198cdabcdSWillem de Bruijn // SPDX-License-Identifier: GPL-2.0
298cdabcdSWillem de Bruijn
398cdabcdSWillem de Bruijn /* In-place tunneling */
498cdabcdSWillem de Bruijn
57255fadeSWillem de Bruijn #include <stdbool.h>
67255fadeSWillem de Bruijn #include <string.h>
77255fadeSWillem de Bruijn
898cdabcdSWillem de Bruijn #include <linux/stddef.h>
998cdabcdSWillem de Bruijn #include <linux/bpf.h>
1098cdabcdSWillem de Bruijn #include <linux/if_ether.h>
1198cdabcdSWillem de Bruijn #include <linux/in.h>
1298cdabcdSWillem de Bruijn #include <linux/ip.h>
13ef81bd05SWillem de Bruijn #include <linux/ipv6.h>
143ec61df8SAlan Maguire #include <linux/mpls.h>
1598cdabcdSWillem de Bruijn #include <linux/tcp.h>
16166b5a7fSAlan Maguire #include <linux/udp.h>
1798cdabcdSWillem de Bruijn #include <linux/pkt_cls.h>
1898cdabcdSWillem de Bruijn #include <linux/types.h>
1998cdabcdSWillem de Bruijn
203e689141SToke Høiland-Jørgensen #include <bpf/bpf_endian.h>
213e689141SToke Høiland-Jørgensen #include <bpf/bpf_helpers.h>
2298cdabcdSWillem de Bruijn
2398cdabcdSWillem de Bruijn static const int cfg_port = 8000;
2498cdabcdSWillem de Bruijn
25166b5a7fSAlan Maguire static const int cfg_udp_src = 20000;
263ec61df8SAlan Maguire
27256becd4SXuesen Huang #define L2_PAD_SZ (sizeof(struct vxlanhdr) + ETH_HLEN)
28256becd4SXuesen Huang
293ec61df8SAlan Maguire #define UDP_PORT 5555
303ec61df8SAlan Maguire #define MPLS_OVER_UDP_PORT 6635
313ec61df8SAlan Maguire #define ETH_OVER_UDP_PORT 7777
32256becd4SXuesen Huang #define VXLAN_UDP_PORT 8472
33256becd4SXuesen Huang
34256becd4SXuesen Huang #define EXTPROTO_VXLAN 0x1
35256becd4SXuesen Huang
36256becd4SXuesen Huang #define VXLAN_N_VID (1u << 24)
37256becd4SXuesen Huang #define VXLAN_VNI_MASK bpf_htonl((VXLAN_N_VID - 1) << 8)
38256becd4SXuesen Huang #define VXLAN_FLAGS 0x8
39256becd4SXuesen Huang #define VXLAN_VNI 1
403ec61df8SAlan Maguire
41*7105f76fSZiyang Xuan #ifndef NEXTHDR_DEST
42*7105f76fSZiyang Xuan #define NEXTHDR_DEST 60
43*7105f76fSZiyang Xuan #endif
44*7105f76fSZiyang Xuan
453ec61df8SAlan Maguire /* MPLS label 1000 with S bit (last label) set and ttl of 255. */
463ec61df8SAlan Maguire static const __u32 mpls_label = __bpf_constant_htonl(1000 << 12 |
473ec61df8SAlan Maguire MPLS_LS_S_MASK | 0xff);
48166b5a7fSAlan Maguire
49256becd4SXuesen Huang struct vxlanhdr {
50256becd4SXuesen Huang __be32 vx_flags;
51256becd4SXuesen Huang __be32 vx_vni;
52256becd4SXuesen Huang } __attribute__((packed));
53256becd4SXuesen Huang
54166b5a7fSAlan Maguire struct gre_hdr {
557255fadeSWillem de Bruijn __be16 flags;
567255fadeSWillem de Bruijn __be16 protocol;
577255fadeSWillem de Bruijn } __attribute__((packed));
587255fadeSWillem de Bruijn
59166b5a7fSAlan Maguire union l4hdr {
60166b5a7fSAlan Maguire struct udphdr udp;
61166b5a7fSAlan Maguire struct gre_hdr gre;
62166b5a7fSAlan Maguire };
63166b5a7fSAlan Maguire
64166b5a7fSAlan Maguire struct v4hdr {
65166b5a7fSAlan Maguire struct iphdr ip;
66166b5a7fSAlan Maguire union l4hdr l4hdr;
67256becd4SXuesen Huang __u8 pad[L2_PAD_SZ]; /* space for L2 header / vxlan header ... */
68166b5a7fSAlan Maguire } __attribute__((packed));
69166b5a7fSAlan Maguire
70166b5a7fSAlan Maguire struct v6hdr {
717255fadeSWillem de Bruijn struct ipv6hdr ip;
72166b5a7fSAlan Maguire union l4hdr l4hdr;
73256becd4SXuesen Huang __u8 pad[L2_PAD_SZ]; /* space for L2 header / vxlan header ... */
747255fadeSWillem de Bruijn } __attribute__((packed));
757255fadeSWillem de Bruijn
set_ipv4_csum(struct iphdr * iph)7698cdabcdSWillem de Bruijn static __always_inline void set_ipv4_csum(struct iphdr *iph)
7798cdabcdSWillem de Bruijn {
7898cdabcdSWillem de Bruijn __u16 *iph16 = (__u16 *)iph;
7998cdabcdSWillem de Bruijn __u32 csum;
8098cdabcdSWillem de Bruijn int i;
8198cdabcdSWillem de Bruijn
8298cdabcdSWillem de Bruijn iph->check = 0;
8398cdabcdSWillem de Bruijn
8498cdabcdSWillem de Bruijn #pragma clang loop unroll(full)
8598cdabcdSWillem de Bruijn for (i = 0, csum = 0; i < sizeof(*iph) >> 1; i++)
8698cdabcdSWillem de Bruijn csum += *iph16++;
8798cdabcdSWillem de Bruijn
8898cdabcdSWillem de Bruijn iph->check = ~((csum & 0xffff) + (csum >> 16));
8998cdabcdSWillem de Bruijn }
9098cdabcdSWillem de Bruijn
__encap_ipv4(struct __sk_buff * skb,__u8 encap_proto,__u16 l2_proto,__u16 ext_proto)91256becd4SXuesen Huang static __always_inline int __encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
92256becd4SXuesen Huang __u16 l2_proto, __u16 ext_proto)
9398cdabcdSWillem de Bruijn {
943ec61df8SAlan Maguire __u16 udp_dst = UDP_PORT;
957255fadeSWillem de Bruijn struct iphdr iph_inner;
96166b5a7fSAlan Maguire struct v4hdr h_outer;
9798cdabcdSWillem de Bruijn struct tcphdr tcph;
983ec61df8SAlan Maguire int olen, l2_len;
99256becd4SXuesen Huang __u8 *l2_hdr = NULL;
100f6ad6accSWillem de Bruijn int tcp_off;
10194f16813SWillem de Bruijn __u64 flags;
10298cdabcdSWillem de Bruijn
103f6ad6accSWillem de Bruijn /* Most tests encapsulate a packet into a tunnel with the same
104f6ad6accSWillem de Bruijn * network protocol, and derive the outer header fields from
105f6ad6accSWillem de Bruijn * the inner header.
