1
2#include <limits.h>
3#include <stddef.h>
4#include <stdbool.h>
5#include <string.h>
6#include <linux/pkt_cls.h>
7#include <linux/bpf.h>
8#include <linux/in.h>
9#include <linux/if_ether.h>
10#include <linux/icmp.h>
11#include <linux/ip.h>
12#include <linux/ipv6.h>
13#include <linux/tcp.h>
14#include <linux/udp.h>
15#include <linux/if_packet.h>
16#include <sys/socket.h>
17#include <linux/if_tunnel.h>
18#include <linux/mpls.h>
19#include "bpf_helpers.h"
20#include "bpf_endian.h"
21
22int _version SEC("version") = 1;
23#define PROG(F) SEC(#F) int bpf_func_##F
24
25
26
27
28
29enum {
30 IP,
31 IPV6,
32 IPV6OP,
33 IPV6FR,
34 MPLS,
35 VLAN,
36};
37
38#define IP_MF 0x2000
39#define IP_OFFSET 0x1FFF
40#define IP6_MF 0x0001
41#define IP6_OFFSET 0xFFF8
42
43struct vlan_hdr {
44 __be16 h_vlan_TCI;
45 __be16 h_vlan_encapsulated_proto;
46};
47
48struct gre_hdr {
49 __be16 flags;
50 __be16 proto;
51};
52
53struct frag_hdr {
54 __u8 nexthdr;
55 __u8 reserved;
56 __be16 frag_off;
57 __be32 identification;
58};
59
60struct {
61 __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
62 __uint(max_entries, 8);
63 __uint(key_size, sizeof(__u32));
64 __uint(value_size, sizeof(__u32));
65} jmp_table SEC(".maps");
66
67struct {
68 __uint(type, BPF_MAP_TYPE_ARRAY);
69 __uint(max_entries, 1);
70 __type(key, __u32);
71 __type(value, struct bpf_flow_keys);
72} last_dissection SEC(".maps");
73
74static __always_inline int export_flow_keys(struct bpf_flow_keys *keys,
75 int ret)
76{
77 struct bpf_flow_keys *val;
78 __u32 key = 0;
79
80 val = bpf_map_lookup_elem(&last_dissection, &key);
81 if (val)
82 memcpy(val, keys, sizeof(*val));
83 return ret;
84}
85
86static __always_inline void *bpf_flow_dissect_get_header(struct __sk_buff *skb,
87 __u16 hdr_size,
88 void *buffer)
89{
90 void *data_end = (void *)(long)skb->data_end;
91 void *data = (void *)(long)skb->data;
92 __u16 thoff = skb->flow_keys->thoff;
93 __u8 *hdr;
94
95
96 if (thoff > (USHRT_MAX - hdr_size))
97 return NULL;
98
99 hdr = data + thoff;
100 if (hdr + hdr_size <= data_end)
101 return hdr;
102
103 if (bpf_skb_load_bytes(skb, thoff, buffer, hdr_size))
104 return NULL;
105
106 return buffer;
107}
108
109
110static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
111{
112 struct bpf_flow_keys *keys = skb->flow_keys;
113
114 switch (proto) {
115 case bpf_htons(ETH_P_IP):
116 bpf_tail_call(skb, &jmp_table, IP);
117 break;
118 case bpf_htons(ETH_P_IPV6):
119 bpf_tail_call(skb, &jmp_table, IPV6);
120 break;
121 case bpf_htons(ETH_P_MPLS_MC):
122 case bpf_htons(ETH_P_MPLS_UC):
123 bpf_tail_call(skb, &jmp_table, MPLS);
124 break;
125 case bpf_htons(ETH_P_8021Q):
126 case bpf_htons(ETH_P_8021AD):
127 bpf_tail_call(skb, &jmp_table, VLAN);
128 break;
129 default:
130
131 return export_flow_keys(keys, BPF_DROP);
132 }
133
134 return export_flow_keys(keys, BPF_DROP);
135}
136
137SEC("flow_dissector")
138int _dissect(struct __sk_buff *skb)
139{
140 struct bpf_flow_keys *keys = skb->flow_keys;
141
142 return parse_eth_proto(skb, keys->n_proto);
143}
144
145
146static __always_inline int parse_ip_proto(struct __sk_buff *skb, __u8 proto)
147{
148 struct bpf_flow_keys *keys = skb->flow_keys;
149 void *data_end = (void *)(long)skb->data_end;
