1eef4a011SDaniel Borkmann // SPDX-License-Identifier: GPL-2.0
2adfd272cSToke Høiland-Jørgensen #include <stddef.h>
3eef4a011SDaniel Borkmann #include <stdint.h>
4eef4a011SDaniel Borkmann #include <stdbool.h>
5eef4a011SDaniel Borkmann
6eef4a011SDaniel Borkmann #include <linux/bpf.h>
7eef4a011SDaniel Borkmann #include <linux/stddef.h>
8eef4a011SDaniel Borkmann #include <linux/pkt_cls.h>
9eef4a011SDaniel Borkmann #include <linux/if_ether.h>
10eef4a011SDaniel Borkmann #include <linux/in.h>
11eef4a011SDaniel Borkmann #include <linux/ip.h>
12eef4a011SDaniel Borkmann #include <linux/ipv6.h>
13eef4a011SDaniel Borkmann
14eef4a011SDaniel Borkmann #include <bpf/bpf_helpers.h>
15eef4a011SDaniel Borkmann #include <bpf/bpf_endian.h>
16eef4a011SDaniel Borkmann
17eef4a011SDaniel Borkmann #ifndef ctx_ptr
18eef4a011SDaniel Borkmann # define ctx_ptr(field) (void *)(long)(field)
19eef4a011SDaniel Borkmann #endif
20eef4a011SDaniel Borkmann
21eef4a011SDaniel Borkmann #define ip4_src 0xac100164 /* 172.16.1.100 */
22eef4a011SDaniel Borkmann #define ip4_dst 0xac100264 /* 172.16.2.100 */
23eef4a011SDaniel Borkmann
24eef4a011SDaniel Borkmann #define ip6_src { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
25eef4a011SDaniel Borkmann 0x00, 0x01, 0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe }
26eef4a011SDaniel Borkmann #define ip6_dst { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
27eef4a011SDaniel Borkmann 0x00, 0x02, 0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe }
28eef4a011SDaniel Borkmann
29eef4a011SDaniel Borkmann #ifndef v6_equal
30eef4a011SDaniel Borkmann # define v6_equal(a, b) (a.s6_addr32[0] == b.s6_addr32[0] && \
31eef4a011SDaniel Borkmann a.s6_addr32[1] == b.s6_addr32[1] && \
32eef4a011SDaniel Borkmann a.s6_addr32[2] == b.s6_addr32[2] && \
33eef4a011SDaniel Borkmann a.s6_addr32[3] == b.s6_addr32[3])
34eef4a011SDaniel Borkmann #endif
35eef4a011SDaniel Borkmann
368f1634b8SStanislav Fomichev volatile const __u32 IFINDEX_SRC;
378f1634b8SStanislav Fomichev volatile const __u32 IFINDEX_DST;
3857a73fe7SDaniel Borkmann
is_remote_ep_v4(struct __sk_buff * skb,__be32 addr)39eef4a011SDaniel Borkmann static __always_inline bool is_remote_ep_v4(struct __sk_buff *skb,
40eef4a011SDaniel Borkmann __be32 addr)
41eef4a011SDaniel Borkmann {
42eef4a011SDaniel Borkmann void *data_end = ctx_ptr(skb->data_end);
43eef4a011SDaniel Borkmann void *data = ctx_ptr(skb->data);
44eef4a011SDaniel Borkmann struct iphdr *ip4h;
45eef4a011SDaniel Borkmann
46eef4a011SDaniel Borkmann if (data + sizeof(struct ethhdr) > data_end)
47eef4a011SDaniel Borkmann return false;
48eef4a011SDaniel Borkmann
49eef4a011SDaniel Borkmann ip4h = (struct iphdr *)(data + sizeof(struct ethhdr));
50eef4a011SDaniel Borkmann if ((void *)(ip4h + 1) > data_end)
51eef4a011SDaniel Borkmann return false;
52eef4a011SDaniel Borkmann
53eef4a011SDaniel Borkmann return ip4h->daddr == addr;
54eef4a011SDaniel Borkmann }
55eef4a011SDaniel Borkmann
is_remote_ep_v6(struct __sk_buff * skb,struct in6_addr addr)56eef4a011SDaniel Borkmann static __always_inline bool is_remote_ep_v6(struct __sk_buff *skb,
57eef4a011SDaniel Borkmann struct in6_addr addr)
58eef4a011SDaniel Borkmann {
59eef4a011SDaniel Borkmann void *data_end = ctx_ptr(skb->data_end);
60eef4a011SDaniel Borkmann void *data = ctx_ptr(skb->data);
61eef4a011SDaniel Borkmann struct ipv6hdr *ip6h;
62eef4a011SDaniel Borkmann
63eef4a011SDaniel Borkmann if (data + sizeof(struct ethhdr) > data_end)
64eef4a011SDaniel Borkmann return false;
65eef4a011SDaniel Borkmann