106f6ad6accSWillem de Bruijn *
107f6ad6accSWillem de Bruijn * The 6in4 case tests different inner and outer protocols. As
108f6ad6accSWillem de Bruijn * the inner is ipv6, but the outer expects an ipv4 header as
109f6ad6accSWillem de Bruijn * input, manually build a struct iphdr based on the ipv6hdr.
110f6ad6accSWillem de Bruijn */
111f6ad6accSWillem de Bruijn if (encap_proto == IPPROTO_IPV6) {
112f6ad6accSWillem de Bruijn const __u32 saddr = (192 << 24) | (168 << 16) | (1 << 8) | 1;
113f6ad6accSWillem de Bruijn const __u32 daddr = (192 << 24) | (168 << 16) | (1 << 8) | 2;
114f6ad6accSWillem de Bruijn struct ipv6hdr iph6_inner;
115f6ad6accSWillem de Bruijn
116f6ad6accSWillem de Bruijn /* Read the IPv6 header */
117f6ad6accSWillem de Bruijn if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph6_inner,
118f6ad6accSWillem de Bruijn sizeof(iph6_inner)) < 0)
119f6ad6accSWillem de Bruijn return TC_ACT_OK;
120f6ad6accSWillem de Bruijn
121f6ad6accSWillem de Bruijn /* Derive the IPv4 header fields from the IPv6 header */
122f6ad6accSWillem de Bruijn memset(&iph_inner, 0, sizeof(iph_inner));
123f6ad6accSWillem de Bruijn iph_inner.version = 4;
124f6ad6accSWillem de Bruijn iph_inner.ihl = 5;
125f6ad6accSWillem de Bruijn iph_inner.tot_len = bpf_htons(sizeof(iph6_inner) +
126f6ad6accSWillem de Bruijn bpf_ntohs(iph6_inner.payload_len));
127f6ad6accSWillem de Bruijn iph_inner.ttl = iph6_inner.hop_limit - 1;
128f6ad6accSWillem de Bruijn iph_inner.protocol = iph6_inner.nexthdr;
129f6ad6accSWillem de Bruijn iph_inner.saddr = __bpf_constant_htonl(saddr);
130f6ad6accSWillem de Bruijn iph_inner.daddr = __bpf_constant_htonl(daddr);
131f6ad6accSWillem de Bruijn
132f6ad6accSWillem de Bruijn tcp_off = sizeof(iph6_inner);
133f6ad6accSWillem de Bruijn } else {
13498cdabcdSWillem de Bruijn if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
13598cdabcdSWillem de Bruijn sizeof(iph_inner)) < 0)
13698cdabcdSWillem de Bruijn return TC_ACT_OK;
13798cdabcdSWillem de Bruijn
138f6ad6accSWillem de Bruijn tcp_off = sizeof(iph_inner);
139f6ad6accSWillem de Bruijn }
140f6ad6accSWillem de Bruijn
14198cdabcdSWillem de Bruijn /* filter only packets we want */
14298cdabcdSWillem de Bruijn if (iph_inner.ihl != 5 || iph_inner.protocol != IPPROTO_TCP)
14398cdabcdSWillem de Bruijn return TC_ACT_OK;
14498cdabcdSWillem de Bruijn
145f6ad6accSWillem de Bruijn if (bpf_skb_load_bytes(skb, ETH_HLEN + tcp_off,
14698cdabcdSWillem de Bruijn &tcph, sizeof(tcph)) < 0)
14798cdabcdSWillem de Bruijn return TC_ACT_OK;
14898cdabcdSWillem de Bruijn
14998cdabcdSWillem de Bruijn if (tcph.dest != __bpf_constant_htons(cfg_port))
15098cdabcdSWillem de Bruijn return TC_ACT_OK;
15198cdabcdSWillem de Bruijn
15275a1a9faSWillem de Bruijn olen = sizeof(h_outer.ip);
1533ec61df8SAlan Maguire l2_len = 0;
154166b5a7fSAlan Maguire
155166b5a7fSAlan Maguire flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV4;
1563ec61df8SAlan Maguire
1573ec61df8SAlan Maguire switch (l2_proto) {
1583ec61df8SAlan Maguire case ETH_P_MPLS_UC:
1593ec61df8SAlan Maguire l2_len = sizeof(mpls_label);
1603ec61df8SAlan Maguire udp_dst = MPLS_OVER_UDP_PORT;
1613ec61df8SAlan Maguire break;
1623ec61df8SAlan Maguire case ETH_P_TEB:
1633ec61df8SAlan Maguire l2_len = ETH_HLEN;
164256becd4SXuesen Huang if (ext_proto & EXTPROTO_VXLAN) {
165256becd4SXuesen Huang udp_dst = VXLAN_UDP_PORT;
166256becd4SXuesen Huang l2_len += sizeof(struct vxlanhdr);
167256becd4SXuesen Huang } else
1683ec61df8SAlan Maguire udp_dst = ETH_OVER_UDP_PORT;
1693ec61df8SAlan Maguire break;
1703ec61df8SAlan Maguire }
1713ec61df8SAlan Maguire flags |= BPF_F_ADJ_ROOM_ENCAP_L2(l2_len);
1723ec61df8SAlan Maguire
173166b5a7fSAlan Maguire switch (encap_proto) {
174166b5a7fSAlan Maguire case IPPROTO_GRE:
175166b5a7fSAlan Maguire flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
176166b5a7fSAlan Maguire olen += sizeof(h_outer.l4hdr.gre);
1773ec61df8SAlan Maguire h_outer.l4hdr.gre.protocol = bpf_htons(l2_proto);
178166b5a7fSAlan Maguire h_outer.l4hdr.gre.flags = 0;
179166b5a7fSAlan Maguire break;
180166b5a7fSAlan Maguire case IPPROTO_UDP:
181166b5a7fSAlan Maguire flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
182166b5a7fSAlan Maguire olen += sizeof(h_outer.l4hdr.udp);
183166b5a7fSAlan Maguire h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
1843ec61df8SAlan Maguire h_outer.l4hdr.udp.dest = bpf_htons(udp_dst);
185166b5a7fSAlan Maguire h_outer.l4hdr.udp.check = 0;
