1bafc0ba8SLorenz Bauer // SPDX-License-Identifier: GPL-2.0
2bafc0ba8SLorenz Bauer // Copyright (c) 2018 Facebook
3bafc0ba8SLorenz Bauer // Copyright (c) 2019 Cloudflare
4bafc0ba8SLorenz Bauer
5bafc0ba8SLorenz Bauer #include <string.h>
6bafc0ba8SLorenz Bauer
7bafc0ba8SLorenz Bauer #include <linux/bpf.h>
8bafc0ba8SLorenz Bauer #include <linux/pkt_cls.h>
9bafc0ba8SLorenz Bauer #include <linux/if_ether.h>
10bafc0ba8SLorenz Bauer #include <linux/in.h>
11bafc0ba8SLorenz Bauer #include <linux/ip.h>
12bafc0ba8SLorenz Bauer #include <linux/ipv6.h>
13bafc0ba8SLorenz Bauer #include <sys/socket.h>
14bafc0ba8SLorenz Bauer #include <linux/tcp.h>
15bafc0ba8SLorenz Bauer
163e689141SToke Høiland-Jørgensen #include <bpf/bpf_helpers.h>
173e689141SToke Høiland-Jørgensen #include <bpf/bpf_endian.h>
18bafc0ba8SLorenz Bauer
19*ccc3f569SAndrii Nakryiko struct {
20*ccc3f569SAndrii Nakryiko __uint(type, BPF_MAP_TYPE_ARRAY);
21*ccc3f569SAndrii Nakryiko __type(key, __u32);
22*ccc3f569SAndrii Nakryiko __type(value, __u32);
23*ccc3f569SAndrii Nakryiko __uint(max_entries, 3);
24*ccc3f569SAndrii Nakryiko } results SEC(".maps");
25bafc0ba8SLorenz Bauer
gen_syncookie(void * data_end,struct bpf_sock * sk,void * iph,__u32 ip_size,struct tcphdr * tcph)2691bc3578SPetar Penkov static __always_inline __s64 gen_syncookie(void *data_end, struct bpf_sock *sk,
2791bc3578SPetar Penkov void *iph, __u32 ip_size,
2891bc3578SPetar Penkov struct tcphdr *tcph)
2991bc3578SPetar Penkov {
3091bc3578SPetar Penkov __u32 thlen = tcph->doff * 4;
3191bc3578SPetar Penkov
3291bc3578SPetar Penkov if (tcph->syn && !tcph->ack) {
3391bc3578SPetar Penkov // packet should only have an MSS option
3491bc3578SPetar Penkov if (thlen != 24)
3591bc3578SPetar Penkov return 0;
3691bc3578SPetar Penkov
3791bc3578SPetar Penkov if ((void *)tcph + thlen > data_end)
3891bc3578SPetar Penkov return 0;
3991bc3578SPetar Penkov
4091bc3578SPetar Penkov return bpf_tcp_gen_syncookie(sk, iph, ip_size, tcph, thlen);
4191bc3578SPetar Penkov }
4291bc3578SPetar Penkov return 0;
4391bc3578SPetar Penkov }
4491bc3578SPetar Penkov
check_syncookie(void * ctx,void * data,void * data_end)45bafc0ba8SLorenz Bauer static __always_inline void check_syncookie(void *ctx, void *data,
46bafc0ba8SLorenz Bauer void *data_end)
47bafc0ba8SLorenz Bauer {
48bafc0ba8SLorenz Bauer struct bpf_sock_tuple tup;
49bafc0ba8SLorenz Bauer struct bpf_sock *sk;
50bafc0ba8SLorenz Bauer struct ethhdr *ethh;
51bafc0ba8SLorenz Bauer struct iphdr *ipv4h;
52bafc0ba8SLorenz Bauer struct ipv6hdr *ipv6h;
53bafc0ba8SLorenz Bauer struct tcphdr *tcph;
