tools/testing/selftests/bpf/progs/bpf_flow.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <limits.h>
   3 #include <stddef.h>
   4 #include <stdbool.h>
   5 #include <string.h>
   6 #include <linux/pkt_cls.h>
   7 #include <linux/bpf.h>
   8 #include <linux/in.h>
   9 #include <linux/if_ether.h>
  10 #include <linux/icmp.h>
  11 #include <linux/ip.h>
  12 #include <linux/ipv6.h>
  13 #include <linux/tcp.h>
  14 #include <linux/udp.h>
  15 #include <linux/if_packet.h>
  16 #include <sys/socket.h>
  17 #include <linux/if_tunnel.h>
  18 #include <linux/mpls.h>
  19 #include <bpf/bpf_helpers.h>
  20 #include <bpf/bpf_endian.h>
  21
  22 #define PROG(F) PROG_(F, _##F)
  23 #define PROG_(NUM, NAME) SEC("flow_dissector") int flow_dissector_##NUM
  24
  25 #define FLOW_CONTINUE_SADDR 0x7f00007f /* 127.0.0.127 */
  26
  27 /* These are the identifiers of the BPF programs that will be used in tail
  28  * calls. Name is limited to 16 characters, with the terminating character and
  29  * bpf_func_ above, we have only 6 to work with, anything after will be cropped.
  30  */
  31 #define IP              0
  32 #define IPV6            1
  33 #define IPV6OP          2 /* Destination/Hop-by-Hop Options IPv6 Ext. Header */
  34 #define IPV6FR          3 /* Fragmentation IPv6 Extension Header */
  35 #define MPLS            4
  36 #define VLAN            5
  37 #define MAX_PROG        6
  38
  39 #define IP_MF           0x2000
  40 #define IP_OFFSET       0x1FFF
  41 #define IP6_MF          0x0001
  42 #define IP6_OFFSET      0xFFF8
  43
  44 struct vlan_hdr {
  45         __be16 h_vlan_TCI;
  46         __be16 h_vlan_encapsulated_proto;
  47 };
  48
  49 struct gre_hdr {
  50         __be16 flags;
  51         __be16 proto;
  52 };
  53
  54 struct frag_hdr {
  55         __u8 nexthdr;
  56         __u8 reserved;
  57         __be16 frag_off;
  58         __be32 identification;
  59 };
  60
  61 struct {
  62         __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
  63         __uint(max_entries, MAX_PROG);
  64         __uint(key_size, sizeof(__u32));
  65         __uint(value_size, sizeof(__u32));
  66 } jmp_table SEC(".maps");
  67
  68 struct {
  69         __uint(type, BPF_MAP_TYPE_HASH);
  70         __uint(max_entries, 1024);
  71         __type(key, __u32);
  72         __type(value, struct bpf_flow_keys);
  73 } last_dissection SEC(".maps");
  74
  75 static __always_inline int export_flow_keys(struct bpf_flow_keys *keys,
  76                                             int ret)
  77 {
  78         __u32 key = (__u32)(keys->sport) << 16 | keys->dport;
  79         struct bpf_flow_keys val;
  80
  81         memcpy(&val, keys, sizeof(val));
  82         bpf_map_update_elem(&last_dissection, &key, &val, BPF_ANY);
  83         return ret;
  84 }
  85
  86 #define IPV6_FLOWLABEL_MASK             __bpf_constant_htonl(0x000FFFFF)
  87 static inline __be32 ip6_flowlabel(const struct ipv6hdr *hdr)
  88 {
  89         return *(__be32 *)hdr & IPV6_FLOWLABEL_MASK;
  90 }
  91
  92 static __always_inline void *bpf_flow_dissect_get_header(struct __sk_buff *skb,
  93                                                          __u16 hdr_size,
  94                                                          void *buffer)
  95 {
  96         void *data_end = (void *)(long)skb->data_end;
  97         void *data = (void *)(long)skb->data;
  98         __u16 thoff = skb->flow_keys->thoff;
  99         __u8 *hdr;
 100
 101         /* Verifies this variable offset does not overflow */
 102         if (thoff > (USHRT_MAX - hdr_size))
 103                 return NULL;
 104
 105         hdr = data + thoff;
 106         if (hdr + hdr_size <= data_end)
 107                 return hdr;
 108
 109         if (bpf_skb_load_bytes(skb, thoff, buffer, hdr_size))
 110                 return NULL;
 111
 112         return buffer;
 113 }
 114
 115 /* Dispatches on ETHERTYPE */
 116 static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
 117 {
 118         struct bpf_flow_keys *keys = skb->flow_keys;
 119