186166b5a7fSAlan Maguire h_outer.l4hdr.udp.len = bpf_htons(bpf_ntohs(iph_inner.tot_len) +
1873ec61df8SAlan Maguire sizeof(h_outer.l4hdr.udp) +
1883ec61df8SAlan Maguire l2_len);
189166b5a7fSAlan Maguire break;
190166b5a7fSAlan Maguire case IPPROTO_IPIP:
191f6ad6accSWillem de Bruijn case IPPROTO_IPV6:
192166b5a7fSAlan Maguire break;
193166b5a7fSAlan Maguire default:
194166b5a7fSAlan Maguire return TC_ACT_OK;
19575a1a9faSWillem de Bruijn }
1967255fadeSWillem de Bruijn
1973ec61df8SAlan Maguire /* add L2 encap (if specified) */
198256becd4SXuesen Huang l2_hdr = (__u8 *)&h_outer + olen;
1993ec61df8SAlan Maguire switch (l2_proto) {
2003ec61df8SAlan Maguire case ETH_P_MPLS_UC:
201256becd4SXuesen Huang *(__u32 *)l2_hdr = mpls_label;
2023ec61df8SAlan Maguire break;
2033ec61df8SAlan Maguire case ETH_P_TEB:
204256becd4SXuesen Huang flags |= BPF_F_ADJ_ROOM_ENCAP_L2_ETH;
205256becd4SXuesen Huang
206256becd4SXuesen Huang if (ext_proto & EXTPROTO_VXLAN) {
207256becd4SXuesen Huang struct vxlanhdr *vxlan_hdr = (struct vxlanhdr *)l2_hdr;
208256becd4SXuesen Huang
209256becd4SXuesen Huang vxlan_hdr->vx_flags = VXLAN_FLAGS;
210256becd4SXuesen Huang vxlan_hdr->vx_vni = bpf_htonl((VXLAN_VNI & VXLAN_VNI_MASK) << 8);
211256becd4SXuesen Huang
212256becd4SXuesen Huang l2_hdr += sizeof(struct vxlanhdr);
213256becd4SXuesen Huang }
214256becd4SXuesen Huang
215256becd4SXuesen Huang if (bpf_skb_load_bytes(skb, 0, l2_hdr, ETH_HLEN))
2163ec61df8SAlan Maguire return TC_ACT_SHOT;
217256becd4SXuesen Huang
2183ec61df8SAlan Maguire break;
2193ec61df8SAlan Maguire }
2203ec61df8SAlan Maguire olen += l2_len;
2213ec61df8SAlan Maguire
22298cdabcdSWillem de Bruijn /* add room between mac and network header */
22394f16813SWillem de Bruijn if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
22498cdabcdSWillem de Bruijn return TC_ACT_SHOT;
22598cdabcdSWillem de Bruijn
22698cdabcdSWillem de Bruijn /* prepare new outer network header */
2277255fadeSWillem de Bruijn h_outer.ip = iph_inner;
2287255fadeSWillem de Bruijn h_outer.ip.tot_len = bpf_htons(olen +
229166b5a7fSAlan Maguire bpf_ntohs(h_outer.ip.tot_len));
230166b5a7fSAlan Maguire h_outer.ip.protocol = encap_proto;
2317255fadeSWillem de Bruijn
232bcbccad6SStanislav Fomichev set_ipv4_csum((void *)&h_outer.ip);
23398cdabcdSWillem de Bruijn
23498cdabcdSWillem de Bruijn /* store new outer network header */
2357255fadeSWillem de Bruijn if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
23698cdabcdSWillem de Bruijn BPF_F_INVALIDATE_HASH) < 0)
23798cdabcdSWillem de Bruijn return TC_ACT_SHOT;
23898cdabcdSWillem de Bruijn
239f6ad6accSWillem de Bruijn /* if changing outer proto type, update eth->h_proto */
240f6ad6accSWillem de Bruijn if (encap_proto == IPPROTO_IPV6) {
241f6ad6accSWillem de Bruijn struct ethhdr eth;
242f6ad6accSWillem de Bruijn
243f6ad6accSWillem de Bruijn if (bpf_skb_load_bytes(skb, 0, ð, sizeof(eth)) < 0)
244f6ad6accSWillem de Bruijn return TC_ACT_SHOT;
245f6ad6accSWillem de Bruijn eth.h_proto = bpf_htons(ETH_P_IP);
246f6ad6accSWillem de Bruijn if (bpf_skb_store_bytes(skb, 0, ð, sizeof(eth), 0) < 0)
247f6ad6accSWillem de Bruijn return TC_ACT_SHOT;
248f6ad6accSWillem de Bruijn }
249f6ad6accSWillem de Bruijn
25098cdabcdSWillem de Bruijn return TC_ACT_OK;
25198cdabcdSWillem de Bruijn }
25298cdabcdSWillem de Bruijn
encap_ipv4(struct __sk_buff * skb,__u8 encap_proto,__u16 l2_proto)253256becd4SXuesen Huang static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
2543ec61df8SAlan Maguire __u16 l2_proto)
255ccd34cd3SWillem de Bruijn {
256256becd4SXuesen Huang return __encap_ipv4(skb, encap_proto, l2_proto, 0);
257256becd4SXuesen Huang }
258256becd4SXuesen Huang
__encap_ipv6(struct __sk_buff * skb,__u8 encap_proto,__u16 l2_proto,__u16 ext_proto)259256becd4SXuesen Huang static __always_inline int __encap_ipv6(struct __sk_buff *skb, __u8 encap_proto,
260256becd4SXuesen Huang __u16 l2_proto, __u16 ext_proto)
261256becd4SXuesen Huang {
2623ec61df8SAlan Maguire __u16 udp_dst = UDP_PORT;
2637255fadeSWillem de Bruijn struct ipv6hdr iph_inner;
264166b5a7fSAlan Maguire struct v6hdr h_outer;
265ef81bd05SWillem de Bruijn struct tcphdr tcph;
2663ec61df8SAlan Maguire int olen, l2_len;
267256becd4SXuesen Huang __u8 *l2_hdr = NULL;
268166b5a7fSAlan Maguire __u16 tot_len;
26994f16813SWillem de Bruijn __u64 flags;
270ccd34cd3SWillem de Bruijn
271ef81bd05SWillem de Bruijn if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
