samples/bpf/xdp_tx_iptunnel_kern.c

0001 /* Copyright (c) 2016 Facebook
0002  *
0003  * This program is free software; you can redistribute it and/or
0004  * modify it under the terms of version 2 of the GNU General Public
0005  * License as published by the Free Software Foundation.
0006  *
0007  * This program shows how to use bpf_xdp_adjust_head() by
0008  * encapsulating the incoming packet in an IPv4/v6 header
0009  * and then XDP_TX it out.
0010  */
0011 #define KBUILD_MODNAME "foo"
0012 #include <uapi/linux/bpf.h>
0013 #include <linux/in.h>
0014 #include <linux/if_ether.h>
0015 #include <linux/if_packet.h>
0016 #include <linux/if_vlan.h>
0017 #include <linux/ip.h>
0018 #include <linux/ipv6.h>
0019 #include <bpf/bpf_helpers.h>
0020 #include "xdp_tx_iptunnel_common.h"
0021
0022 struct {
0023     __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
0024     __type(key, __u32);
0025     __type(value, __u64);
0026     __uint(max_entries, 256);
0027 } rxcnt SEC(".maps");
0028
0029 struct {
0030     __uint(type, BPF_MAP_TYPE_HASH);
0031     __type(key, struct vip);
0032     __type(value, struct iptnl_info);
0033     __uint(max_entries, MAX_IPTNL_ENTRIES);
0034 } vip2tnl SEC(".maps");
0035
0036 static __always_inline void count_tx(u32 protocol)
0037 {
0038     u64 *rxcnt_count;
0039
0040     rxcnt_count = bpf_map_lookup_elem(&rxcnt, &protocol);
0041     if (rxcnt_count)
0042         *rxcnt_count += 1;
0043 }
0044
0045 static __always_inline int get_dport(void *trans_data, void *data_end,
0046                      u8 protocol)
0047 {
0048     struct tcphdr *th;
0049     struct udphdr *uh;
0050
0051     switch (protocol) {
0052     case IPPROTO_TCP:
0053         th = (struct tcphdr *)trans_data;
0054         if (th + 1 > data_end)
0055             return -1;
0056         return th->dest;
0057     case IPPROTO_UDP:
0058         uh = (struct udphdr *)trans_data;
0059         if (uh + 1 > data_end)
0060             return -1;
0061         return uh->dest;
0062     default:
0063         return 0;
0064     }
0065 }
0066
0067 static __always_inline void set_ethhdr(struct ethhdr *new_eth,
0068                        const struct ethhdr *old_eth,
0069                        const struct iptnl_info *tnl,
0070                        __be16 h_proto)
0071 {
0072     memcpy(new_eth->h_source, old_eth->h_dest, sizeof(new_eth->h_source));
0073     memcpy(new_eth->h_dest, tnl->dmac, sizeof(new_eth->h_dest));
0074     new_eth->h_proto = h_proto;
0075 }
0076
0077 static __always_inline int handle_ipv4(struct xdp_md *xdp)
0078 {
0079     void *data_end = (void *)(long)xdp->data_end;
0080     void *data = (void *)(long)xdp->data;
0081     struct iptnl_info *tnl;
0082     struct ethhdr *new_eth;
0083     struct ethhdr *old_eth;
0084     struct iphdr *iph = data + sizeof(struct ethhdr);
0085     u16 *next_iph_u16;
0086     u16 payload_len;
0087     struct vip vip = {};
0088     int dport;
0089     u32 csum = 0;
0090     int i;
0091
0092     if (iph + 1 > data_end)
0093         return XDP_DROP;
0094
0095     dport = get_dport(iph + 1, data_end, iph->protocol);
0096     if (dport == -1)
0097         return XDP_DROP;
0098
0099     vip.protocol = iph->protocol;
0100     vip.family = AF_INET;
0101     vip.daddr.v4 = iph->daddr;
0102     vip.dport = dport;
0103     payload_len = ntohs(iph->tot_len);
0104
0105     tnl = bpf_map_lookup_elem(&vip2tnl, &vip);
0106     /* It only does v4-in-v4 */
0107     if (!tnl || tnl->family != AF_INET)
0108         return XDP_PASS;
0109
0110     /* The vip key is found.  Add an IP header and send it out */
0111
0112     if (bpf_xdp_adjust_head(xdp, 0 - (int)sizeof(struct iphdr)))
0113         return XDP_DROP;
0114
0115     data = (void *)(long)xdp->data;
