bpf/progs/connect6_prog.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 // Copyright (c) 2018 Facebook
0003
0004 #include <string.h>
0005
0006 #include <linux/stddef.h>
0007 #include <linux/bpf.h>
0008 #include <linux/in.h>
0009 #include <linux/in6.h>
0010 #include <sys/socket.h>
0011
0012 #include <bpf/bpf_helpers.h>
0013 #include <bpf/bpf_endian.h>
0014
0015 #define SRC_REWRITE_IP6_0   0
0016 #define SRC_REWRITE_IP6_1   0
0017 #define SRC_REWRITE_IP6_2   0
0018 #define SRC_REWRITE_IP6_3   6
0019
0020 #define DST_REWRITE_IP6_0   0
0021 #define DST_REWRITE_IP6_1   0
0022 #define DST_REWRITE_IP6_2   0
0023 #define DST_REWRITE_IP6_3   1
0024
0025 #define DST_REWRITE_PORT6   6666
0026
0027 SEC("cgroup/connect6")
0028 int connect_v6_prog(struct bpf_sock_addr *ctx)
0029 {
0030     struct bpf_sock_tuple tuple = {};
0031     struct sockaddr_in6 sa;
0032     struct bpf_sock *sk;
0033
0034     /* Verify that new destination is available. */
0035     memset(&tuple.ipv6.saddr, 0, sizeof(tuple.ipv6.saddr));
0036     memset(&tuple.ipv6.sport, 0, sizeof(tuple.ipv6.sport));
0037
0038     tuple.ipv6.daddr[0] = bpf_htonl(DST_REWRITE_IP6_0);
0039     tuple.ipv6.daddr[1] = bpf_htonl(DST_REWRITE_IP6_1);
0040     tuple.ipv6.daddr[2] = bpf_htonl(DST_REWRITE_IP6_2);
0041     tuple.ipv6.daddr[3] = bpf_htonl(DST_REWRITE_IP6_3);
0042
0043     tuple.ipv6.dport = bpf_htons(DST_REWRITE_PORT6);
0044
0045     if (ctx->type != SOCK_STREAM && ctx->type != SOCK_DGRAM)
0046         return 0;
0047     else if (ctx->type == SOCK_STREAM)
0048         sk = bpf_sk_lookup_tcp(ctx, &tuple, sizeof(tuple.ipv6),
0049                        BPF_F_CURRENT_NETNS, 0);
0050     else
0051         sk = bpf_sk_lookup_udp(ctx, &tuple, sizeof(tuple.ipv6),
0052                        BPF_F_CURRENT_NETNS, 0);
0053
0054     if (!sk)
0055         return 0;
0056
0057     if (sk->src_ip6[0] != tuple.ipv6.daddr[0] ||
0058         sk->src_ip6[1] != tuple.ipv6.daddr[1] ||
0059         sk->src_ip6[2] != tuple.ipv6.daddr[2] ||
0060         sk->src_ip6[3] != tuple.ipv6.daddr[3] ||
0061         sk->src_port != DST_REWRITE_PORT6) {
0062         bpf_sk_release(sk);
0063         return 0;
0064     }
0065
0066     bpf_sk_release(sk);
0067
0068     /* Rewrite destination. */
0069     ctx->user_ip6[0] = bpf_htonl(DST_REWRITE_IP6_0);
0070     ctx->user_ip6[1] = bpf_htonl(DST_REWRITE_IP6_1);
0071     ctx->user_ip6[2] = bpf_htonl(DST_REWRITE_IP6_2);
0072     ctx->user_ip6[3] = bpf_htonl(DST_REWRITE_IP6_3);
0073
0074     ctx->user_port = bpf_htons(DST_REWRITE_PORT6);
0075
0076     /* Rewrite source. */
0077     memset(&sa, 0, sizeof(sa));
0078
0079     sa.sin6_family = AF_INET6;
0080     sa.sin6_port = bpf_htons(0);
0081
0082     sa.sin6_addr.s6_addr32[0] = bpf_htonl(SRC_REWRITE_IP6_0);
0083     sa.sin6_addr.s6_addr32[1] = bpf_htonl(SRC_REWRITE_IP6_1);
0084     sa.sin6_addr.s6_addr32[2] = bpf_htonl(SRC_REWRITE_IP6_2);
0085     sa.sin6_addr.s6_addr32[3] = bpf_htonl(SRC_REWRITE_IP6_3);
0086
0087     if (bpf_bind(ctx, (struct sockaddr *)&sa, sizeof(sa)) != 0)
0088         return 0;
0089
0090     return 1;
0091 }
0092
0093 char _license[] SEC("license") = "GPL";