272ef81bd05SWillem de Bruijn sizeof(iph_inner)) < 0)
273ccd34cd3SWillem de Bruijn return TC_ACT_OK;
274ccd34cd3SWillem de Bruijn
275ef81bd05SWillem de Bruijn /* filter only packets we want */
276ef81bd05SWillem de Bruijn if (bpf_skb_load_bytes(skb, ETH_HLEN + sizeof(iph_inner),
277ef81bd05SWillem de Bruijn &tcph, sizeof(tcph)) < 0)
278ef81bd05SWillem de Bruijn return TC_ACT_OK;
279ef81bd05SWillem de Bruijn
280ef81bd05SWillem de Bruijn if (tcph.dest != __bpf_constant_htons(cfg_port))
281ef81bd05SWillem de Bruijn return TC_ACT_OK;
282ef81bd05SWillem de Bruijn
28375a1a9faSWillem de Bruijn olen = sizeof(h_outer.ip);
2843ec61df8SAlan Maguire l2_len = 0;
28575a1a9faSWillem de Bruijn
286166b5a7fSAlan Maguire flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV6;
2873ec61df8SAlan Maguire
2883ec61df8SAlan Maguire switch (l2_proto) {
2893ec61df8SAlan Maguire case ETH_P_MPLS_UC:
2903ec61df8SAlan Maguire l2_len = sizeof(mpls_label);
2913ec61df8SAlan Maguire udp_dst = MPLS_OVER_UDP_PORT;
2923ec61df8SAlan Maguire break;
2933ec61df8SAlan Maguire case ETH_P_TEB:
2943ec61df8SAlan Maguire l2_len = ETH_HLEN;
295256becd4SXuesen Huang if (ext_proto & EXTPROTO_VXLAN) {
296256becd4SXuesen Huang udp_dst = VXLAN_UDP_PORT;
297256becd4SXuesen Huang l2_len += sizeof(struct vxlanhdr);
298256becd4SXuesen Huang } else
2993ec61df8SAlan Maguire udp_dst = ETH_OVER_UDP_PORT;
3003ec61df8SAlan Maguire break;
3013ec61df8SAlan Maguire }
3023ec61df8SAlan Maguire flags |= BPF_F_ADJ_ROOM_ENCAP_L2(l2_len);
3033ec61df8SAlan Maguire
304166b5a7fSAlan Maguire switch (encap_proto) {
305166b5a7fSAlan Maguire case IPPROTO_GRE:
306166b5a7fSAlan Maguire flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
307166b5a7fSAlan Maguire olen += sizeof(h_outer.l4hdr.gre);
3083ec61df8SAlan Maguire h_outer.l4hdr.gre.protocol = bpf_htons(l2_proto);
309166b5a7fSAlan Maguire h_outer.l4hdr.gre.flags = 0;
310166b5a7fSAlan Maguire break;
311166b5a7fSAlan Maguire case IPPROTO_UDP:
312166b5a7fSAlan Maguire flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
313166b5a7fSAlan Maguire olen += sizeof(h_outer.l4hdr.udp);
314166b5a7fSAlan Maguire h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
3153ec61df8SAlan Maguire h_outer.l4hdr.udp.dest = bpf_htons(udp_dst);
316166b5a7fSAlan Maguire tot_len = bpf_ntohs(iph_inner.payload_len) + sizeof(iph_inner) +
317256becd4SXuesen Huang sizeof(h_outer.l4hdr.udp) + l2_len;
318166b5a7fSAlan Maguire h_outer.l4hdr.udp.check = 0;
319166b5a7fSAlan Maguire h_outer.l4hdr.udp.len = bpf_htons(tot_len);
320166b5a7fSAlan Maguire break;
321166b5a7fSAlan Maguire case IPPROTO_IPV6:
322166b5a7fSAlan Maguire break;
323166b5a7fSAlan Maguire default:
324166b5a7fSAlan Maguire return TC_ACT_OK;
325166b5a7fSAlan Maguire }
3267255fadeSWillem de Bruijn
3273ec61df8SAlan Maguire /* add L2 encap (if specified) */
328256becd4SXuesen Huang l2_hdr = (__u8 *)&h_outer + olen;
3293ec61df8SAlan Maguire switch (l2_proto) {
3303ec61df8SAlan Maguire case ETH_P_MPLS_UC:
331256becd4SXuesen Huang *(__u32 *)l2_hdr = mpls_label;
3323ec61df8SAlan Maguire break;
3333ec61df8SAlan Maguire case ETH_P_TEB:
334256becd4SXuesen Huang flags |= BPF_F_ADJ_ROOM_ENCAP_L2_ETH;
335256becd4SXuesen Huang
336256becd4SXuesen Huang if (ext_proto & EXTPROTO_VXLAN) {
337256becd4SXuesen Huang struct vxlanhdr *vxlan_hdr = (struct vxlanhdr *)l2_hdr;
338256becd4SXuesen Huang
339256becd4SXuesen Huang vxlan_hdr->vx_flags = VXLAN_FLAGS;
340256becd4SXuesen Huang vxlan_hdr->vx_vni = bpf_htonl((VXLAN_VNI & VXLAN_VNI_MASK) << 8);
341256becd4SXuesen Huang
342256becd4SXuesen Huang l2_hdr += sizeof(struct vxlanhdr);
343256becd4SXuesen Huang }
344256becd4SXuesen Huang
345256becd4SXuesen Huang if (bpf_skb_load_bytes(skb, 0, l2_hdr, ETH_HLEN))
3463ec61df8SAlan Maguire return TC_ACT_SHOT;
3473ec61df8SAlan Maguire break;
3483ec61df8SAlan Maguire }
3493ec61df8SAlan Maguire olen += l2_len;
3503ec61df8SAlan Maguire
351ef81bd05SWillem de Bruijn /* add room between mac and network header */
35294f16813SWillem de Bruijn if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
353ef81bd05SWillem de Bruijn return TC_ACT_SHOT;
354ef81bd05SWillem de Bruijn
355ef81bd05SWillem de Bruijn /* prepare new outer network header */
3567255fadeSWillem de Bruijn h_outer.ip = iph_inner;
3577255fadeSWillem de Bruijn h_outer.ip.payload_len = bpf_htons(olen +
3587255fadeSWillem de Bruijn bpf_ntohs(h_outer.ip.payload_len));
