1
2
3
4
5
6
7#define KBUILD_MODNAME "foo"
8#include <uapi/linux/bpf.h>
9#include <uapi/linux/if_ether.h>
10#include <uapi/linux/if_packet.h>
11#include <uapi/linux/ip.h>
12#include <uapi/linux/ipv6.h>
13#include <uapi/linux/in.h>
14#include <uapi/linux/tcp.h>
15#include <uapi/linux/filter.h>
16#include <uapi/linux/pkt_cls.h>
17#include <net/ipv6.h>
18#include <bpf/bpf_helpers.h>
19
20#define _htonl __builtin_bswap32
21
22#define PIN_GLOBAL_NS 2
23struct bpf_elf_map {
24 __u32 type;
25 __u32 size_key;
26 __u32 size_value;
27 __u32 max_elem;
28 __u32 flags;
29 __u32 id;
30 __u32 pinning;
31};
32
33
34struct eth_hdr {
35 unsigned char h_dest[ETH_ALEN];
36 unsigned char h_source[ETH_ALEN];
37 unsigned short h_proto;
38};
39
40struct bpf_elf_map SEC("maps") tun_iface = {
41 .type = BPF_MAP_TYPE_ARRAY,
42 .size_key = sizeof(int),
43 .size_value = sizeof(int),
44 .pinning = PIN_GLOBAL_NS,
45 .max_elem = 1,
46};
47
48static __always_inline bool is_vip_addr(__be16 eth_proto, __be32 daddr)
49{
50 if (eth_proto == htons(ETH_P_IP))
51 return (_htonl(0xffffff00) & daddr) == _htonl(0x0a0a0100);
52 else if (eth_proto == htons(ETH_P_IPV6))
53 return (daddr == _htonl(0x2401face));
54
55 return false;
56}
57
58SEC("l2_to_iptun_ingress_forward")
59int _l2_to_iptun_ingress_forward(struct __sk_buff *skb)
60{
61 struct bpf_tunnel_key tkey = {};
62 void *data = (void *)(long)skb->data;
63 struct eth_hdr *eth = data;
64 void *data_end = (void *)(long)skb->data_end;
65 int key = 0, *ifindex;
66
67 int ret;
68
69 if (data + sizeof(*eth) > data_end)
70 return TC_ACT_OK;
71
72 ifindex = bpf_map_lookup_elem(&tun_iface, &key);
73 if (!ifindex)
74 return TC_ACT_OK;
75
76 if (eth->h_proto == htons(ETH_P_IP)) {
77 char fmt4[] = "ingress forward to ifindex:%d daddr4:%x\n";
78 struct iphdr *iph = data + sizeof(*eth);
79
80 if (data + sizeof(*eth) + sizeof(*iph) > data_end)
81 return TC_ACT_OK;
82
83 if (iph->protocol != IPPROTO_IPIP)
84 return TC_ACT_OK;
85
86 bpf_trace_printk(fmt4, sizeof(fmt4), *ifindex,
87 _htonl(iph->daddr));
88 return bpf_redirect(*ifindex, BPF_F_INGRESS);
89 } else if (eth->h_proto == htons(ETH_P_IPV6)) {
90 char fmt6[] = "ingress forward to ifindex:%d daddr6:%x::%x\n";
91 struct ipv6hdr *ip6h = data + sizeof(*eth);
92
93 if (data + sizeof(*eth) + sizeof(*ip6h) > data_end)
94 return TC_ACT_OK;
95
96 if (ip6h->nexthdr != IPPROTO_IPIP &&
97 ip6h->nexthdr != IPPROTO_IPV6)
98 return TC_ACT_OK;
99
100 bpf_trace_printk(fmt6, sizeof(fmt6), *ifindex,
101 _htonl(ip6h->daddr.s6_addr32[0]),
102 _htonl(ip6h->daddr.s6_addr32[3]));
103 return bpf_redirect(*ifindex, BPF_F_INGRESS);
104 }
105
106 return TC_ACT_OK;
107}
108
109SEC("l2_to_iptun_ingress_redirect")
110int _l2_to_iptun_ingress_redirect(struct __sk_buff *skb)
111{
112 struct bpf_tunnel_key tkey = {};
113 void *data = (void *)(long)skb->data;
114 struct eth_hdr *eth = data;
115 void *data_end = (void *)(long)skb->data_end;
116 int key = 0, *ifindex;
117
118 int ret;
119
120 if (data + sizeof(*eth) > data_end)
121 return TC_ACT_OK;
122
123 ifindex = bpf_map_lookup_elem(&tun_iface, &key);
124 if (!ifindex)
125 return TC_ACT_OK;
126
127 if (eth->h_proto == htons(ETH_P_IP)) {