54bafc0ba8SLorenz Bauer int ret;
5591bc3578SPetar Penkov __u32 key_mss = 2;
5691bc3578SPetar Penkov __u32 key_gen = 1;
57bafc0ba8SLorenz Bauer __u32 key = 0;
5891bc3578SPetar Penkov __s64 seq_mss;
59bafc0ba8SLorenz Bauer
60bafc0ba8SLorenz Bauer ethh = data;
61bafc0ba8SLorenz Bauer if (ethh + 1 > data_end)
62bafc0ba8SLorenz Bauer return;
63bafc0ba8SLorenz Bauer
64bafc0ba8SLorenz Bauer switch (bpf_ntohs(ethh->h_proto)) {
65bafc0ba8SLorenz Bauer case ETH_P_IP:
66bafc0ba8SLorenz Bauer ipv4h = data + sizeof(struct ethhdr);
67bafc0ba8SLorenz Bauer if (ipv4h + 1 > data_end)
68bafc0ba8SLorenz Bauer return;
69bafc0ba8SLorenz Bauer
70bafc0ba8SLorenz Bauer if (ipv4h->ihl != 5)
71bafc0ba8SLorenz Bauer return;
72bafc0ba8SLorenz Bauer
73bafc0ba8SLorenz Bauer tcph = data + sizeof(struct ethhdr) + sizeof(struct iphdr);
74bafc0ba8SLorenz Bauer if (tcph + 1 > data_end)
75bafc0ba8SLorenz Bauer return;
76bafc0ba8SLorenz Bauer
77bafc0ba8SLorenz Bauer tup.ipv4.saddr = ipv4h->saddr;
78bafc0ba8SLorenz Bauer tup.ipv4.daddr = ipv4h->daddr;
79bafc0ba8SLorenz Bauer tup.ipv4.sport = tcph->source;
80bafc0ba8SLorenz Bauer tup.ipv4.dport = tcph->dest;
81bafc0ba8SLorenz Bauer
82bafc0ba8SLorenz Bauer sk = bpf_skc_lookup_tcp(ctx, &tup, sizeof(tup.ipv4),
83bafc0ba8SLorenz Bauer BPF_F_CURRENT_NETNS, 0);
84bafc0ba8SLorenz Bauer if (!sk)
85bafc0ba8SLorenz Bauer return;
86bafc0ba8SLorenz Bauer
87bafc0ba8SLorenz Bauer if (sk->state != BPF_TCP_LISTEN)
88bafc0ba8SLorenz Bauer goto release;
89bafc0ba8SLorenz Bauer
9091bc3578SPetar Penkov seq_mss = gen_syncookie(data_end, sk, ipv4h, sizeof(*ipv4h),
9191bc3578SPetar Penkov tcph);
9291bc3578SPetar Penkov
93bafc0ba8SLorenz Bauer ret = bpf_tcp_check_syncookie(sk, ipv4h, sizeof(*ipv4h),
94bafc0ba8SLorenz Bauer tcph, sizeof(*tcph));
95bafc0ba8SLorenz Bauer break;
96bafc0ba8SLorenz Bauer
97bafc0ba8SLorenz Bauer case ETH_P_IPV6:
98bafc0ba8SLorenz Bauer ipv6h = data + sizeof(struct ethhdr);
99bafc0ba8SLorenz Bauer if (ipv6h + 1 > data_end)
100bafc0ba8SLorenz Bauer return;
101bafc0ba8SLorenz Bauer
102bafc0ba8SLorenz Bauer if (ipv6h->nexthdr != IPPROTO_TCP)
103bafc0ba8SLorenz Bauer return;
104bafc0ba8SLorenz Bauer
105bafc0ba8SLorenz Bauer tcph = data + sizeof(struct ethhdr) + sizeof(struct ipv6hdr);
106bafc0ba8SLorenz Bauer if (tcph + 1 > data_end)
107bafc0ba8SLorenz Bauer return;
108bafc0ba8SLorenz Bauer
109bafc0ba8SLorenz Bauer memcpy(tup.ipv6.saddr, &ipv6h->saddr, sizeof(tup.ipv6.saddr));
110bafc0ba8SLorenz Bauer memcpy(tup.ipv6.daddr, &ipv6h->daddr, sizeof(tup.ipv6.daddr));