359166b5a7fSAlan Maguire
360166b5a7fSAlan Maguire h_outer.ip.nexthdr = encap_proto;
361ef81bd05SWillem de Bruijn
362ef81bd05SWillem de Bruijn /* store new outer network header */
3637255fadeSWillem de Bruijn if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
364ef81bd05SWillem de Bruijn BPF_F_INVALIDATE_HASH) < 0)
365ef81bd05SWillem de Bruijn return TC_ACT_SHOT;
366ef81bd05SWillem de Bruijn
367ef81bd05SWillem de Bruijn return TC_ACT_OK;
368ef81bd05SWillem de Bruijn }
369ef81bd05SWillem de Bruijn
encap_ipv6_ipip6(struct __sk_buff * skb)370*7105f76fSZiyang Xuan static int encap_ipv6_ipip6(struct __sk_buff *skb)
371*7105f76fSZiyang Xuan {
372*7105f76fSZiyang Xuan struct iphdr iph_inner;
373*7105f76fSZiyang Xuan struct v6hdr h_outer;
374*7105f76fSZiyang Xuan struct tcphdr tcph;
375*7105f76fSZiyang Xuan struct ethhdr eth;
376*7105f76fSZiyang Xuan __u64 flags;
377*7105f76fSZiyang Xuan int olen;
378*7105f76fSZiyang Xuan
379*7105f76fSZiyang Xuan if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
380*7105f76fSZiyang Xuan sizeof(iph_inner)) < 0)
381*7105f76fSZiyang Xuan return TC_ACT_OK;
382*7105f76fSZiyang Xuan
383*7105f76fSZiyang Xuan /* filter only packets we want */
384*7105f76fSZiyang Xuan if (bpf_skb_load_bytes(skb, ETH_HLEN + (iph_inner.ihl << 2),
385*7105f76fSZiyang Xuan &tcph, sizeof(tcph)) < 0)
386*7105f76fSZiyang Xuan return TC_ACT_OK;
387*7105f76fSZiyang Xuan
388*7105f76fSZiyang Xuan if (tcph.dest != __bpf_constant_htons(cfg_port))
389*7105f76fSZiyang Xuan return TC_ACT_OK;
390*7105f76fSZiyang Xuan
391*7105f76fSZiyang Xuan olen = sizeof(h_outer.ip);
392*7105f76fSZiyang Xuan
393*7105f76fSZiyang Xuan flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV6;
394*7105f76fSZiyang Xuan
395*7105f76fSZiyang Xuan /* add room between mac and network header */
396*7105f76fSZiyang Xuan if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
397*7105f76fSZiyang Xuan return TC_ACT_SHOT;
398*7105f76fSZiyang Xuan
399*7105f76fSZiyang Xuan /* prepare new outer network header */
400*7105f76fSZiyang Xuan memset(&h_outer.ip, 0, sizeof(h_outer.ip));
401*7105f76fSZiyang Xuan h_outer.ip.version = 6;
402*7105f76fSZiyang Xuan h_outer.ip.hop_limit = iph_inner.ttl;
403*7105f76fSZiyang Xuan h_outer.ip.saddr.s6_addr[1] = 0xfd;
404*7105f76fSZiyang Xuan h_outer.ip.saddr.s6_addr[15] = 1;
405*7105f76fSZiyang Xuan h_outer.ip.daddr.s6_addr[1] = 0xfd;
406*7105f76fSZiyang Xuan h_outer.ip.daddr.s6_addr[15] = 2;
407*7105f76fSZiyang Xuan h_outer.ip.payload_len = iph_inner.tot_len;
408*7105f76fSZiyang Xuan h_outer.ip.nexthdr = IPPROTO_IPIP;
409*7105f76fSZiyang Xuan
410*7105f76fSZiyang Xuan /* store new outer network header */
411*7105f76fSZiyang Xuan if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
412*7105f76fSZiyang Xuan BPF_F_INVALIDATE_HASH) < 0)
413*7105f76fSZiyang Xuan return TC_ACT_SHOT;
414*7105f76fSZiyang Xuan
415*7105f76fSZiyang Xuan /* update eth->h_proto */
416*7105f76fSZiyang Xuan if (bpf_skb_load_bytes(skb, 0, ð, sizeof(eth)) < 0)
417*7105f76fSZiyang Xuan return TC_ACT_SHOT;
418*7105f76fSZiyang Xuan eth.h_proto = bpf_htons(ETH_P_IPV6);
419*7105f76fSZiyang Xuan if (bpf_skb_store_bytes(skb, 0, ð, sizeof(eth), 0) < 0)
420*7105f76fSZiyang Xuan return TC_ACT_SHOT;
421*7105f76fSZiyang Xuan
422*7105f76fSZiyang Xuan return TC_ACT_OK;
423*7105f76fSZiyang Xuan }
424*7105f76fSZiyang Xuan
encap_ipv6(struct __sk_buff * skb,__u8 encap_proto,__u16 l2_proto)425256becd4SXuesen Huang static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto,
426256becd4SXuesen Huang __u16 l2_proto)
427256becd4SXuesen Huang {
428256becd4SXuesen Huang return __encap_ipv6(skb, encap_proto, l2_proto, 0);
429256becd4SXuesen Huang }
430256becd4SXuesen Huang
4313ec61df8SAlan Maguire SEC("encap_ipip_none")
__encap_ipip_none(struct __sk_buff * skb)4323ec61df8SAlan Maguire int __encap_ipip_none(struct __sk_buff *skb)
433ef81bd05SWillem de Bruijn {
4347255fadeSWillem de Bruijn if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
4353ec61df8SAlan Maguire return encap_ipv4(skb, IPPROTO_IPIP, ETH_P_IP);
4367255fadeSWillem de Bruijn else
4377255fadeSWillem de Bruijn return TC_ACT_OK;
4387255fadeSWillem de Bruijn }
4397255fadeSWillem de Bruijn
4403ec61df8SAlan Maguire SEC("encap_gre_none")
__encap_gre_none(struct __sk_buff * skb)4413ec61df8SAlan Maguire int __encap_gre_none(struct __sk_buff *skb)
4427255fadeSWillem de Bruijn {
4437255fadeSWillem de Bruijn if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
