1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (c) 2022 Meta */ 3 #include <stddef.h> 4 #include <string.h> 5 #include <linux/bpf.h> 6 #include <linux/if_ether.h> 7 #include <linux/if_packet.h> 8 #include <linux/ip.h> 9 #include <linux/ipv6.h> 10 #include <linux/in.h> 11 #include <linux/udp.h> 12 #include <linux/tcp.h> 13 #include <linux/pkt_cls.h> 14 #include <sys/socket.h> 15 #include <bpf/bpf_helpers.h> 16 #include <bpf/bpf_endian.h> 17 #include "test_iptunnel_common.h" 18 #include "bpf_kfuncs.h" 19 20 const size_t tcphdr_sz = sizeof(struct tcphdr); 21 const size_t udphdr_sz = sizeof(struct udphdr); 22 const size_t ethhdr_sz = sizeof(struct ethhdr); 23 const size_t iphdr_sz = sizeof(struct iphdr); 24 const size_t ipv6hdr_sz = sizeof(struct ipv6hdr); 25 26 struct { 27 __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); 28 __uint(max_entries, 256); 29 __type(key, __u32); 30 __type(value, __u64); 31 } rxcnt SEC(".maps"); 32 33 struct { 34 __uint(type, BPF_MAP_TYPE_HASH); 35 __uint(max_entries, MAX_IPTNL_ENTRIES); 36 __type(key, struct vip); 37 __type(value, struct iptnl_info); 38 } vip2tnl SEC(".maps"); 39 40 static __always_inline void count_tx(__u32 protocol) 41 { 42 __u64 *rxcnt_count; 43 44 rxcnt_count = bpf_map_lookup_elem(&rxcnt, &protocol); 45 if (rxcnt_count) 46 *rxcnt_count += 1; 47 } 48 49 static __always_inline int get_dport(void *trans_data, __u8 protocol) 50 { 51 struct tcphdr *th; 52 struct udphdr *uh; 53 54 switch (protocol) { 55 case IPPROTO_TCP: 56 th = (struct tcphdr *)trans_data; 57 return th->dest; 58 case IPPROTO_UDP: 59 uh = (struct udphdr *)trans_data; 60 return uh->dest; 61 default: 62 return 0; 63 } 64 } 65 66 static __always_inline void set_ethhdr(struct ethhdr *new_eth, 67 const struct ethhdr *old_eth, 68 const struct iptnl_info *tnl, 69 __be16 h_proto) 70 { 71 memcpy(new_eth->h_source, old_eth->h_dest, sizeof(new_eth->h_source)); 72 memcpy(new_eth->h_dest, tnl->dmac, sizeof(new_eth->h_dest)); 73 new_eth->h_proto = h_proto; 74 } 75 76 static __always_inline int handle_ipv4(struct xdp_md *xdp, struct bpf_dynptr *xdp_ptr) 77 { 78 __u8 eth_buffer[ethhdr_sz + iphdr_sz + ethhdr_sz]; 79 __u8 iph_buffer_tcp[iphdr_sz + tcphdr_sz]; 80 __u8 iph_buffer_udp[iphdr_sz + udphdr_sz]; 81 struct bpf_dynptr new_xdp_ptr; 82 struct iptnl_info *tnl; 83 struct ethhdr *new_eth; 84 struct ethhdr *old_eth; 85 struct iphdr *iph; 86 __u16 *next_iph; 87 __u16 payload_len; 88 struct vip vip = {}; 89 int dport; 90 __u32 csum = 0; 91 int i; 92 93 __builtin_memset(eth_buffer, 0, sizeof(eth_buffer)); 94 __builtin_memset(iph_buffer_tcp, 0, sizeof(iph_buffer_tcp)); 95 __builtin_memset(iph_buffer_udp, 0, sizeof(iph_buffer_udp)); 96 97 if (ethhdr_sz + iphdr_sz + tcphdr_sz > xdp->data_end - xdp->data) 98 iph = bpf_dynptr_slice(xdp_ptr, ethhdr_sz, iph_buffer_udp, sizeof(iph_buffer_udp)); 99 else 100 iph = bpf_dynptr_slice(xdp_ptr, ethhdr_sz, iph_buffer_tcp, sizeof(iph_buffer_tcp)); 101 102 if (!iph) 103 return XDP_DROP; 104 105 dport = get_dport(iph + 1, iph->protocol); 106 if (dport == -1) 107 return XDP_DROP; 108 109 vip.protocol = iph->protocol; 110 vip.family = AF_INET; 111 vip.daddr.v4 = iph->daddr; 112 vip.dport = dport; 113 payload_len = bpf_ntohs(iph->tot_len); 114 115 tnl = bpf_map_lookup_elem(&vip2tnl, &vip); 116 /* It only does v4-in-v4 */ 117 if (!tnl || tnl->family != AF_INET) 118 return XDP_PASS; 119 120 if (bpf_xdp_adjust_head(xdp, 0 - (int)iphdr_sz)) 121 return XDP_DROP; 122 123 bpf_dynptr_from_xdp(xdp, 0, &new_xdp_ptr); 124 new_eth = bpf_dynptr_slice_rdwr(&new_xdp_ptr, 0, eth_buffer, sizeof(eth_buffer)); 125 if (!new_eth) 126 return XDP_DROP; 127 128 iph = (struct iphdr *)(new_eth + 1); 129 old_eth = (struct ethhdr *)(iph + 1); 130 131 set_ethhdr(new_eth, old_eth, tnl, bpf_htons(ETH_P_IP)); 132 133 if (new_eth == eth_buffer) 134 bpf_dynptr_write(&new_xdp_ptr, 0, eth_buffer, sizeof(eth_buffer), 0); 135 136 iph->version = 4; 137 iph->ihl = iphdr_sz >> 2; 138 iph->frag_off = 0; 139 iph->protocol = IPPROTO_IPIP; 140 iph->check = 0; 141 iph->tos = 0; 142 iph->tot_len = bpf_htons(payload_len + iphdr_sz); 143 iph->daddr = tnl->daddr.v4; 144 iph->saddr = tnl->saddr.v4; 145 iph->ttl = 8; 146 147 next_iph = (__u16 *)iph; 148 for (i = 0; i < iphdr_sz >> 1; i++) 149 csum += *next_iph++; 150 151 iph->check = ~((csum & 0xffff) + (csum >> 16)); 152 153 count_tx(vip.protocol); 154 155 return XDP_TX; 156 } 157 158 static __always_inline int handle_ipv6(struct xdp_md *xdp, struct bpf_dynptr *xdp_ptr) 159 { 160 __u8 eth_buffer[ethhdr_sz + ipv6hdr_sz + ethhdr_sz]; 161 __u8 ip6h_buffer_tcp[ipv6hdr_sz + tcphdr_sz]; 162 __u8 ip6h_buffer_udp[ipv6hdr_sz + udphdr_sz]; 163 struct bpf_dynptr new_xdp_ptr; 164 struct iptnl_info *tnl; 165 struct ethhdr *new_eth; 166 struct ethhdr *old_eth; 167 struct ipv6hdr *ip6h; 168 __u16 payload_len; 169 struct vip vip = {}; 170 int dport; 171 172 __builtin_memset(eth_buffer, 0, sizeof(eth_buffer)); 173 __builtin_memset(ip6h_buffer_tcp, 0, sizeof(ip6h_buffer_tcp)); 174 __builtin_memset(ip6h_buffer_udp, 0, sizeof(ip6h_buffer_udp)); 175 176 if (ethhdr_sz + iphdr_sz + tcphdr_sz > xdp->data_end - xdp->data) 177 ip6h = bpf_dynptr_slice(xdp_ptr, ethhdr_sz, ip6h_buffer_udp, sizeof(ip6h_buffer_udp)); 178 else 179 ip6h = bpf_dynptr_slice(xdp_ptr, ethhdr_sz, ip6h_buffer_tcp, sizeof(ip6h_buffer_tcp)); 180 181 if (!ip6h) 182 return XDP_DROP; 183 184 dport = get_dport(ip6h + 1, ip6h->nexthdr); 185 if (dport == -1) 186 return XDP_DROP; 187 188 vip.protocol = ip6h->nexthdr; 189 vip.family = AF_INET6; 190 memcpy(vip.daddr.v6, ip6h->daddr.s6_addr32, sizeof(vip.daddr)); 191 vip.dport = dport; 192 payload_len = ip6h->payload_len; 193 194 tnl = bpf_map_lookup_elem(&vip2tnl, &vip); 195 /* It only does v6-in-v6 */ 196 if (!tnl || tnl->family != AF_INET6) 197 return XDP_PASS; 198 199 if (bpf_xdp_adjust_head(xdp, 0 - (int)ipv6hdr_sz)) 200 return XDP_DROP; 201 202 bpf_dynptr_from_xdp(xdp, 0, &new_xdp_ptr); 203 new_eth = bpf_dynptr_slice_rdwr(&new_xdp_ptr, 0, eth_buffer, sizeof(eth_buffer)); 204 if (!new_eth) 205 return XDP_DROP; 206 207 ip6h = (struct ipv6hdr *)(new_eth + 1); 208 old_eth = (struct ethhdr *)(ip6h + 1); 209 210 set_ethhdr(new_eth, old_eth, tnl, bpf_htons(ETH_P_IPV6)); 211 212 if (new_eth == eth_buffer) 213 bpf_dynptr_write(&new_xdp_ptr, 0, eth_buffer, sizeof(eth_buffer), 0); 214 215 ip6h->version = 6; 216 ip6h->priority = 0; 217 memset(ip6h->flow_lbl, 0, sizeof(ip6h->flow_lbl)); 218 ip6h->payload_len = bpf_htons(bpf_ntohs(payload_len) + ipv6hdr_sz); 219 ip6h->nexthdr = IPPROTO_IPV6; 220 ip6h->hop_limit = 8; 221 memcpy(ip6h->saddr.s6_addr32, tnl->saddr.v6, sizeof(tnl->saddr.v6)); 222 memcpy(ip6h->daddr.s6_addr32, tnl->daddr.v6, sizeof(tnl->daddr.v6)); 223 224 count_tx(vip.protocol); 225 226 return XDP_TX; 227 } 228 229 SEC("xdp") 230 int _xdp_tx_iptunnel(struct xdp_md *xdp) 231 { 232 __u8 buffer[ethhdr_sz]; 233 struct bpf_dynptr ptr; 234 struct ethhdr *eth; 235 __u16 h_proto; 236 237 __builtin_memset(buffer, 0, sizeof(buffer)); 238 239 bpf_dynptr_from_xdp(xdp, 0, &ptr); 240 eth = bpf_dynptr_slice(&ptr, 0, buffer, sizeof(buffer)); 241 if (!eth) 242 return XDP_DROP; 243 244 h_proto = eth->h_proto; 245 246 if (h_proto == bpf_htons(ETH_P_IP)) 247 return handle_ipv4(xdp, &ptr); 248 else if (h_proto == bpf_htons(ETH_P_IPV6)) 249 250 return handle_ipv6(xdp, &ptr); 251 else 252 return XDP_DROP; 253 } 254 255 char _license[] SEC("license") = "GPL"; 256