1 // SPDX-License-Identifier: GPL-2.0
6 #include <linux/pkt_cls.h>
9 #include <linux/if_ether.h>
10 #include <linux/icmp.h>
12 #include <linux/ipv6.h>
13 #include <linux/tcp.h>
14 #include <linux/udp.h>
15 #include <linux/if_packet.h>
16 #include <sys/socket.h>
17 #include <linux/if_tunnel.h>
18 #include <linux/mpls.h>
19 #include "bpf_helpers.h"
20 #include "bpf_endian.h"
22 int _version SEC("version") = 1;
23 #define PROG(F) SEC(#F) int bpf_func_##F
25 /* These are the identifiers of the BPF programs that will be used in tail
26 * calls. Name is limited to 16 characters, with the terminating character and
27 * bpf_func_ above, we have only 6 to work with, anything after will be cropped.
32 IPV6OP, /* Destination/Hop-by-Hop Options IPv6 Extension header */
33 IPV6FR, /* Fragmentation IPv6 Extension Header */
39 #define IP_OFFSET 0x1FFF
41 #define IP6_OFFSET 0xFFF8
45 __be16 h_vlan_encapsulated_proto;
57 __be32 identification;
60 struct bpf_map_def SEC("maps") jmp_table = {
61 .type = BPF_MAP_TYPE_PROG_ARRAY,
62 .key_size = sizeof(__u32),
63 .value_size = sizeof(__u32),
67 static __always_inline void *bpf_flow_dissect_get_header(struct __sk_buff *skb,
71 void *data_end = (void *)(long)skb->data_end;
72 void *data = (void *)(long)skb->data;
73 __u16 nhoff = skb->flow_keys->nhoff;
76 /* Verifies this variable offset does not overflow */
77 if (nhoff > (USHRT_MAX - hdr_size))
81 if (hdr + hdr_size <= data_end)
84 if (bpf_skb_load_bytes(skb, nhoff, buffer, hdr_size))
90 /* Dispatches on ETHERTYPE */
91 static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
93 struct bpf_flow_keys *keys = skb->flow_keys;
95 keys->n_proto = proto;
97 case bpf_htons(ETH_P_IP):
98 bpf_tail_call(skb, &jmp_table, IP);
100 case bpf_htons(ETH_P_IPV6):
101 bpf_tail_call(skb, &jmp_table, IPV6);
103 case bpf_htons(ETH_P_MPLS_MC):
104 case bpf_htons(ETH_P_MPLS_UC):
105 bpf_tail_call(skb, &jmp_table, MPLS);
107 case bpf_htons(ETH_P_8021Q):
108 case bpf_htons(ETH_P_8021AD):
109 bpf_tail_call(skb, &jmp_table, VLAN);
112 /* Protocol not supported */
119 SEC("flow_dissector")
120 int _dissect(struct __sk_buff *skb)
122 if (!skb->vlan_present)
123 return parse_eth_proto(skb, skb->protocol);
125 return parse_eth_proto(skb, skb->vlan_proto);
128 /* Parses on IPPROTO_* */
129 static __always_inline int parse_ip_proto(struct __sk_buff *skb, __u8 proto)
131 struct bpf_flow_keys *keys = skb->flow_keys;
132 void *data_end = (void *)(long)skb->data_end;
133 struct icmphdr *icmp, _icmp;
134 struct gre_hdr *gre, _gre;
135 struct ethhdr *eth, _eth;
136 struct tcphdr *tcp, _tcp;
137 struct udphdr *udp, _udp;
139 keys->ip_proto = proto;
142 icmp = bpf_flow_dissect_get_header(skb, sizeof(*icmp), &_icmp);
147 keys->is_encap = true;
148 return parse_eth_proto(skb, bpf_htons(ETH_P_IP));
150 keys->is_encap = true;
151 return parse_eth_proto(skb, bpf_htons(ETH_P_IPV6));
153 gre = bpf_flow_dissect_get_header(skb, sizeof(*gre), &_gre);
157 if (bpf_htons(gre->flags & GRE_VERSION))
158 /* Only inspect standard GRE packets with version 0 */
161 keys->nhoff += sizeof(*gre); /* Step over GRE Flags and Proto */
162 if (GRE_IS_CSUM(gre->flags))
163 keys->nhoff += 4; /* Step over chksum and Padding */
164 if (GRE_IS_KEY(gre->flags))
165 keys->nhoff += 4; /* Step over key */
166 if (GRE_IS_SEQ(gre->flags))
167 keys->nhoff += 4; /* Step over sequence number */
169 keys->is_encap = true;
171 if (gre->proto == bpf_htons(ETH_P_TEB)) {
172 eth = bpf_flow_dissect_get_header(skb, sizeof(*eth),
177 keys->nhoff += sizeof(*eth);
179 return parse_eth_proto(skb, eth->h_proto);
181 return parse_eth_proto(skb, gre->proto);