0116     data_end = (void *)(long)xdp->data_end;
0117
0118     new_eth = data;
0119     iph = data + sizeof(*new_eth);
0120     old_eth = data + sizeof(*iph);
0121
0122     if (new_eth + 1 > data_end ||
0123         old_eth + 1 > data_end ||
0124         iph + 1 > data_end)
0125         return XDP_DROP;
0126
0127     set_ethhdr(new_eth, old_eth, tnl, htons(ETH_P_IP));
0128
0129     iph->version = 4;
0130     iph->ihl = sizeof(*iph) >> 2;
0131     iph->frag_off = 0;
0132     iph->protocol = IPPROTO_IPIP;
0133     iph->check = 0;
0134     iph->tos = 0;
0135     iph->tot_len = htons(payload_len + sizeof(*iph));
0136     iph->daddr = tnl->daddr.v4;
0137     iph->saddr = tnl->saddr.v4;
0138     iph->ttl = 8;
0139
0140     next_iph_u16 = (u16 *)iph;
0141 #pragma clang loop unroll(full)
0142     for (i = 0; i < sizeof(*iph) >> 1; i++)
0143         csum += *next_iph_u16++;
0144
0145     iph->check = ~((csum & 0xffff) + (csum >> 16));
0146
0147     count_tx(vip.protocol);
0148
0149     return XDP_TX;
0150 }
0151
0152 static __always_inline int handle_ipv6(struct xdp_md *xdp)
0153 {
0154     void *data_end = (void *)(long)xdp->data_end;
0155     void *data = (void *)(long)xdp->data;
0156     struct iptnl_info *tnl;
0157     struct ethhdr *new_eth;
0158     struct ethhdr *old_eth;
0159     struct ipv6hdr *ip6h = data + sizeof(struct ethhdr);
0160     __u16 payload_len;
0161     struct vip vip = {};
0162     int dport;
0163
0164     if (ip6h + 1 > data_end)
0165         return XDP_DROP;
0166
0167     dport = get_dport(ip6h + 1, data_end, ip6h->nexthdr);
0168     if (dport == -1)
0169         return XDP_DROP;
0170
0171     vip.protocol = ip6h->nexthdr;
0172     vip.family = AF_INET6;
0173     memcpy(vip.daddr.v6, ip6h->daddr.s6_addr32, sizeof(vip.daddr));
0174     vip.dport = dport;
0175     payload_len = ip6h->payload_len;
0176
0177     tnl = bpf_map_lookup_elem(&vip2tnl, &vip);
0178     /* It only does v6-in-v6 */
0179     if (!tnl || tnl->family != AF_INET6)
0180         return XDP_PASS;
0181
0182     /* The vip key is found.  Add an IP header and send it out */
0183
0184     if (bpf_xdp_adjust_head(xdp, 0 - (int)sizeof(struct ipv6hdr)))
0185         return XDP_DROP;
0186
0187     data = (void *)(long)xdp->data;
0188     data_end = (void *)(long)xdp->data_end;
0189
0190     new_eth = data;
0191     ip6h = data + sizeof(*new_eth);
0192     old_eth = data + sizeof(*ip6h);
0193
0194     if (new_eth + 1 > data_end ||
0195         old_eth + 1 > data_end ||
0196         ip6h + 1 > data_end)
0197         return XDP_DROP;
0198
0199     set_ethhdr(new_eth, old_eth, tnl, htons(ETH_P_IPV6));
0200
0201     ip6h->version = 6;
0202     ip6h->priority = 0;
0203     memset(ip6h->flow_lbl, 0, sizeof(ip6h->flow_lbl));
0204     ip6h->payload_len = htons(ntohs(payload_len) + sizeof(*ip6h));
0205     ip6h->nexthdr = IPPROTO_IPV6;
0206     ip6h->hop_limit = 8;
0207     memcpy(ip6h->saddr.s6_addr32, tnl->saddr.v6, sizeof(tnl->saddr.v6));
0208     memcpy(ip6h->daddr.s6_addr32, tnl->daddr.v6, sizeof(tnl->daddr.v6));
0209
0210     count_tx(vip.protocol);
0211
0212     return XDP_TX;
0213 }
0214
0215 SEC("xdp.frags")
0216 int _xdp_tx_iptunnel(struct xdp_md *xdp)
0217 {
0218     void *data_end = (void *)(long)xdp->data_end;
0219     void *data = (void *)(long)xdp->data;
0220     struct ethhdr *eth = data;
0221     __u16 h_proto;
0222
0223     if (eth + 1 > data_end)
0224         return XDP_DROP;
0225
0226     h_proto = eth->h_proto;
0227
0228     if (h_proto == htons(ETH_P_IP))
0229         return handle_ipv4(xdp);
0230     else if (h_proto == htons(ETH_P_IPV6))
0231
0232         return handle_ipv6(xdp);
0233     else
0234         return XDP_PASS;
0235 }
0236
0237 char _license[] SEC("license") = "GPL";