^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) #include <uapi/linux/bpf.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) #include <uapi/linux/in.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) #include <uapi/linux/if.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) #include <uapi/linux/if_ether.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) #include <uapi/linux/ip.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) #include <uapi/linux/ipv6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) #include <uapi/linux/if_tunnel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) #include <bpf/bpf_helpers.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) #include "bpf_legacy.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #define IP_MF 0x2000
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #define IP_OFFSET 0x1FFF
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) struct vlan_hdr {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) __be16 h_vlan_TCI;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) __be16 h_vlan_encapsulated_proto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) struct flow_key_record {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) __be32 src;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) __be32 dst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) __be32 ports;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) __be16 port16[2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) __u16 thoff;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) __u8 ip_proto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) static inline int proto_ports_offset(__u64 proto)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) switch (proto) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) case IPPROTO_TCP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) case IPPROTO_UDP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) case IPPROTO_DCCP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) case IPPROTO_ESP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) case IPPROTO_SCTP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) case IPPROTO_UDPLITE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) case IPPROTO_AH:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) return 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) static inline int ip_is_fragment(struct __sk_buff *ctx, __u64 nhoff)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) return load_half(ctx, nhoff + offsetof(struct iphdr, frag_off))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) & (IP_MF | IP_OFFSET);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) static inline __u32 ipv6_addr_hash(struct __sk_buff *ctx, __u64 off)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) __u64 w0 = load_word(ctx, off);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) __u64 w1 = load_word(ctx, off + 4);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) __u64 w2 = load_word(ctx, off + 8);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) __u64 w3 = load_word(ctx, off + 12);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) return (__u32)(w0 ^ w1 ^ w2 ^ w3);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) static inline __u64 parse_ip(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) struct flow_key_record *flow)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) __u64 verlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) if (unlikely(ip_is_fragment(skb, nhoff)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) *ip_proto = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) *ip_proto = load_byte(skb, nhoff + offsetof(struct iphdr, protocol));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) if (*ip_proto != IPPROTO_GRE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) flow->src = load_word(skb, nhoff + offsetof(struct iphdr, saddr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) flow->dst = load_word(skb, nhoff + offsetof(struct iphdr, daddr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) verlen = load_byte(skb, nhoff + 0/*offsetof(struct iphdr, ihl)*/);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) if (likely(verlen == 0x45))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) nhoff += 20;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) nhoff += (verlen & 0xF) << 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) return nhoff;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) static inline __u64 parse_ipv6(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) struct flow_key_record *flow)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) *ip_proto = load_byte(skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) nhoff + offsetof(struct ipv6hdr, nexthdr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) flow->src = ipv6_addr_hash(skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) nhoff + offsetof(struct ipv6hdr, saddr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) flow->dst = ipv6_addr_hash(skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) nhoff + offsetof(struct ipv6hdr, daddr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) nhoff += sizeof(struct ipv6hdr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) return nhoff;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) static inline bool flow_dissector(struct __sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) struct flow_key_record *flow)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) __u64 nhoff = ETH_HLEN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) __u64 ip_proto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) __u64 proto = load_half(skb, 12);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) int poff;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) if (proto == ETH_P_8021AD) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) proto = load_half(skb, nhoff + offsetof(struct vlan_hdr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) h_vlan_encapsulated_proto));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) nhoff += sizeof(struct vlan_hdr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) if (proto == ETH_P_8021Q) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) proto = load_half(skb, nhoff + offsetof(struct vlan_hdr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) h_vlan_encapsulated_proto));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) nhoff += sizeof(struct vlan_hdr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) if (likely(proto == ETH_P_IP))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) nhoff = parse_ip(skb, nhoff, &ip_proto, flow);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) else if (proto == ETH_P_IPV6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) nhoff = parse_ipv6(skb, nhoff, &ip_proto, flow);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) switch (ip_proto) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) case IPPROTO_GRE: {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) struct gre_hdr {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) __be16 flags;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) __be16 proto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) __u64 gre_flags = load_half(skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) nhoff + offsetof(struct gre_hdr, flags));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) __u64 gre_proto = load_half(skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) nhoff + offsetof(struct gre_hdr, proto));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) if (gre_flags & (GRE_VERSION|GRE_ROUTING))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) proto = gre_proto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) nhoff += 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) if (gre_flags & GRE_CSUM)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) nhoff += 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) if (gre_flags & GRE_KEY)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) nhoff += 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) if (gre_flags & GRE_SEQ)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) nhoff += 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) if (proto == ETH_P_8021Q) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) proto = load_half(skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) nhoff + offsetof(struct vlan_hdr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) h_vlan_encapsulated_proto));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) nhoff += sizeof(struct vlan_hdr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) if (proto == ETH_P_IP)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) nhoff = parse_ip(skb, nhoff, &ip_proto, flow);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) else if (proto == ETH_P_IPV6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) nhoff = parse_ipv6(skb, nhoff, &ip_proto, flow);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) case IPPROTO_IPIP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) nhoff = parse_ip(skb, nhoff, &ip_proto, flow);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) case IPPROTO_IPV6:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) nhoff = parse_ipv6(skb, nhoff, &ip_proto, flow);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) flow->ip_proto = ip_proto;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) poff = proto_ports_offset(ip_proto);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) if (poff >= 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) nhoff += poff;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) flow->ports = load_word(skb, nhoff);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) flow->thoff = (__u16) nhoff;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) struct pair {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) long packets;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) long bytes;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) __uint(type, BPF_MAP_TYPE_HASH);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) __type(key, __be32);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) __type(value, struct pair);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) __uint(max_entries, 1024);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) } hash_map SEC(".maps");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) SEC("socket2")
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) int bpf_prog2(struct __sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) struct flow_key_record flow = {};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) struct pair *value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) u32 key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) if (!flow_dissector(skb, &flow))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) key = flow.dst;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) value = bpf_map_lookup_elem(&hash_map, &key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) if (value) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) __sync_fetch_and_add(&value->packets, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) __sync_fetch_and_add(&value->bytes, skb->len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) struct pair val = {1, skb->len};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) bpf_map_update_elem(&hash_map, &key, &val, BPF_ANY);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) char _license[] SEC("license") = "GPL";