1// SPDX-License-Identifier: GPL-2.0
  2#define BPF_NO_KFUNC_PROTOTYPES
  3#include <vmlinux.h>
  4#include <bpf/bpf_helpers.h>
  5#include <bpf/bpf_endian.h>
  6
  7#define ETH_P_IP	0x0800
  8#define ETH_P_IPV6	0x86dd
  9#define IP_MF		0x2000	/* "More Fragments" */
 10#define IP_OFFSET	0x1fff	/* "Fragment Offset" */
 11#define AF_INET		2
 12#define AF_INET6	10
 13
 14struct bpf_flowtable_opts___local {
 15	s32 error;
 16};
 17
 18struct flow_offload_tuple_rhash *
 19bpf_xdp_flow_lookup(struct xdp_md *, struct bpf_fib_lookup *,
 20		    struct bpf_flowtable_opts___local *, u32) __ksym;
 21
 22struct {
 23	__uint(type, BPF_MAP_TYPE_ARRAY);
 24	__type(key, __u32);
 25	__type(value, __u32);
 26	__uint(max_entries, 1);
 27} stats SEC(".maps");
 28
 29static bool xdp_flowtable_offload_check_iphdr(struct iphdr *iph)
 30{
 31	/* ip fragmented traffic */
 32	if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET))
 33		return false;
 34
 35	/* ip options */
 36	if (iph->ihl * 4 != sizeof(*iph))
 37		return false;
 38
 39	if (iph->ttl <= 1)
 40		return false;
 41
 42	return true;
 43}
 44
 45static bool xdp_flowtable_offload_check_tcp_state(void *ports, void *data_end,
 46						  u8 proto)
 47{
 48	if (proto == IPPROTO_TCP) {
 49		struct tcphdr *tcph = ports;
 50
 51		if (tcph + 1 > data_end)
 52			return false;
 53
 54		if (tcph->fin || tcph->rst)
 55			return false;
 56	}
 57
 58	return true;
 59}
 60
 61struct flow_ports___local {
 62	__be16 source, dest;
 63} __attribute__((preserve_access_index));
 64
 65SEC("xdp.frags")
 66int xdp_flowtable_do_lookup(struct xdp_md *ctx)
 67{
 68	void *data_end = (void *)(long)ctx->data_end;
 69	struct bpf_flowtable_opts___local opts = {};
 70	struct flow_offload_tuple_rhash *tuplehash;
 71	struct bpf_fib_lookup tuple = {
 72		.ifindex = ctx->ingress_ifindex,
 73	};
 74	void *data = (void *)(long)ctx->data;
 75	struct ethhdr *eth = data;
 76	struct flow_ports___local *ports;
 77	__u32 *val, key = 0;
 78
 79	if (eth + 1 > data_end)
 80		return XDP_DROP;
 81
 82	switch (eth->h_proto) {
 83	case bpf_htons(ETH_P_IP): {
 84		struct iphdr *iph = data + sizeof(*eth);
 85
 86		ports = (struct flow_ports___local *)(iph + 1);
 87		if (ports + 1 > data_end)
 88			return XDP_PASS;
 89
 90		/* sanity check on ip header */
 91		if (!xdp_flowtable_offload_check_iphdr(iph))
 92			return XDP_PASS;
 93
 94		if (!xdp_flowtable_offload_check_tcp_state(ports, data_end,
 95							   iph->protocol))
 96			return XDP_PASS;
 97
 98		tuple.family		= AF_INET;
 99		tuple.tos		= iph->tos;
100		tuple.l4_protocol	= iph->protocol;
101		tuple.tot_len		= bpf_ntohs(iph->tot_len);
102		tuple.ipv4_src		= iph->saddr;
103		tuple.ipv4_dst		= iph->daddr;
104		tuple.sport		= ports->source;
105		tuple.dport		= ports->dest;
106		break;
107	}
108	case bpf_htons(ETH_P_IPV6): {
109		struct in6_addr *src = (struct in6_addr *)tuple.ipv6_src;
110		struct in6_addr *dst = (struct in6_addr *)tuple.ipv6_dst;
111		struct ipv6hdr *ip6h = data + sizeof(*eth);
112
113		ports = (struct flow_ports___local *)(ip6h + 1);
114		if (ports + 1 > data_end)
115			return XDP_PASS;
116
117		if (ip6h->hop_limit <= 1)
118			return XDP_PASS;
119
120		if (!xdp_flowtable_offload_check_tcp_state(ports, data_end,
121							   ip6h->nexthdr))
122			return XDP_PASS;
123
124		tuple.family		= AF_INET6;
125		tuple.l4_protocol	= ip6h->nexthdr;
126		tuple.tot_len		= bpf_ntohs(ip6h->payload_len);
127		*src			= ip6h->saddr;
128		*dst			= ip6h->daddr;
129		tuple.sport		= ports->source;
130		tuple.dport		= ports->dest;
131		break;
132	}
133	default:
134		return XDP_PASS;
135	}
136
137	tuplehash = bpf_xdp_flow_lookup(ctx, &tuple, &opts, sizeof(opts));
138	if (!tuplehash)
139		return XDP_PASS;
140
141	val = bpf_map_lookup_elem(&stats, &key);
142	if (val)
143		__sync_add_and_fetch(val, 1);
144
145	return XDP_PASS;
146}
147
148char _license[] SEC("license") = "GPL";