111bafc0ba8SLorenz Bauer tup.ipv6.sport = tcph->source;
112bafc0ba8SLorenz Bauer tup.ipv6.dport = tcph->dest;
113bafc0ba8SLorenz Bauer
114bafc0ba8SLorenz Bauer sk = bpf_skc_lookup_tcp(ctx, &tup, sizeof(tup.ipv6),
115bafc0ba8SLorenz Bauer BPF_F_CURRENT_NETNS, 0);
116bafc0ba8SLorenz Bauer if (!sk)
117bafc0ba8SLorenz Bauer return;
118bafc0ba8SLorenz Bauer
119bafc0ba8SLorenz Bauer if (sk->state != BPF_TCP_LISTEN)
120bafc0ba8SLorenz Bauer goto release;
121bafc0ba8SLorenz Bauer
12291bc3578SPetar Penkov seq_mss = gen_syncookie(data_end, sk, ipv6h, sizeof(*ipv6h),
12391bc3578SPetar Penkov tcph);
12491bc3578SPetar Penkov
125bafc0ba8SLorenz Bauer ret = bpf_tcp_check_syncookie(sk, ipv6h, sizeof(*ipv6h),
126bafc0ba8SLorenz Bauer tcph, sizeof(*tcph));
127bafc0ba8SLorenz Bauer break;
128bafc0ba8SLorenz Bauer
129bafc0ba8SLorenz Bauer default:
130bafc0ba8SLorenz Bauer return;
131bafc0ba8SLorenz Bauer }
132bafc0ba8SLorenz Bauer
13391bc3578SPetar Penkov if (seq_mss > 0) {
13491bc3578SPetar Penkov __u32 cookie = (__u32)seq_mss;
13591bc3578SPetar Penkov __u32 mss = seq_mss >> 32;
13691bc3578SPetar Penkov
13791bc3578SPetar Penkov bpf_map_update_elem(&results, &key_gen, &cookie, 0);
13891bc3578SPetar Penkov bpf_map_update_elem(&results, &key_mss, &mss, 0);
13991bc3578SPetar Penkov }
14091bc3578SPetar Penkov
14191bc3578SPetar Penkov if (ret == 0) {
14291bc3578SPetar Penkov __u32 cookie = bpf_ntohl(tcph->ack_seq) - 1;
14391bc3578SPetar Penkov
14491bc3578SPetar Penkov bpf_map_update_elem(&results, &key, &cookie, 0);
14591bc3578SPetar Penkov }
146bafc0ba8SLorenz Bauer
147bafc0ba8SLorenz Bauer release:
148bafc0ba8SLorenz Bauer bpf_sk_release(sk);
149bafc0ba8SLorenz Bauer }
150bafc0ba8SLorenz Bauer
151c22bdd28SAndrii Nakryiko SEC("tc")
check_syncookie_clsact(struct __sk_buff * skb)152bafc0ba8SLorenz Bauer int check_syncookie_clsact(struct __sk_buff *skb)
153bafc0ba8SLorenz Bauer {
154bafc0ba8SLorenz Bauer check_syncookie(skb, (void *)(long)skb->data,
155bafc0ba8SLorenz Bauer (void *)(long)skb->data_end);
156bafc0ba8SLorenz Bauer return TC_ACT_OK;
157bafc0ba8SLorenz Bauer }
158bafc0ba8SLorenz Bauer
1598fffa0e3SAndrii Nakryiko SEC("xdp")
check_syncookie_xdp(struct xdp_md * ctx)160bafc0ba8SLorenz Bauer int check_syncookie_xdp(struct xdp_md *ctx)
161bafc0ba8SLorenz Bauer {
162bafc0ba8SLorenz Bauer check_syncookie(ctx, (void *)(long)ctx->data,
163bafc0ba8SLorenz Bauer (void *)(long)ctx->data_end);
164bafc0ba8SLorenz Bauer return XDP_PASS;
165bafc0ba8SLorenz Bauer }
166bafc0ba8SLorenz Bauer
167bafc0ba8SLorenz Bauer char _license[] SEC("license") = "GPL";
168