4443ec61df8SAlan Maguire return encap_ipv4(skb, IPPROTO_GRE, ETH_P_IP);
445166b5a7fSAlan Maguire else
446166b5a7fSAlan Maguire return TC_ACT_OK;
447166b5a7fSAlan Maguire }
448166b5a7fSAlan Maguire
4493ec61df8SAlan Maguire SEC("encap_gre_mpls")
__encap_gre_mpls(struct __sk_buff * skb)4503ec61df8SAlan Maguire int __encap_gre_mpls(struct __sk_buff *skb)
451166b5a7fSAlan Maguire {
452166b5a7fSAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
4533ec61df8SAlan Maguire return encap_ipv4(skb, IPPROTO_GRE, ETH_P_MPLS_UC);
4547255fadeSWillem de Bruijn else
4557255fadeSWillem de Bruijn return TC_ACT_OK;
4567255fadeSWillem de Bruijn }
4577255fadeSWillem de Bruijn
4583ec61df8SAlan Maguire SEC("encap_gre_eth")
__encap_gre_eth(struct __sk_buff * skb)4593ec61df8SAlan Maguire int __encap_gre_eth(struct __sk_buff *skb)
4607255fadeSWillem de Bruijn {
4613ec61df8SAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
4623ec61df8SAlan Maguire return encap_ipv4(skb, IPPROTO_GRE, ETH_P_TEB);
4637255fadeSWillem de Bruijn else
4647255fadeSWillem de Bruijn return TC_ACT_OK;
4657255fadeSWillem de Bruijn }
4667255fadeSWillem de Bruijn
4673ec61df8SAlan Maguire SEC("encap_udp_none")
__encap_udp_none(struct __sk_buff * skb)4683ec61df8SAlan Maguire int __encap_udp_none(struct __sk_buff *skb)
4697255fadeSWillem de Bruijn {
4703ec61df8SAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
4713ec61df8SAlan Maguire return encap_ipv4(skb, IPPROTO_UDP, ETH_P_IP);
472166b5a7fSAlan Maguire else
473166b5a7fSAlan Maguire return TC_ACT_OK;
474166b5a7fSAlan Maguire }
475166b5a7fSAlan Maguire
4763ec61df8SAlan Maguire SEC("encap_udp_mpls")
__encap_udp_mpls(struct __sk_buff * skb)4773ec61df8SAlan Maguire int __encap_udp_mpls(struct __sk_buff *skb)
4783ec61df8SAlan Maguire {
4793ec61df8SAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
4803ec61df8SAlan Maguire return encap_ipv4(skb, IPPROTO_UDP, ETH_P_MPLS_UC);
4813ec61df8SAlan Maguire else
4823ec61df8SAlan Maguire return TC_ACT_OK;
4833ec61df8SAlan Maguire }
4843ec61df8SAlan Maguire
4853ec61df8SAlan Maguire SEC("encap_udp_eth")
__encap_udp_eth(struct __sk_buff * skb)4863ec61df8SAlan Maguire int __encap_udp_eth(struct __sk_buff *skb)
4873ec61df8SAlan Maguire {
4883ec61df8SAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
4893ec61df8SAlan Maguire return encap_ipv4(skb, IPPROTO_UDP, ETH_P_TEB);
4903ec61df8SAlan Maguire else
4913ec61df8SAlan Maguire return TC_ACT_OK;
4923ec61df8SAlan Maguire }
4933ec61df8SAlan Maguire
494256becd4SXuesen Huang SEC("encap_vxlan_eth")
__encap_vxlan_eth(struct __sk_buff * skb)495256becd4SXuesen Huang int __encap_vxlan_eth(struct __sk_buff *skb)
496256becd4SXuesen Huang {
497256becd4SXuesen Huang if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
498256becd4SXuesen Huang return __encap_ipv4(skb, IPPROTO_UDP,
499256becd4SXuesen Huang ETH_P_TEB,
500256becd4SXuesen Huang EXTPROTO_VXLAN);
501256becd4SXuesen Huang else
502256becd4SXuesen Huang return TC_ACT_OK;
503256becd4SXuesen Huang }
504256becd4SXuesen Huang
505f6ad6accSWillem de Bruijn SEC("encap_sit_none")
__encap_sit_none(struct __sk_buff * skb)506f6ad6accSWillem de Bruijn int __encap_sit_none(struct __sk_buff *skb)
507f6ad6accSWillem de Bruijn {
508f6ad6accSWillem de Bruijn if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
509f6ad6accSWillem de Bruijn return encap_ipv4(skb, IPPROTO_IPV6, ETH_P_IP);
510f6ad6accSWillem de Bruijn else
511f6ad6accSWillem de Bruijn return TC_ACT_OK;
512f6ad6accSWillem de Bruijn }
513f6ad6accSWillem de Bruijn
5143ec61df8SAlan Maguire SEC("encap_ip6tnl_none")
__encap_ip6tnl_none(struct __sk_buff * skb)5153ec61df8SAlan Maguire int __encap_ip6tnl_none(struct __sk_buff *skb)
516166b5a7fSAlan Maguire {
517166b5a7fSAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
5183ec61df8SAlan Maguire return encap_ipv6(skb, IPPROTO_IPV6, ETH_P_IPV6);
5193ec61df8SAlan Maguire else
5203ec61df8SAlan Maguire return TC_ACT_OK;
5213ec61df8SAlan Maguire }
5223ec61df8SAlan Maguire
523*7105f76fSZiyang Xuan SEC("encap_ipip6_none")
__encap_ipip6_none(struct __sk_buff * skb)524*7105f76fSZiyang Xuan int __encap_ipip6_none(struct __sk_buff *skb)
525*7105f76fSZiyang Xuan {
526*7105f76fSZiyang Xuan if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
527*7105f76fSZiyang Xuan return encap_ipv6_ipip6(skb);
528*7105f76fSZiyang Xuan else
529*7105f76fSZiyang Xuan return TC_ACT_OK;
