tools/testing/selftests/bpf/progs/bpf_flow.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <limits.h>
   3 #include <stddef.h>
   4 #include <stdbool.h>
   5 #include <string.h>
   6 #include <linux/pkt_cls.h>
   7 #include <linux/bpf.h>
   8 #include <linux/in.h>
   9 #include <linux/if_ether.h>
  10 #include <linux/icmp.h>
  11 #include <linux/ip.h>
  12 #include <linux/ipv6.h>
  13 #include <linux/tcp.h>
  14 #include <linux/udp.h>
  15 #include <linux/if_packet.h>
  16 #include <sys/socket.h>
  17 #include <linux/if_tunnel.h>
  18 #include <linux/mpls.h>
  19 #include "bpf_helpers.h"
  20 #include "bpf_endian.h"
  21
  22 int _version SEC("version") = 1;
  23 #define PROG(F) SEC(#F) int bpf_func_##F
  24
  25 /* These are the identifiers of the BPF programs that will be used in tail
  26  * calls. Name is limited to 16 characters, with the terminating character and
  27  * bpf_func_ above, we have only 6 to work with, anything after will be cropped.
  28  */
  29 enum {
  30         IP,
  31         IPV6,
  32         IPV6OP, /* Destination/Hop-by-Hop Options IPv6 Extension header */
  33         IPV6FR, /* Fragmentation IPv6 Extension Header */
  34         MPLS,
  35         VLAN,
  36 };
  37
  38 #define IP_MF           0x2000
  39 #define IP_OFFSET       0x1FFF
  40 #define IP6_MF          0x0001
  41 #define IP6_OFFSET      0xFFF8
  42
  43 struct vlan_hdr {
  44         __be16 h_vlan_TCI;
  45         __be16 h_vlan_encapsulated_proto;
  46 };
  47
  48 struct gre_hdr {
  49         __be16 flags;
  50         __be16 proto;
  51 };
  52
  53 struct frag_hdr {
  54         __u8 nexthdr;
  55         __u8 reserved;
  56         __be16 frag_off;
  57         __be32 identification;
  58 };
  59
  60 struct {
  61         __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
  62         __uint(max_entries, 8);
  63         __uint(key_size, sizeof(__u32));
  64         __uint(value_size, sizeof(__u32));
  65 } jmp_table SEC(".maps");
  66
  67 struct {
  68         __uint(type, BPF_MAP_TYPE_ARRAY);
  69         __uint(max_entries, 1);
  70         __type(key, __u32);
  71         __type(value, struct bpf_flow_keys);
  72 } last_dissection SEC(".maps");
  73
  74 static __always_inline int export_flow_keys(struct bpf_flow_keys *keys,
  75                                             int ret)
  76 {
  77         struct bpf_flow_keys *val;
  78         __u32 key = 0;
  79
  80         val = bpf_map_lookup_elem(&last_dissection, &key);
  81         if (val)
  82                 memcpy(val, keys, sizeof(*val));
  83         return ret;
  84 }
  85
  86 static __always_inline void *bpf_flow_dissect_get_header(struct __sk_buff *skb,
  87                                                          __u16 hdr_size,
  88                                                          void *buffer)
  89 {
  90         void *data_end = (void *)(long)skb->data_end;
  91         void *data = (void *)(long)skb->data;
  92         __u16 thoff = skb->flow_keys->thoff;
  93         __u8 *hdr;
  94
  95         /* Verifies this variable offset does not overflow */
  96         if (thoff > (USHRT_MAX - hdr_size))
  97                 return NULL;
  98
  99         hdr = data + thoff;
 100         if (hdr + hdr_size <= data_end)
 101                 return hdr;
 102
 103         if (bpf_skb_load_bytes(skb, thoff, buffer, hdr_size))
 104                 return NULL;
 105
 106         return buffer;
 107 }
 108
 109 /* Dispatches on ETHERTYPE */
 110 static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
 111 {
 112         struct bpf_flow_keys *keys = skb->flow_keys;
 113
 114         switch (proto) {
 115         case bpf_htons(ETH_P_IP):
 116                 bpf_tail_call(skb, &jmp_table, IP);
 117                 break;
 118         case bpf_htons(ETH_P_IPV6):
 119                 bpf_tail_call(skb, &jmp_table, IPV6);
 120                 break;
 121         case bpf_htons(ETH_P_MPLS_MC):
 122         case bpf_htons(ETH_P_MPLS_UC):
 123                 bpf_tail_call(skb, &jmp_table, MPLS);
 124                 break;
 125         case bpf_htons(ETH_P_8021Q):
 126         case bpf_htons(ETH_P_8021AD):
 127                 bpf_tail_call(skb, &jmp_table, VLAN);
 128                 break;
 129         default:
 130                 /* Protocol not supported */
 131                 return export_flow_keys(keys, BPF_DROP);
 132         }
 133
 134         return export_flow_keys(keys, BPF_DROP);
 135 }
 136
 137 SEC("flow_dissector")
 138 int _dissect(struct __sk_buff *skb)
 139 {
 140         struct bpf_flow_keys *keys = skb->flow_keys;
 141
 142         return parse_eth_proto(skb, keys->n_proto);
 143 }
 144
 145 /* Parses on IPPROTO_* */
 146 static __always_inline int parse_ip_proto(struct __sk_buff *skb, __u8 proto)
 147 {
 148         struct bpf_flow_keys *keys = skb->flow_keys;
 149         void *data_end = (void *)(long)skb->data_end;
 150         struct icmphdr *icmp, _icmp;
 151         struct gre_hdr *gre, _gre;
 152         struct ethhdr *eth, _eth;
 153         struct tcphdr *tcp, _tcp;
 154         struct udphdr *udp, _udp;
 155
 156         keys->ip_proto = proto;
 157         switch (proto) {
 158         case IPPROTO_ICMP:
 159                 icmp = bpf_flow_dissect_get_header(skb, sizeof(*icmp), &_icmp);
 160                 if (!icmp)
 161                         return export_flow_keys(keys, BPF_DROP);
 162                 return export_flow_keys(keys, BPF_OK);
 163         case IPPROTO_IPIP:
 164                 keys->is_encap = true;
 165                 return parse_eth_proto(skb, bpf_htons(ETH_P_IP));
 166         case IPPROTO_IPV6:
 167                 keys->is_encap = true;
 168                 return parse_eth_proto(skb, bpf_htons(ETH_P_IPV6));
 169         case IPPROTO_GRE:
 170                 gre = bpf_flow_dissect_get_header(skb, sizeof(*gre), &_gre);
 171                 if (!gre)
 172                         return export_flow_keys(keys, BPF_DROP);
 173
 174                 if (bpf_htons(gre->flags & GRE_VERSION))
 175                         /* Only inspect standard GRE packets with version 0 */
 176                         return export_flow_keys(keys, BPF_OK);
 177
 178                 keys->thoff += sizeof(*gre); /* Step over GRE Flags and Proto */
 179                 if (GRE_IS_CSUM(gre->flags))
 180                         keys->thoff += 4; /* Step over chksum and Padding */
 181                 if (GRE_IS_KEY(gre->flags))
 182                         keys->thoff += 4; /* Step over key */
 183                 if (GRE_IS_SEQ(gre->flags))
 184                         keys->thoff += 4; /* Step over sequence number */
 185
 186                 keys->is_encap = true;
 187
 188                 if (gre->proto == bpf_htons(ETH_P_TEB)) {
 189                         eth = bpf_flow_dissect_get_header(skb, sizeof(*eth),
 190                                                           &_eth);
 191                         if (!eth)
 192                                 return export_flow_keys(keys, BPF_DROP);
 193
 194                         keys->thoff += sizeof(*eth);
 195
 196                         return parse_eth_proto(skb, eth->h_proto);
 197                 } else {
 198                         return parse_eth_proto(skb, gre->proto);
 199                 }
 200         case IPPROTO_TCP:
 201                 tcp = bpf_flow_dissect_get_header(skb, sizeof(*tcp), &_tcp);
 202                 if (!tcp)
 203                         return export_flow_keys(keys, BPF_DROP);
 204
 205                 if (tcp->doff < 5)
 206                         return export_flow_keys(keys, BPF_DROP);
 207
 208                 if ((__u8 *)tcp + (tcp->doff << 2) > data_end)
 209                         return export_flow_keys(keys, BPF_DROP);
 210
 211                 keys->sport = tcp->source;
 212                 keys->dport = tcp->dest;
 213                 return export_flow_keys(keys, BPF_OK);
 214         case IPPROTO_UDP:
 215         case IPPROTO_UDPLITE:
 216                 udp = bpf_flow_dissect_get_header(skb, sizeof(*udp), &_udp);
 217                 if (!udp)
 218                         return export_flow_keys(keys, BPF_DROP);
 219
 220                 keys->sport = udp->source;
 221                 keys->dport = udp->dest;
 222                 return export_flow_keys(keys, BPF_OK);
 223         default:
 224                 return export_flow_keys(keys, BPF_DROP);
 225         }
 226
 227         return export_flow_keys(keys, BPF_DROP);
 228 }
 229
 230 static __always_inline int parse_ipv6_proto(struct __sk_buff *skb, __u8 nexthdr)
 231 {
 232         struct bpf_flow_keys *keys = skb->flow_keys;
 233
 234         keys->ip_proto = nexthdr;
 235         switch (nexthdr) {
 236         case IPPROTO_HOPOPTS:
 237         case IPPROTO_DSTOPTS:
 238                 bpf_tail_call(skb, &jmp_table, IPV6OP);
 239                 break;
 240         case IPPROTO_FRAGMENT:
 241                 bpf_tail_call(skb, &jmp_table, IPV6FR);
 242                 break;
 243         default:
 244                 return parse_ip_proto(skb, nexthdr);
 245         }
 246
 247         return export_flow_keys(keys, BPF_DROP);
 248 }
 249
 250 PROG(IP)(struct __sk_buff *skb)
 251 {
 252         void *data_end = (void *)(long)skb->data_end;
 253         struct bpf_flow_keys *keys = skb->flow_keys;
 254         void *data = (void *)(long)skb->data;
 255         struct iphdr *iph, _iph;
 256         bool done = false;
 257
 258         iph = bpf_flow_dissect_get_header(skb, sizeof(*iph), &_iph);
 259         if (!iph)
 260                 return export_flow_keys(keys, BPF_DROP);
 261
 262         /* IP header cannot be smaller than 20 bytes */
 263         if (iph->ihl < 5)
 264                 return export_flow_keys(keys, BPF_DROP);
 265
 266         keys->addr_proto = ETH_P_IP;
 267         keys->ipv4_src = iph->saddr;
 268         keys->ipv4_dst = iph->daddr;
 269
 270         keys->thoff += iph->ihl << 2;
 271         if (data + keys->thoff > data_end)
 272                 return export_flow_keys(keys, BPF_DROP);
 273
 274         if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET)) {
 275                 keys->is_frag = true;
 276                 if (iph->frag_off & bpf_htons(IP_OFFSET))
 277                         /* From second fragment on, packets do not have headers
 278                          * we can parse.
