof(buffer));
378*cfa7b011SJoanne Koong if (!iph || iph->ihl != 5)
379*cfa7b011SJoanne Koong return TC_ACT_SHOT;
380*cfa7b011SJoanne Koong
381*cfa7b011SJoanne Koong protocol = iph->protocol;
382*cfa7b011SJoanne Koong pckt.proto = protocol;
383*cfa7b011SJoanne Koong pkt_bytes = bpf_ntohs(iph->tot_len);
384*cfa7b011SJoanne Koong off += IPV4_HDR_LEN_NO_OPT;
385*cfa7b011SJoanne Koong
386*cfa7b011SJoanne Koong if (iph->frag_off & PCKT_FRAGMENTED)
387*cfa7b011SJoanne Koong return TC_ACT_SHOT;
388*cfa7b011SJoanne Koong if (protocol == IPPROTO_ICMP) {
389*cfa7b011SJoanne Koong action = parse_icmp(skb_ptr, off, &pckt);
390*cfa7b011SJoanne Koong if (action >= 0)
391*cfa7b011SJoanne Koong return action;
392*cfa7b011SJoanne Koong off += IPV4_PLUS_ICMP_HDR;
393*cfa7b011SJoanne Koong } else {
394*cfa7b011SJoanne Koong pckt.src = iph->saddr;
395*cfa7b011SJoanne Koong pckt.dst = iph->daddr;
396*cfa7b011SJoanne Koong }
397*cfa7b011SJoanne Koong }
398*cfa7b011SJoanne Koong protocol = pckt.proto;
399*cfa7b011SJoanne Koong
400*cfa7b011SJoanne Koong if (protocol == IPPROTO_TCP) {
401*cfa7b011SJoanne Koong if (!parse_tcp(skb_ptr, off, &pckt))
402*cfa7b011SJoanne Koong return TC_ACT_SHOT;
403*cfa7b011SJoanne Koong } else if (protocol == IPPROTO_UDP) {
404*cfa7b011SJoanne Koong if (!parse_udp(skb_ptr, off, &pckt))
405*cfa7b011SJoanne Koong return TC_ACT_SHOT;
406*cfa7b011SJoanne Koong } else {
407*cfa7b011SJoanne Koong return TC_ACT_SHOT;
408*cfa7b011SJoanne Koong }
409*cfa7b011SJoanne Koong
410*cfa7b011SJoanne Koong if (is_ipv6)
411*cfa7b011SJoanne Koong memcpy(vip.daddr.v6, pckt.dstv6, 16);
412*cfa7b011SJoanne Koong else
413*cfa7b011SJoanne Koong vip.daddr.v4 = pckt.dst;
414*cfa7b011SJoanne Koong
415*cfa7b011SJoanne Koong vip.dport = pckt.port16[1];
416*cfa7b011SJoanne Koong vip.protocol = pckt.proto;
417*cfa7b011SJoanne Koong vip_info = bpf_map_lookup_elem(&vip_map, &vip);
418*cfa7b011SJoanne Koong if (!vip_info) {
419*cfa7b011SJoanne Koong vip.dport = 0;
420*cfa7b011SJoanne Koong vip_info = bpf_map_lookup_elem(&vip_map, &vip);
421*cfa7b011SJoanne Koong if (!vip_info)
422*cfa7b011SJoanne Koong return TC_ACT_SHOT;
423*cfa7b011SJoanne Koong pckt.port16[1] = 0;
424*cfa7b011SJoanne Koong }
425*cfa7b011SJoanne Koong
426*cfa7b011SJoanne Koong if (vip_info->flags & F_HASH_NO_SRC_PORT)
427*cfa7b011SJoanne Koong pckt.port16[0] = 0;
428*cfa7b011SJoanne Koong
429*cfa7b011SJoanne Koong if (!get_packet_dst(&dst, &pckt, vip_info, is_ipv6))
430*cfa7b011SJoanne Koong return TC_ACT_SHOT;
431*cfa7b011SJoanne Koong
432*cfa7b011SJoanne Koong if (dst->flags & F_IPV6) {
433*cfa7b011SJoanne Koong cval = bpf_map_lookup_elem(&ctl_array, &v6_intf_pos);
434*cfa7b011SJoanne Koong if (!cval)