 120         switch (proto) {
 121         case bpf_htons(ETH_P_IP):
 122                 bpf_tail_call_static(skb, &jmp_table, IP);
 123                 break;
 124         case bpf_htons(ETH_P_IPV6):
 125                 bpf_tail_call_static(skb, &jmp_table, IPV6);
 126                 break;
 127         case bpf_htons(ETH_P_MPLS_MC):
 128         case bpf_htons(ETH_P_MPLS_UC):
 129                 bpf_tail_call_static(skb, &jmp_table, MPLS);
 130                 break;
 131         case bpf_htons(ETH_P_8021Q):
 132         case bpf_htons(ETH_P_8021AD):
 133                 bpf_tail_call_static(skb, &jmp_table, VLAN);
 134                 break;
 135         default:
 136                 /* Protocol not supported */
 137                 return export_flow_keys(keys, BPF_DROP);
 138         }
 139
 140         return export_flow_keys(keys, BPF_DROP);
 141 }
 142
 143 SEC("flow_dissector")
 144 int _dissect(struct __sk_buff *skb)
 145 {
 146         struct bpf_flow_keys *keys = skb->flow_keys;
 147
 148         if (keys->n_proto == bpf_htons(ETH_P_IP)) {
 149                 /* IP traffic from FLOW_CONTINUE_SADDR falls-back to
 150                  * standard dissector
 151                  */
 152                 struct iphdr *iph, _iph;
 153
 154                 iph = bpf_flow_dissect_get_header(skb, sizeof(*iph), &_iph);
 155                 if (iph && iph->ihl == 5 &&
 156                     iph->saddr == bpf_htonl(FLOW_CONTINUE_SADDR)) {
 157                         return BPF_FLOW_DISSECTOR_CONTINUE;
 158                 }
 159         }
 160
 161         return parse_eth_proto(skb, keys->n_proto);
 162 }
 163
 164 /* Parses on IPPROTO_* */
 165 static __always_inline int parse_ip_proto(struct __sk_buff *skb, __u8 proto)
 166 {
 167         struct bpf_flow_keys *keys = skb->flow_keys;
 168         void *data_end = (void *)(long)skb->data_end;
 169         struct icmphdr *icmp, _icmp;
 170         struct gre_hdr *gre, _gre;
 171         struct ethhdr *eth, _eth;
 172         struct tcphdr *tcp, _tcp;
 173         struct udphdr *udp, _udp;
 174
 175         switch (proto) {
 176         case IPPROTO_ICMP:
 177                 icmp = bpf_flow_dissect_get_header(skb, sizeof(*icmp), &_icmp);
 178                 if (!icmp)
 179                         return export_flow_keys(keys, BPF_DROP);
 180                 return export_flow_keys(keys, BPF_OK);
 181         case IPPROTO_IPIP:
 182                 keys->is_encap = true;
 183                 if (keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP)
 184                         return export_flow_keys(keys, BPF_OK);
 185
 186                 return parse_eth_proto(skb, bpf_htons(ETH_P_IP));
 187         case IPPROTO_IPV6:
 188                 keys->is_encap = true;
 189                 if (keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP)
 190                         return export_flow_keys(keys, BPF_OK);
 191
 192                 return parse_eth_proto(skb, bpf_htons(ETH_P_IPV6));
 193         case IPPROTO_GRE:
 194                 gre = bpf_flow_dissect_get_header(skb, sizeof(*gre), &_gre);
 195                 if (!gre)
 196                         return export_flow_keys(keys, BPF_DROP);
 197
 198                 if (bpf_htons(gre->flags & GRE_VERSION))
 199                         /* Only inspect standard GRE packets with version 0 */
 200                         return export_flow_keys(keys, BPF_OK);
 201
 202                 keys->thoff += sizeof(*gre); /* Step over GRE Flags and Proto */
 203                 if (GRE_IS_CSUM(gre->flags))
 204                         keys->thoff += 4; /* Step over chksum and Padding */
 205                 if (GRE_IS_KEY(gre->flags))
 206                         keys->thoff += 4; /* Step over key */
 207                 if (GRE_IS_SEQ(gre->flags))
 208                         keys->thoff += 4; /* Step over sequence number */
 209
 210                 keys->is_encap = true;
 211                 if (keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP)