 279                          */
 280                         done = true;
 281                 else
 282                         keys->is_first_frag = true;
 283         }
 284
 285         if (done)
 286                 return export_flow_keys(keys, BPF_OK);
 287
 288         return parse_ip_proto(skb, iph->protocol);
 289 }
 290
 291 PROG(IPV6)(struct __sk_buff *skb)
 292 {
 293         struct bpf_flow_keys *keys = skb->flow_keys;
 294         struct ipv6hdr *ip6h, _ip6h;
 295
 296         ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
 297         if (!ip6h)
 298                 return export_flow_keys(keys, BPF_DROP);
 299
 300         keys->addr_proto = ETH_P_IPV6;
 301         memcpy(&keys->ipv6_src, &ip6h->saddr, 2*sizeof(ip6h->saddr));
 302
 303         keys->thoff += sizeof(struct ipv6hdr);
 304
 305         return parse_ipv6_proto(skb, ip6h->nexthdr);
 306 }
 307
 308 PROG(IPV6OP)(struct __sk_buff *skb)
 309 {
 310         struct bpf_flow_keys *keys = skb->flow_keys;
 311         struct ipv6_opt_hdr *ip6h, _ip6h;
 312
 313         ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
 314         if (!ip6h)
 315                 return export_flow_keys(keys, BPF_DROP);
 316
 317         /* hlen is in 8-octets and does not include the first 8 bytes
 318          * of the header
 319          */
 320         skb->flow_keys->thoff += (1 + ip6h->hdrlen) << 3;
 321
 322         return parse_ipv6_proto(skb, ip6h->nexthdr);
 323 }
 324
 325 PROG(IPV6FR)(struct __sk_buff *skb)
 326 {
 327         struct bpf_flow_keys *keys = skb->flow_keys;
 328         struct frag_hdr *fragh, _fragh;
 329
 330         fragh = bpf_flow_dissect_get_header(skb, sizeof(*fragh), &_fragh);
 331         if (!fragh)
 332                 return export_flow_keys(keys, BPF_DROP);
 333
 334         keys->thoff += sizeof(*fragh);
 335         keys->is_frag = true;
 336         if (!(fragh->frag_off & bpf_htons(IP6_OFFSET)))
 337                 keys->is_first_frag = true;
 338
 339         return parse_ipv6_proto(skb, fragh->nexthdr);
 340 }
 341
 342 PROG(MPLS)(struct __sk_buff *skb)
 343 {
 344         struct bpf_flow_keys *keys = skb->flow_keys;
 345         struct mpls_label *mpls, _mpls;
 346
 347         mpls = bpf_flow_dissect_get_header(skb, sizeof(*mpls), &_mpls);
 348         if (!mpls)
 349                 return export_flow_keys(keys, BPF_DROP);
 350
 351         return export_flow_keys(keys, BPF_OK);
 352 }
 353
 354 PROG(VLAN)(struct __sk_buff *skb)
 355 {
 356         struct bpf_flow_keys *keys = skb->flow_keys;
 357         struct vlan_hdr *vlan, _vlan;
 358
 359         /* Account for double-tagging */
 360         if (keys->n_proto == bpf_htons(ETH_P_8021AD)) {
 361                 vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
 362                 if (!vlan)
 363                         return export_flow_keys(keys, BPF_DROP);
 364
 365                 if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q))
 366                         return export_flow_keys(keys, BPF_DROP);
 367
 368                 keys->nhoff += sizeof(*vlan);
 369                 keys->thoff += sizeof(*vlan);
 370         }
 371
 372         vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
 373         if (!vlan)
 374                 return export_flow_keys(keys, BPF_DROP);
 375
 376         keys->nhoff += sizeof(*vlan);
 377         keys->thoff += sizeof(*vlan);
 378         /* Only allow 8021AD + 8021Q double tagging and no triple tagging.*/
 379         if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) ||
 380             vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q))
 381                 return export_flow_keys(keys, BPF_DROP);
 382
 383         keys->n_proto = vlan->h_vlan_encapsulated_proto;
 384         return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto);
 385 }
 386
 387 char __license[] SEC("license") = "GPL";