66eef4a011SDaniel Borkmann ip6h = (struct ipv6hdr *)(data + sizeof(struct ethhdr));
67eef4a011SDaniel Borkmann if ((void *)(ip6h + 1) > data_end)
68eef4a011SDaniel Borkmann return false;
69eef4a011SDaniel Borkmann
70eef4a011SDaniel Borkmann return v6_equal(ip6h->daddr, addr);
71eef4a011SDaniel Borkmann }
72eef4a011SDaniel Borkmann
73c22bdd28SAndrii Nakryiko SEC("tc")
tc_chk(struct __sk_buff * skb)74096eccdeSJussi Maki int tc_chk(struct __sk_buff *skb)
75eef4a011SDaniel Borkmann {
76eef4a011SDaniel Borkmann void *data_end = ctx_ptr(skb->data_end);
77eef4a011SDaniel Borkmann void *data = ctx_ptr(skb->data);
78eef4a011SDaniel Borkmann __u32 *raw = data;
79eef4a011SDaniel Borkmann
80eef4a011SDaniel Borkmann if (data + sizeof(struct ethhdr) > data_end)
81eef4a011SDaniel Borkmann return TC_ACT_SHOT;
82eef4a011SDaniel Borkmann
83eef4a011SDaniel Borkmann return !raw[0] && !raw[1] && !raw[2] ? TC_ACT_SHOT : TC_ACT_OK;
84eef4a011SDaniel Borkmann }
85eef4a011SDaniel Borkmann
86c22bdd28SAndrii Nakryiko SEC("tc")
tc_dst(struct __sk_buff * skb)87096eccdeSJussi Maki int tc_dst(struct __sk_buff *skb)
88eef4a011SDaniel Borkmann {
89eef4a011SDaniel Borkmann __u8 zero[ETH_ALEN * 2];
90eef4a011SDaniel Borkmann bool redirect = false;
91eef4a011SDaniel Borkmann
92eef4a011SDaniel Borkmann switch (skb->protocol) {
93eef4a011SDaniel Borkmann case __bpf_constant_htons(ETH_P_IP):
94eef4a011SDaniel Borkmann redirect = is_remote_ep_v4(skb, __bpf_constant_htonl(ip4_src));
95eef4a011SDaniel Borkmann break;
96eef4a011SDaniel Borkmann case __bpf_constant_htons(ETH_P_IPV6):
97*c8ed6685SAndrii Nakryiko redirect = is_remote_ep_v6(skb, (struct in6_addr){{ip6_src}});
98eef4a011SDaniel Borkmann break;
99eef4a011SDaniel Borkmann }
100eef4a011SDaniel Borkmann
101eef4a011SDaniel Borkmann if (!redirect)
102eef4a011SDaniel Borkmann return TC_ACT_OK;
103eef4a011SDaniel Borkmann
104eef4a011SDaniel Borkmann __builtin_memset(&zero, 0, sizeof(zero));
105eef4a011SDaniel Borkmann if (bpf_skb_store_bytes(skb, 0, &zero, sizeof(zero), 0) < 0)
106eef4a011SDaniel Borkmann return TC_ACT_SHOT;
107eef4a011SDaniel Borkmann
108096eccdeSJussi Maki return bpf_redirect_neigh(IFINDEX_SRC, NULL, 0, 0);
109eef4a011SDaniel Borkmann }
110eef4a011SDaniel Borkmann
111c22bdd28SAndrii Nakryiko SEC("tc")
tc_src(struct __sk_buff * skb)112096eccdeSJussi Maki int tc_src(struct __sk_buff *skb)
113eef4a011SDaniel Borkmann {
114eef4a011SDaniel Borkmann __u8 zero[ETH_ALEN * 2];
115eef4a011SDaniel Borkmann bool redirect = false;
116eef4a011SDaniel Borkmann
117eef4a011SDaniel Borkmann switch (skb->protocol) {
118eef4a011SDaniel Borkmann case __bpf_constant_htons(ETH_P_IP):
119eef4a011SDaniel Borkmann redirect = is_remote_ep_v4(skb, __bpf_constant_htonl(ip4_dst));
120eef4a011SDaniel Borkmann break;
121eef4a011SDaniel Borkmann case __bpf_constant_htons(ETH_P_IPV6):
122*c8ed6685SAndrii Nakryiko redirect = is_remote_ep_v6(skb, (struct in6_addr){{ip6_dst}});
123eef4a011SDaniel Borkmann break;
124eef4a011SDaniel Borkmann }
125eef4a011SDaniel Borkmann
126eef4a011SDaniel Borkmann if (!redirect)
127eef4a011SDaniel Borkmann return TC_ACT_OK;
128eef4a011SDaniel Borkmann
129eef4a011SDaniel Borkmann __builtin_memset(&zero, 0, sizeof(zero));
130eef4a011SDaniel Borkmann if (bpf_skb_store_bytes(skb, 0, &zero, sizeof(zero), 0) < 0)
131eef4a011SDaniel Borkmann return TC_ACT_SHOT;
132eef4a011SDaniel Borkmann
133096eccdeSJussi Maki return bpf_redirect_neigh(IFINDEX_DST, NULL, 0, 0);
134eef4a011SDaniel Borkmann }
135eef4a011SDaniel Borkmann
136eef4a011SDaniel Borkmann char __license[] SEC("license") = "GPL";
137