530*7105f76fSZiyang Xuan }
531*7105f76fSZiyang Xuan
5323ec61df8SAlan Maguire SEC("encap_ip6gre_none")
__encap_ip6gre_none(struct __sk_buff * skb)5333ec61df8SAlan Maguire int __encap_ip6gre_none(struct __sk_buff *skb)
5343ec61df8SAlan Maguire {
5353ec61df8SAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
5363ec61df8SAlan Maguire return encap_ipv6(skb, IPPROTO_GRE, ETH_P_IPV6);
5373ec61df8SAlan Maguire else
5383ec61df8SAlan Maguire return TC_ACT_OK;
5393ec61df8SAlan Maguire }
5403ec61df8SAlan Maguire
5413ec61df8SAlan Maguire SEC("encap_ip6gre_mpls")
__encap_ip6gre_mpls(struct __sk_buff * skb)5423ec61df8SAlan Maguire int __encap_ip6gre_mpls(struct __sk_buff *skb)
5433ec61df8SAlan Maguire {
5443ec61df8SAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
5453ec61df8SAlan Maguire return encap_ipv6(skb, IPPROTO_GRE, ETH_P_MPLS_UC);
5463ec61df8SAlan Maguire else
5473ec61df8SAlan Maguire return TC_ACT_OK;
5483ec61df8SAlan Maguire }
5493ec61df8SAlan Maguire
5503ec61df8SAlan Maguire SEC("encap_ip6gre_eth")
__encap_ip6gre_eth(struct __sk_buff * skb)5513ec61df8SAlan Maguire int __encap_ip6gre_eth(struct __sk_buff *skb)
5523ec61df8SAlan Maguire {
5533ec61df8SAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
5543ec61df8SAlan Maguire return encap_ipv6(skb, IPPROTO_GRE, ETH_P_TEB);
5553ec61df8SAlan Maguire else
5563ec61df8SAlan Maguire return TC_ACT_OK;
5573ec61df8SAlan Maguire }
5583ec61df8SAlan Maguire
5593ec61df8SAlan Maguire SEC("encap_ip6udp_none")
__encap_ip6udp_none(struct __sk_buff * skb)5603ec61df8SAlan Maguire int __encap_ip6udp_none(struct __sk_buff *skb)
5613ec61df8SAlan Maguire {
5623ec61df8SAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
5633ec61df8SAlan Maguire return encap_ipv6(skb, IPPROTO_UDP, ETH_P_IPV6);
5643ec61df8SAlan Maguire else
5653ec61df8SAlan Maguire return TC_ACT_OK;
5663ec61df8SAlan Maguire }
5673ec61df8SAlan Maguire
5683ec61df8SAlan Maguire SEC("encap_ip6udp_mpls")
__encap_ip6udp_mpls(struct __sk_buff * skb)5693ec61df8SAlan Maguire int __encap_ip6udp_mpls(struct __sk_buff *skb)
5703ec61df8SAlan Maguire {
5713ec61df8SAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
5723ec61df8SAlan Maguire return encap_ipv6(skb, IPPROTO_UDP, ETH_P_MPLS_UC);
5733ec61df8SAlan Maguire else
5743ec61df8SAlan Maguire return TC_ACT_OK;
5753ec61df8SAlan Maguire }
5763ec61df8SAlan Maguire
5773ec61df8SAlan Maguire SEC("encap_ip6udp_eth")
__encap_ip6udp_eth(struct __sk_buff * skb)5783ec61df8SAlan Maguire int __encap_ip6udp_eth(struct __sk_buff *skb)
5793ec61df8SAlan Maguire {
5803ec61df8SAlan Maguire if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
5813ec61df8SAlan Maguire return encap_ipv6(skb, IPPROTO_UDP, ETH_P_TEB);
5827255fadeSWillem de Bruijn else
5837255fadeSWillem de Bruijn return TC_ACT_OK;
5847255fadeSWillem de Bruijn }
5857255fadeSWillem de Bruijn
586256becd4SXuesen Huang SEC("encap_ip6vxlan_eth")
__encap_ip6vxlan_eth(struct __sk_buff * skb)587256becd4SXuesen Huang int __encap_ip6vxlan_eth(struct __sk_buff *skb)
588256becd4SXuesen Huang {
589256becd4SXuesen Huang if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
590256becd4SXuesen Huang return __encap_ipv6(skb, IPPROTO_UDP,
591256becd4SXuesen Huang ETH_P_TEB,
592256becd4SXuesen Huang EXTPROTO_VXLAN);
593256becd4SXuesen Huang else
594256becd4SXuesen Huang return TC_ACT_OK;
595256becd4SXuesen Huang }
596256becd4SXuesen Huang
decap_internal(struct __sk_buff * skb,int off,int len,char proto)5977255fadeSWillem de Bruijn static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
5987255fadeSWillem de Bruijn {
599*7105f76fSZiyang Xuan __u64 flags = BPF_F_ADJ_ROOM_FIXED_GSO;
600*7105f76fSZiyang Xuan struct ipv6_opt_hdr ip6_opt_hdr;
6013ec61df8SAlan Maguire struct gre_hdr greh;
6023ec61df8SAlan Maguire struct udphdr udph;
603166b5a7fSAlan Maguire int olen = len;
6047255fadeSWillem de Bruijn
6057255fadeSWillem de Bruijn switch (proto) {
6067255fadeSWillem de Bruijn case IPPROTO_IPIP:
607*7105f76fSZiyang Xuan flags |= BPF_F_ADJ_ROOM_DECAP_L3_IPV4;
608*7105f76fSZiyang Xuan break;
6097255fadeSWillem de Bruijn case IPPROTO_IPV6:
610*7105f76fSZiyang Xuan flags |= BPF_F_ADJ_ROOM_DECAP_L3_IPV6;
611*7105f76fSZiyang Xuan break;
612*7105f76fSZiyang Xuan case NEXTHDR_DEST:
613*7105f76fSZiyang Xuan if (bpf_skb_load_bytes(skb, off + len, &ip6_opt_hdr,
614*7105f76fSZiyang Xuan sizeof(ip6_opt_hdr)) < 0)
615*7105f76fSZiyang Xuan return TC_ACT_OK;