 212                         return export_flow_keys(keys, BPF_OK);
 213
 214                 if (gre->proto == bpf_htons(ETH_P_TEB)) {
 215                         eth = bpf_flow_dissect_get_header(skb, sizeof(*eth),
 216                                                           &_eth);
 217                         if (!eth)
 218                                 return export_flow_keys(keys, BPF_DROP);
 219
 220                         keys->thoff += sizeof(*eth);
 221
 222                         return parse_eth_proto(skb, eth->h_proto);
 223                 } else {
 224                         return parse_eth_proto(skb, gre->proto);
 225                 }
 226         case IPPROTO_TCP:
 227                 tcp = bpf_flow_dissect_get_header(skb, sizeof(*tcp), &_tcp);
 228                 if (!tcp)
 229                         return export_flow_keys(keys, BPF_DROP);
 230
 231                 if (tcp->doff < 5)
 232                         return export_flow_keys(keys, BPF_DROP);
 233
 234                 if ((__u8 *)tcp + (tcp->doff << 2) > data_end)
 235                         return export_flow_keys(keys, BPF_DROP);
 236
 237                 keys->sport = tcp->source;
 238                 keys->dport = tcp->dest;
 239                 return export_flow_keys(keys, BPF_OK);
 240         case IPPROTO_UDP:
 241         case IPPROTO_UDPLITE:
 242                 udp = bpf_flow_dissect_get_header(skb, sizeof(*udp), &_udp);
 243                 if (!udp)
 244                         return export_flow_keys(keys, BPF_DROP);
 245
 246                 keys->sport = udp->source;
 247                 keys->dport = udp->dest;
 248                 return export_flow_keys(keys, BPF_OK);
 249         default:
 250                 return export_flow_keys(keys, BPF_DROP);
 251         }
 252
 253         return export_flow_keys(keys, BPF_DROP);
 254 }
 255
 256 static __always_inline int parse_ipv6_proto(struct __sk_buff *skb, __u8 nexthdr)
 257 {
 258         struct bpf_flow_keys *keys = skb->flow_keys;
 259
 260         switch (nexthdr) {
 261         case IPPROTO_HOPOPTS:
 262         case IPPROTO_DSTOPTS:
 263                 bpf_tail_call_static(skb, &jmp_table, IPV6OP);
 264                 break;
 265         case IPPROTO_FRAGMENT:
 266                 bpf_tail_call_static(skb, &jmp_table, IPV6FR);
 267                 break;
 268         default:
 269                 return parse_ip_proto(skb, nexthdr);
 270         }
 271
 272         return export_flow_keys(keys, BPF_DROP);
 273 }
 274
 275 PROG(IP)(struct __sk_buff *skb)
 276 {
 277         void *data_end = (void *)(long)skb->data_end;
 278         struct bpf_flow_keys *keys = skb->flow_keys;
 279         void *data = (void *)(long)skb->data;
 280         struct iphdr *iph, _iph;
 281         bool done = false;
 282
 283         iph = bpf_flow_dissect_get_header(skb, sizeof(*iph), &_iph);
 284         if (!iph)
 285                 return export_flow_keys(keys, BPF_DROP);
 286
 287         /* IP header cannot be smaller than 20 bytes */
 288         if (iph->ihl < 5)
 289                 return export_flow_keys(keys, BPF_DROP);
 290
 291         keys->addr_proto = ETH_P_IP;
 292         keys->ipv4_src = iph->saddr;
 293         keys->ipv4_dst = iph->daddr;
 294         keys->ip_proto = iph->protocol;
 295
 296         keys->thoff += iph->ihl << 2;
 297         if (data + keys->thoff > data_end)
 298                 return export_flow_keys(keys, BPF_DROP);
 299
 300         if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET)) {
 301                 keys->is_frag = true;
 302                 if (iph->frag_off & bpf_htons(IP_OFFSET)) {
 303                         /* From second fragment on, packets do not have headers
 304                          * we can parse.
 305                          */
 306                         done = true;
 307                 } else {
 308                         keys->is_first_frag = true;
 309                         /* No need to parse fragmented packet unless
 310                          * explicitly asked for.