184 tcp = bpf_flow_dissect_get_header(skb, sizeof(*tcp), &_tcp);
191 if ((__u8 *)tcp + (tcp->doff << 2) > data_end)
194 keys->thoff = keys->nhoff;
195 keys->sport = tcp->source;
196 keys->dport = tcp->dest;
199 case IPPROTO_UDPLITE:
200 udp = bpf_flow_dissect_get_header(skb, sizeof(*udp), &_udp);
204 keys->thoff = keys->nhoff;
205 keys->sport = udp->source;
206 keys->dport = udp->dest;
215 static __always_inline int parse_ipv6_proto(struct __sk_buff *skb, __u8 nexthdr)
217 struct bpf_flow_keys *keys = skb->flow_keys;
219 keys->ip_proto = nexthdr;
221 case IPPROTO_HOPOPTS:
222 case IPPROTO_DSTOPTS:
223 bpf_tail_call(skb, &jmp_table, IPV6OP);
225 case IPPROTO_FRAGMENT:
226 bpf_tail_call(skb, &jmp_table, IPV6FR);
229 return parse_ip_proto(skb, nexthdr);
235 PROG(IP)(struct __sk_buff *skb)
237 void *data_end = (void *)(long)skb->data_end;
238 struct bpf_flow_keys *keys = skb->flow_keys;
239 void *data = (void *)(long)skb->data;
240 struct iphdr *iph, _iph;
243 iph = bpf_flow_dissect_get_header(skb, sizeof(*iph), &_iph);
247 /* IP header cannot be smaller than 20 bytes */
251 keys->addr_proto = ETH_P_IP;
252 keys->ipv4_src = iph->saddr;
253 keys->ipv4_dst = iph->daddr;
255 keys->nhoff += iph->ihl << 2;
256 if (data + keys->nhoff > data_end)
259 if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET)) {
260 keys->is_frag = true;
261 if (iph->frag_off & bpf_htons(IP_OFFSET))
262 /* From second fragment on, packets do not have headers
267 keys->is_first_frag = true;
273 return parse_ip_proto(skb, iph->protocol);
276 PROG(IPV6)(struct __sk_buff *skb)
278 struct bpf_flow_keys *keys = skb->flow_keys;
279 struct ipv6hdr *ip6h, _ip6h;
281 ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
285 keys->addr_proto = ETH_P_IPV6;
286 memcpy(&keys->ipv6_src, &ip6h->saddr, 2*sizeof(ip6h->saddr));
288 keys->nhoff += sizeof(struct ipv6hdr);
290 return parse_ipv6_proto(skb, ip6h->nexthdr);
293 PROG(IPV6OP)(struct __sk_buff *skb)
295 struct ipv6_opt_hdr *ip6h, _ip6h;
297 ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
301 /* hlen is in 8-octets and does not include the first 8 bytes
304 skb->flow_keys->nhoff += (1 + ip6h->hdrlen) << 3;
306 return parse_ipv6_proto(skb, ip6h->nexthdr);
309 PROG(IPV6FR)(struct __sk_buff *skb)
311 struct bpf_flow_keys *keys = skb->flow_keys;
312 struct frag_hdr *fragh, _fragh;
314 fragh = bpf_flow_dissect_get_header(skb, sizeof(*fragh), &_fragh);
318 keys->nhoff += sizeof(*fragh);
319 keys->is_frag = true;
320 if (!(fragh->frag_off & bpf_htons(IP6_OFFSET)))
321 keys->is_first_frag = true;
323 return parse_ipv6_proto(skb, fragh->nexthdr);
326 PROG(MPLS)(struct __sk_buff *skb)
328 struct mpls_label *mpls, _mpls;
330 mpls = bpf_flow_dissect_get_header(skb, sizeof(*mpls), &_mpls);
337 PROG(VLAN)(struct __sk_buff *skb)
339 struct bpf_flow_keys *keys = skb->flow_keys;
340 struct vlan_hdr *vlan, _vlan;
343 /* Peek back to see if single or double-tagging */
344 if (bpf_skb_load_bytes(skb, keys->nhoff - sizeof(proto), &proto,
348 /* Account for double-tagging */
349 if (proto == bpf_htons(ETH_P_8021AD)) {
350 vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
354 if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q))
357 keys->nhoff += sizeof(*vlan);
360 vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
364 keys->nhoff += sizeof(*vlan);
365 /* Only allow 8021AD + 8021Q double tagging and no triple tagging.*/
366 if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) ||
367 vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q))
370 return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto);
373 char __license[] SEC("license") = "GPL";