bpf/progs/twfw.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /* Copyright (c) 2021 Facebook */
0003 #include <linux/types.h>
0004 #include <bpf/bpf_helpers.h>
0005 #include <linux/bpf.h>
0006 #include <stdint.h>
0007
0008 #define TWFW_MAX_TIERS (64)
0009 /*
0010  * load is successful
0011  * #define TWFW_MAX_TIERS (64u)$
0012  */
0013
0014 struct twfw_tier_value {
0015     unsigned long mask[1];
0016 };
0017
0018 struct rule {
0019     uint8_t seqnum;
0020 };
0021
0022 struct rules_map {
0023     __uint(type, BPF_MAP_TYPE_ARRAY);
0024     __type(key, __u32);
0025     __type(value, struct rule);
0026     __uint(max_entries, 1);
0027 };
0028
0029 struct tiers_map {
0030     __uint(type, BPF_MAP_TYPE_ARRAY);
0031     __type(key, __u32);
0032     __type(value, struct twfw_tier_value);
0033     __uint(max_entries, 1);
0034 };
0035
0036 struct rules_map rules SEC(".maps");
0037 struct tiers_map tiers SEC(".maps");
0038
0039 SEC("cgroup_skb/ingress")
0040 int twfw_verifier(struct __sk_buff* skb)
0041 {
0042     const uint32_t key = 0;
0043     const struct twfw_tier_value* tier = bpf_map_lookup_elem(&tiers, &key);
0044     if (!tier)
0045         return 1;
0046
0047     struct rule* rule = bpf_map_lookup_elem(&rules, &key);
0048     if (!rule)
0049         return 1;
0050
0051     if (rule && rule->seqnum < TWFW_MAX_TIERS) {
0052         /* rule->seqnum / 64 should always be 0 */
0053         unsigned long mask = tier->mask[rule->seqnum / 64];
0054         if (mask)
0055             return 0;
0056     }
0057     return 1;
0058 }