435*cfa7b011SJoanne Koong return TC_ACT_SHOT;
436*cfa7b011SJoanne Koong ifindex = cval->ifindex;
437*cfa7b011SJoanne Koong memcpy(tkey.remote_ipv6, dst->dstv6, 16);
438*cfa7b011SJoanne Koong tun_flag = BPF_F_TUNINFO_IPV6;
439*cfa7b011SJoanne Koong } else {
440*cfa7b011SJoanne Koong cval = bpf_map_lookup_elem(&ctl_array, &v4_intf_pos);
441*cfa7b011SJoanne Koong if (!cval)
442*cfa7b011SJoanne Koong return TC_ACT_SHOT;
443*cfa7b011SJoanne Koong ifindex = cval->ifindex;
444*cfa7b011SJoanne Koong tkey.remote_ipv4 = dst->dst;
445*cfa7b011SJoanne Koong }
446*cfa7b011SJoanne Koong vip_num = vip_info->vip_num;
447*cfa7b011SJoanne Koong data_stats = bpf_map_lookup_elem(&stats, &vip_num);
448*cfa7b011SJoanne Koong if (!data_stats)
449*cfa7b011SJoanne Koong return TC_ACT_SHOT;
450*cfa7b011SJoanne Koong data_stats->pkts++;
451*cfa7b011SJoanne Koong data_stats->bytes += pkt_bytes;
452*cfa7b011SJoanne Koong bpf_skb_set_tunnel_key(skb, &tkey, sizeof(tkey), tun_flag);
453*cfa7b011SJoanne Koong *(u32 *)eth->eth_dest = tkey.remote_ipv4;
454*cfa7b011SJoanne Koong return bpf_redirect(ifindex, 0);
455*cfa7b011SJoanne Koong }
456*cfa7b011SJoanne Koong
457*cfa7b011SJoanne Koong SEC("tc")
balancer_ingress(struct __sk_buff * ctx)458*cfa7b011SJoanne Koong int balancer_ingress(struct __sk_buff *ctx)
459*cfa7b011SJoanne Koong {
460*cfa7b011SJoanne Koong __u8 buffer[sizeof(struct eth_hdr)] = {};
461*cfa7b011SJoanne Koong struct bpf_dynptr ptr;
462*cfa7b011SJoanne Koong struct eth_hdr *eth;
463*cfa7b011SJoanne Koong __u32 eth_proto;
464*cfa7b011SJoanne Koong __u32 nh_off;
465*cfa7b011SJoanne Koong int err;
466*cfa7b011SJoanne Koong
467*cfa7b011SJoanne Koong nh_off = sizeof(struct eth_hdr);
468*cfa7b011SJoanne Koong
469*cfa7b011SJoanne Koong bpf_dynptr_from_skb(ctx, 0, &ptr);
470*cfa7b011SJoanne Koong eth = bpf_dynptr_slice_rdwr(&ptr, 0, buffer, sizeof(buffer));
471*cfa7b011SJoanne Koong if (!eth)
472*cfa7b011SJoanne Koong return TC_ACT_SHOT;
473*cfa7b011SJoanne Koong eth_proto = eth->eth_proto;
474*cfa7b011SJoanne Koong if (eth_proto == bpf_htons(ETH_P_IP))
475*cfa7b011SJoanne Koong err = process_packet(&ptr, eth, nh_off, false, ctx);
476*cfa7b011SJoanne Koong else if (eth_proto == bpf_htons(ETH_P_IPV6))
477*cfa7b011SJoanne Koong err = process_packet(&ptr, eth, nh_off, true, ctx);
478*cfa7b011SJoanne Koong else
479*cfa7b011SJoanne Koong return TC_ACT_SHOT;
480*cfa7b011SJoanne Koong
481*cfa7b011SJoanne Koong if (eth == buffer)
482*cfa7b011SJoanne Koong bpf_dynptr_write(&ptr, 0, buffer, sizeof(buffer), 0);
483*cfa7b011SJoanne Koong
484*cfa7b011SJoanne Koong return err;
485*cfa7b011SJoanne Koong }
486*cfa7b011SJoanne Koong
487*cfa7b011SJoanne Koong char _license[] SEC("license") = "GPL";
488