150 struct icmphdr *icmp, _icmp;
151 struct gre_hdr *gre, _gre;
152 struct ethhdr *eth, _eth;
153 struct tcphdr *tcp, _tcp;
154 struct udphdr *udp, _udp;
155
156 keys->ip_proto = proto;
157 switch (proto) {
158 case IPPROTO_ICMP:
159 icmp = bpf_flow_dissect_get_header(skb, sizeof(*icmp), &_icmp);
160 if (!icmp)
161 return export_flow_keys(keys, BPF_DROP);
162 return export_flow_keys(keys, BPF_OK);
163 case IPPROTO_IPIP:
164 keys->is_encap = true;
165 return parse_eth_proto(skb, bpf_htons(ETH_P_IP));
166 case IPPROTO_IPV6:
167 keys->is_encap = true;
168 return parse_eth_proto(skb, bpf_htons(ETH_P_IPV6));
169 case IPPROTO_GRE:
170 gre = bpf_flow_dissect_get_header(skb, sizeof(*gre), &_gre);
171 if (!gre)
172 return export_flow_keys(keys, BPF_DROP);
173
174 if (bpf_htons(gre->flags & GRE_VERSION))
175
176 return export_flow_keys(keys, BPF_OK);
177
178 keys->thoff += sizeof(*gre);
179 if (GRE_IS_CSUM(gre->flags))
180 keys->thoff += 4;
181 if (GRE_IS_KEY(gre->flags))
182 keys->thoff += 4;
183 if (GRE_IS_SEQ(gre->flags))
184 keys->thoff += 4;
185
186 keys->is_encap = true;
187
188 if (gre->proto == bpf_htons(ETH_P_TEB)) {
189 eth = bpf_flow_dissect_get_header(skb, sizeof(*eth),
190 &_eth);
191 if (!eth)
192 return export_flow_keys(keys, BPF_DROP);
193
194 keys->thoff += sizeof(*eth);
195
196 return parse_eth_proto(skb, eth->h_proto);
197 } else {
198 return parse_eth_proto(skb, gre->proto);
199 }
200 case IPPROTO_TCP:
201 tcp = bpf_flow_dissect_get_header(skb, sizeof(*tcp), &_tcp);
202 if (!tcp)
203 return export_flow_keys(keys, BPF_DROP);
204
205 if (tcp->doff < 5)
206 return export_flow_keys(keys, BPF_DROP);
207
208 if ((__u8 *)tcp + (tcp->doff << 2) > data_end)
209 return export_flow_keys(keys, BPF_DROP);
210
211 keys->sport = tcp->source;
212 keys->dport = tcp->dest;
213 return export_flow_keys(keys, BPF_OK);
214 case IPPROTO_UDP:
215 case IPPROTO_UDPLITE:
216 udp = bpf_flow_dissect_get_header(skb, sizeof(*udp), &_udp);
217 if (!udp)
218 return export_flow_keys(keys, BPF_DROP);
219
220 keys->sport = udp->source;
221 keys->dport = udp->dest;
222 return export_flow_keys(keys, BPF_OK);
223 default:
224 return export_flow_keys(keys, BPF_DROP);
225 }
226
227 return export_flow_keys(keys, BPF_DROP);
228}
229
230static __always_inline int parse_ipv6_proto(struct __sk_buff *skb, __u8 nexthdr)
231{
232 struct bpf_flow_keys *keys = skb->flow_keys;
233
234 keys->ip_proto = nexthdr;
235 switch (nexthdr) {
236 case IPPROTO_HOPOPTS:
237 case IPPROTO_DSTOPTS:
238 bpf_tail_call(skb, &jmp_table, IPV6OP);
239 break;
240 case IPPROTO_FRAGMENT:
241 bpf_tail_call(skb, &jmp_table, IPV6FR);
242 break;
243 default:
244 return parse_ip_proto(skb, nexthdr);
245 }
246
247 return export_flow_keys(keys, BPF_DROP);
248}
249
250PROG(IP)(struct __sk_buff *skb)
251{
252 void *data_end = (void *)(long)skb->data_end;
253 struct bpf_flow_keys *keys = skb->flow_keys;
254 void *data = (void *)(long)skb->data;
255 struct iphdr *iph, _iph;
256 bool done = false;
257
258 iph = bpf_flow_dissect_get_header(skb, sizeof(*iph), &_iph);
259 if (!iph)
260 return export_flow_keys(keys, BPF_DROP);
261
262
263 if (iph->ihl < 5)
264 return export_flow_keys(keys, BPF_DROP);
265
266 keys->addr_proto = ETH_P_IP;