128 char fmt4[] = "e/ingress redirect daddr4:%x to ifindex:%d\n";
129 struct iphdr *iph = data + sizeof(*eth);
130 __be32 daddr = iph->daddr;
131
132 if (data + sizeof(*eth) + sizeof(*iph) > data_end)
133 return TC_ACT_OK;
134
135 if (!is_vip_addr(eth->h_proto, daddr))
136 return TC_ACT_OK;
137
138 bpf_trace_printk(fmt4, sizeof(fmt4), _htonl(daddr), *ifindex);
139 } else {
140 return TC_ACT_OK;
141 }
142
143 tkey.tunnel_id = 10000;
144 tkey.tunnel_ttl = 64;
145 tkey.remote_ipv4 = 0x0a020166;
146 bpf_skb_set_tunnel_key(skb, &tkey, sizeof(tkey), 0);
147 return bpf_redirect(*ifindex, 0);
148}
149
150SEC("l2_to_ip6tun_ingress_redirect")
151int _l2_to_ip6tun_ingress_redirect(struct __sk_buff *skb)
152{
153 struct bpf_tunnel_key tkey = {};
154 void *data = (void *)(long)skb->data;
155 struct eth_hdr *eth = data;
156 void *data_end = (void *)(long)skb->data_end;
157 int key = 0, *ifindex;
158
159 if (data + sizeof(*eth) > data_end)
160 return TC_ACT_OK;
161
162 ifindex = bpf_map_lookup_elem(&tun_iface, &key);
163 if (!ifindex)
164 return TC_ACT_OK;
165
166 if (eth->h_proto == htons(ETH_P_IP)) {
167 char fmt4[] = "e/ingress redirect daddr4:%x to ifindex:%d\n";
168 struct iphdr *iph = data + sizeof(*eth);
169
170 if (data + sizeof(*eth) + sizeof(*iph) > data_end)
171 return TC_ACT_OK;
172
173 if (!is_vip_addr(eth->h_proto, iph->daddr))
174 return TC_ACT_OK;
175
176 bpf_trace_printk(fmt4, sizeof(fmt4), _htonl(iph->daddr),
177 *ifindex);
178 } else if (eth->h_proto == htons(ETH_P_IPV6)) {
179 char fmt6[] = "e/ingress redirect daddr6:%x to ifindex:%d\n";
180 struct ipv6hdr *ip6h = data + sizeof(*eth);
181
182 if (data + sizeof(*eth) + sizeof(*ip6h) > data_end)
183 return TC_ACT_OK;
184
185 if (!is_vip_addr(eth->h_proto, ip6h->daddr.s6_addr32[0]))
186 return TC_ACT_OK;
187
188 bpf_trace_printk(fmt6, sizeof(fmt6),
189 _htonl(ip6h->daddr.s6_addr32[0]), *ifindex);
190 } else {
191 return TC_ACT_OK;
192 }
193
194 tkey.tunnel_id = 10000;
195 tkey.tunnel_ttl = 64;
196
197 tkey.remote_ipv6[0] = _htonl(0x2401db02);
198 tkey.remote_ipv6[1] = 0;
199 tkey.remote_ipv6[2] = 0;
200 tkey.remote_ipv6[3] = _htonl(0x00000066);
201 bpf_skb_set_tunnel_key(skb, &tkey, sizeof(tkey), BPF_F_TUNINFO_IPV6);
202 return bpf_redirect(*ifindex, 0);
203}
204
205SEC("drop_non_tun_vip")
206int _drop_non_tun_vip(struct __sk_buff *skb)
207{
208 struct bpf_tunnel_key tkey = {};
209 void *data = (void *)(long)skb->data;
210 struct eth_hdr *eth = data;
211 void *data_end = (void *)(long)skb->data_end;
212
213 if (data + sizeof(*eth) > data_end)
214 return TC_ACT_OK;
215
216 if (eth->h_proto == htons(ETH_P_IP)) {
217 struct iphdr *iph = data + sizeof(*eth);
218
219 if (data + sizeof(*eth) + sizeof(*iph) > data_end)
220 return TC_ACT_OK;
221
222 if (is_vip_addr(eth->h_proto, iph->daddr))
223 return TC_ACT_SHOT;
224 } else if (eth->h_proto == htons(ETH_P_IPV6)) {
225 struct ipv6hdr *ip6h = data + sizeof(*eth);
226
227 if (data + sizeof(*eth) + sizeof(*ip6h) > data_end)
228 return TC_ACT_OK;
229
230 if (is_vip_addr(eth->h_proto, ip6h->daddr.s6_addr32[0]))
231 return TC_ACT_SHOT;
232 }
233
234 return TC_ACT_OK;
235}
236
237char _license[] SEC("license") = "GPL";
238