 311                          */
 312                         if (!(keys->flags &
 313                               BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG))
 314                                 done = true;
 315                 }
 316         }
 317
 318         if (done)
 319                 return export_flow_keys(keys, BPF_OK);
 320
 321         return parse_ip_proto(skb, iph->protocol);
 322 }
 323
 324 PROG(IPV6)(struct __sk_buff *skb)
 325 {
 326         struct bpf_flow_keys *keys = skb->flow_keys;
 327         struct ipv6hdr *ip6h, _ip6h;
 328
 329         ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
 330         if (!ip6h)
 331                 return export_flow_keys(keys, BPF_DROP);
 332
 333         keys->addr_proto = ETH_P_IPV6;
 334         memcpy(&keys->ipv6_src, &ip6h->saddr, 2*sizeof(ip6h->saddr));
 335
 336         keys->thoff += sizeof(struct ipv6hdr);
 337         keys->ip_proto = ip6h->nexthdr;
 338         keys->flow_label = ip6_flowlabel(ip6h);
 339
 340         if (keys->flow_label && keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL)
 341                 return export_flow_keys(keys, BPF_OK);
 342
 343         return parse_ipv6_proto(skb, ip6h->nexthdr);
 344 }
 345
 346 PROG(IPV6OP)(struct __sk_buff *skb)
 347 {
 348         struct bpf_flow_keys *keys = skb->flow_keys;
 349         struct ipv6_opt_hdr *ip6h, _ip6h;
 350
 351         ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
 352         if (!ip6h)
 353                 return export_flow_keys(keys, BPF_DROP);
 354
 355         /* hlen is in 8-octets and does not include the first 8 bytes
 356          * of the header
 357          */
 358         keys->thoff += (1 + ip6h->hdrlen) << 3;
 359         keys->ip_proto = ip6h->nexthdr;
 360
 361         return parse_ipv6_proto(skb, ip6h->nexthdr);
 362 }
 363
 364 PROG(IPV6FR)(struct __sk_buff *skb)
 365 {
 366         struct bpf_flow_keys *keys = skb->flow_keys;
 367         struct frag_hdr *fragh, _fragh;
 368
 369         fragh = bpf_flow_dissect_get_header(skb, sizeof(*fragh), &_fragh);
 370         if (!fragh)
 371                 return export_flow_keys(keys, BPF_DROP);
 372
 373         keys->thoff += sizeof(*fragh);
 374         keys->is_frag = true;
 375         keys->ip_proto = fragh->nexthdr;
 376
 377         if (!(fragh->frag_off & bpf_htons(IP6_OFFSET))) {
 378                 keys->is_first_frag = true;
 379
 380                 /* No need to parse fragmented packet unless
 381                  * explicitly asked for.
 382                  */
 383                 if (!(keys->flags & BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG))
 384                         return export_flow_keys(keys, BPF_OK);
 385         } else {
 386                 return export_flow_keys(keys, BPF_OK);
 387         }
 388
 389         return parse_ipv6_proto(skb, fragh->nexthdr);
 390 }
 391
 392 PROG(MPLS)(struct __sk_buff *skb)
 393 {
 394         struct bpf_flow_keys *keys = skb->flow_keys;
 395         struct mpls_label *mpls, _mpls;
 396
 397         mpls = bpf_flow_dissect_get_header(skb, sizeof(*mpls), &_mpls);
 398         if (!mpls)
 399                 return export_flow_keys(keys, BPF_DROP);
 400
 401         return export_flow_keys(keys, BPF_OK);
 402 }
 403
 404 PROG(VLAN)(struct __sk_buff *skb)
 405 {
 406         struct bpf_flow_keys *keys = skb->flow_keys;
 407         struct vlan_hdr *vlan, _vlan;
 408
 409         /* Account for double-tagging */
 410         if (keys->n_proto == bpf_htons(ETH_P_8021AD)) {
 411                 vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
 412                 if (!vlan)
 413                         return export_flow_keys(keys, BPF_DROP);
 414
 415                 if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q))
 416                         return export_flow_keys(keys, BPF_DROP);
 417
 418                 keys->nhoff += sizeof(*vlan);
 419                 keys->thoff += sizeof(*vlan);
 420         }
 421
 422         vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
 423         if (!vlan)
 424                 return export_flow_keys(keys, BPF_DROP);
 425
 426         keys->nhoff += sizeof(*vlan);
 427         keys->thoff += sizeof(*vlan);
 428         /* Only allow 8021AD + 8021Q double tagging and no triple tagging.*/
 429         if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) ||
 430             vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q))
 431                 return export_flow_keys(keys, BPF_DROP);
 432
 433         keys->n_proto = vlan->h_vlan_encapsulated_proto;
 434         return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto);
 435 }
 436
 437 char __license[] SEC("license") = "GPL";