267 keys->ipv4_src = iph->saddr;
268 keys->ipv4_dst = iph->daddr;
269
270 keys->thoff += iph->ihl << 2;
271 if (data + keys->thoff > data_end)
272 return export_flow_keys(keys, BPF_DROP);
273
274 if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET)) {
275 keys->is_frag = true;
276 if (iph->frag_off & bpf_htons(IP_OFFSET))
277
278
279
280 done = true;
281 else
282 keys->is_first_frag = true;
283 }
284
285 if (done)
286 return export_flow_keys(keys, BPF_OK);
287
288 return parse_ip_proto(skb, iph->protocol);
289}
290
291PROG(IPV6)(struct __sk_buff *skb)
292{
293 struct bpf_flow_keys *keys = skb->flow_keys;
294 struct ipv6hdr *ip6h, _ip6h;
295
296 ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
297 if (!ip6h)
298 return export_flow_keys(keys, BPF_DROP);
299
300 keys->addr_proto = ETH_P_IPV6;
301 memcpy(&keys->ipv6_src, &ip6h->saddr, 2*sizeof(ip6h->saddr));
302
303 keys->thoff += sizeof(struct ipv6hdr);
304
305 return parse_ipv6_proto(skb, ip6h->nexthdr);
306}
307
308PROG(IPV6OP)(struct __sk_buff *skb)
309{
310 struct bpf_flow_keys *keys = skb->flow_keys;
311 struct ipv6_opt_hdr *ip6h, _ip6h;
312
313 ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
314 if (!ip6h)
315 return export_flow_keys(keys, BPF_DROP);
316
317
318
319
320 skb->flow_keys->thoff += (1 + ip6h->hdrlen) << 3;
321
322 return parse_ipv6_proto(skb, ip6h->nexthdr);
323}
324
325PROG(IPV6FR)(struct __sk_buff *skb)
326{
327 struct bpf_flow_keys *keys = skb->flow_keys;
328 struct frag_hdr *fragh, _fragh;
329
330 fragh = bpf_flow_dissect_get_header(skb, sizeof(*fragh), &_fragh);
331 if (!fragh)
332 return export_flow_keys(keys, BPF_DROP);
333
334 keys->thoff += sizeof(*fragh);
335 keys->is_frag = true;
336 if (!(fragh->frag_off & bpf_htons(IP6_OFFSET)))
337 keys->is_first_frag = true;
338
339 return parse_ipv6_proto(skb, fragh->nexthdr);
340}
341
342PROG(MPLS)(struct __sk_buff *skb)
343{
344 struct bpf_flow_keys *keys = skb->flow_keys;
345 struct mpls_label *mpls, _mpls;
346
347 mpls = bpf_flow_dissect_get_header(skb, sizeof(*mpls), &_mpls);
348 if (!mpls)
349 return export_flow_keys(keys, BPF_DROP);
350
351 return export_flow_keys(keys, BPF_OK);
352}
353
354PROG(VLAN)(struct __sk_buff *skb)
355{
356 struct bpf_flow_keys *keys = skb->flow_keys;
357 struct vlan_hdr *vlan, _vlan;
358
359
360 if (keys->n_proto == bpf_htons(ETH_P_8021AD)) {
361 vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
362 if (!vlan)
363 return export_flow_keys(keys, BPF_DROP);
364
365 if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q))
366 return export_flow_keys(keys, BPF_DROP);
367
368 keys->nhoff += sizeof(*vlan);
369 keys->thoff += sizeof(*vlan);
370 }
371
372 vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
373 if (!vlan)
374 return export_flow_keys(keys, BPF_DROP);
375
376 keys->nhoff += sizeof(*vlan);
377 keys->thoff += sizeof(*vlan);
378
379 if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) ||
380 vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q))
381 return export_flow_keys(keys, BPF_DROP);
382
383 keys->n_proto = vlan->h_vlan_encapsulated_proto;
384 return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto);
385}
386
387char __license[] SEC("license") = "GPL";
388