616*7105f76fSZiyang Xuan switch (ip6_opt_hdr.nexthdr) {
617*7105f76fSZiyang Xuan case IPPROTO_IPIP:
618*7105f76fSZiyang Xuan flags |= BPF_F_ADJ_ROOM_DECAP_L3_IPV4;
619*7105f76fSZiyang Xuan break;
620*7105f76fSZiyang Xuan case IPPROTO_IPV6:
621*7105f76fSZiyang Xuan flags |= BPF_F_ADJ_ROOM_DECAP_L3_IPV6;
622*7105f76fSZiyang Xuan break;
623*7105f76fSZiyang Xuan default:
624*7105f76fSZiyang Xuan return TC_ACT_OK;
625*7105f76fSZiyang Xuan }
6267255fadeSWillem de Bruijn break;
6277255fadeSWillem de Bruijn case IPPROTO_GRE:
628166b5a7fSAlan Maguire olen += sizeof(struct gre_hdr);
6293ec61df8SAlan Maguire if (bpf_skb_load_bytes(skb, off + len, &greh, sizeof(greh)) < 0)
6303ec61df8SAlan Maguire return TC_ACT_OK;
6313ec61df8SAlan Maguire switch (bpf_ntohs(greh.protocol)) {
6323ec61df8SAlan Maguire case ETH_P_MPLS_UC:
6333ec61df8SAlan Maguire olen += sizeof(mpls_label);
6343ec61df8SAlan Maguire break;
6353ec61df8SAlan Maguire case ETH_P_TEB:
6363ec61df8SAlan Maguire olen += ETH_HLEN;
6373ec61df8SAlan Maguire break;
6383ec61df8SAlan Maguire }
639166b5a7fSAlan Maguire break;
640166b5a7fSAlan Maguire case IPPROTO_UDP:
641166b5a7fSAlan Maguire olen += sizeof(struct udphdr);
6423ec61df8SAlan Maguire if (bpf_skb_load_bytes(skb, off + len, &udph, sizeof(udph)) < 0)
6433ec61df8SAlan Maguire return TC_ACT_OK;
6443ec61df8SAlan Maguire switch (bpf_ntohs(udph.dest)) {
6453ec61df8SAlan Maguire case MPLS_OVER_UDP_PORT:
6463ec61df8SAlan Maguire olen += sizeof(mpls_label);
6473ec61df8SAlan Maguire break;
6483ec61df8SAlan Maguire case ETH_OVER_UDP_PORT:
6493ec61df8SAlan Maguire olen += ETH_HLEN;
6503ec61df8SAlan Maguire break;
651256becd4SXuesen Huang case VXLAN_UDP_PORT:
652256becd4SXuesen Huang olen += ETH_HLEN + sizeof(struct vxlanhdr);
653256becd4SXuesen Huang break;
6543ec61df8SAlan Maguire }
6557255fadeSWillem de Bruijn break;
656ef81bd05SWillem de Bruijn default:
657ef81bd05SWillem de Bruijn return TC_ACT_OK;
658ef81bd05SWillem de Bruijn }
659ef81bd05SWillem de Bruijn
660*7105f76fSZiyang Xuan if (bpf_skb_adjust_room(skb, -olen, BPF_ADJ_ROOM_MAC, flags))
661ef81bd05SWillem de Bruijn return TC_ACT_SHOT;
662ef81bd05SWillem de Bruijn
663ef81bd05SWillem de Bruijn return TC_ACT_OK;
664ef81bd05SWillem de Bruijn }
665ef81bd05SWillem de Bruijn
decap_ipv4(struct __sk_buff * skb)666ef81bd05SWillem de Bruijn static int decap_ipv4(struct __sk_buff *skb)
667ef81bd05SWillem de Bruijn {
668ef81bd05SWillem de Bruijn struct iphdr iph_outer;
669ef81bd05SWillem de Bruijn
670ccd34cd3SWillem de Bruijn if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_outer,
671ccd34cd3SWillem de Bruijn sizeof(iph_outer)) < 0)
672ccd34cd3SWillem de Bruijn return TC_ACT_OK;
673ccd34cd3SWillem de Bruijn
6747255fadeSWillem de Bruijn if (iph_outer.ihl != 5)
675ccd34cd3SWillem de Bruijn return TC_ACT_OK;
676ccd34cd3SWillem de Bruijn
6777255fadeSWillem de Bruijn return decap_internal(skb, ETH_HLEN, sizeof(iph_outer),
6787255fadeSWillem de Bruijn iph_outer.protocol);
679ef81bd05SWillem de Bruijn }
680ef81bd05SWillem de Bruijn
decap_ipv6(struct __sk_buff * skb)681ef81bd05SWillem de Bruijn static int decap_ipv6(struct __sk_buff *skb)
682ef81bd05SWillem de Bruijn {
683ef81bd05SWillem de Bruijn struct ipv6hdr iph_outer;
684ef81bd05SWillem de Bruijn
685ef81bd05SWillem de Bruijn if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_outer,
686ef81bd05SWillem de Bruijn sizeof(iph_outer)) < 0)
687ccd34cd3SWillem de Bruijn return TC_ACT_OK;
688ccd34cd3SWillem de Bruijn
6897255fadeSWillem de Bruijn return decap_internal(skb, ETH_HLEN, sizeof(iph_outer),
6907255fadeSWillem de Bruijn iph_outer.nexthdr);
691ef81bd05SWillem de Bruijn }
692ef81bd05SWillem de Bruijn
693ef81bd05SWillem de Bruijn SEC("decap")
decap_f(struct __sk_buff * skb)694ef81bd05SWillem de Bruijn int decap_f(struct __sk_buff *skb)
695ef81bd05SWillem de Bruijn {
696ef81bd05SWillem de Bruijn switch (skb->protocol) {
697ef81bd05SWillem de Bruijn case __bpf_constant_htons(ETH_P_IP):
698ef81bd05SWillem de Bruijn return decap_ipv4(skb);
699ef81bd05SWillem de Bruijn case __bpf_constant_htons(ETH_P_IPV6):
700ef81bd05SWillem de Bruijn return decap_ipv6(skb);
701ef81bd05SWillem de Bruijn default:
702ef81bd05SWillem de Bruijn /* does not match, ignore */
703ef81bd05SWillem de Bruijn return TC_ACT_OK;
704ef81bd05SWillem de Bruijn }
705ccd34cd3SWillem de Bruijn }
706ccd34cd3SWillem de Bruijn
70798cdabcdSWillem de Bruijn char __license[] SEC("license") = "GPL";
708