sockex2_kern.c 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223
  1. #include <uapi/linux/bpf.h>
  2. #include <uapi/linux/in.h>
  3. #include <uapi/linux/if.h>
  4. #include <uapi/linux/if_ether.h>
  5. #include <uapi/linux/ip.h>
  6. #include <uapi/linux/ipv6.h>
  7. #include <uapi/linux/if_tunnel.h>
  8. #include <bpf/bpf_helpers.h>
  9. #include "bpf_legacy.h"
  10. #define IP_MF 0x2000
  11. #define IP_OFFSET 0x1FFF
  12. struct vlan_hdr {
  13. __be16 h_vlan_TCI;
  14. __be16 h_vlan_encapsulated_proto;
  15. };
  16. struct flow_key_record {
  17. __be32 src;
  18. __be32 dst;
  19. union {
  20. __be32 ports;
  21. __be16 port16[2];
  22. };
  23. __u16 thoff;
  24. __u8 ip_proto;
  25. };
  26. static inline int proto_ports_offset(__u64 proto)
  27. {
  28. switch (proto) {
  29. case IPPROTO_TCP:
  30. case IPPROTO_UDP:
  31. case IPPROTO_DCCP:
  32. case IPPROTO_ESP:
  33. case IPPROTO_SCTP:
  34. case IPPROTO_UDPLITE:
  35. return 0;
  36. case IPPROTO_AH:
  37. return 4;
  38. default:
  39. return 0;
  40. }
  41. }
  42. static inline int ip_is_fragment(struct __sk_buff *ctx, __u64 nhoff)
  43. {
  44. return load_half(ctx, nhoff + offsetof(struct iphdr, frag_off))
  45. & (IP_MF | IP_OFFSET);
  46. }
  47. static inline __u32 ipv6_addr_hash(struct __sk_buff *ctx, __u64 off)
  48. {
  49. __u64 w0 = load_word(ctx, off);
  50. __u64 w1 = load_word(ctx, off + 4);
  51. __u64 w2 = load_word(ctx, off + 8);
  52. __u64 w3 = load_word(ctx, off + 12);
  53. return (__u32)(w0 ^ w1 ^ w2 ^ w3);
  54. }
  55. static inline __u64 parse_ip(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
  56. struct flow_key_record *flow)
  57. {
  58. __u64 verlen;
  59. if (unlikely(ip_is_fragment(skb, nhoff)))
  60. *ip_proto = 0;
  61. else
  62. *ip_proto = load_byte(skb, nhoff + offsetof(struct iphdr, protocol));
  63. if (*ip_proto != IPPROTO_GRE) {
  64. flow->src = load_word(skb, nhoff + offsetof(struct iphdr, saddr));
  65. flow->dst = load_word(skb, nhoff + offsetof(struct iphdr, daddr));
  66. }
  67. verlen = load_byte(skb, nhoff + 0/*offsetof(struct iphdr, ihl)*/);
  68. if (likely(verlen == 0x45))
  69. nhoff += 20;
  70. else
  71. nhoff += (verlen & 0xF) << 2;
  72. return nhoff;
  73. }
  74. static inline __u64 parse_ipv6(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
  75. struct flow_key_record *flow)
  76. {
  77. *ip_proto = load_byte(skb,
  78. nhoff + offsetof(struct ipv6hdr, nexthdr));
  79. flow->src = ipv6_addr_hash(skb,
  80. nhoff + offsetof(struct ipv6hdr, saddr));
  81. flow->dst = ipv6_addr_hash(skb,
  82. nhoff + offsetof(struct ipv6hdr, daddr));
  83. nhoff += sizeof(struct ipv6hdr);
  84. return nhoff;
  85. }
  86. static inline bool flow_dissector(struct __sk_buff *skb,
  87. struct flow_key_record *flow)
  88. {
  89. __u64 nhoff = ETH_HLEN;
  90. __u64 ip_proto;
  91. __u64 proto = load_half(skb, 12);
  92. int poff;
  93. if (proto == ETH_P_8021AD) {
  94. proto = load_half(skb, nhoff + offsetof(struct vlan_hdr,
  95. h_vlan_encapsulated_proto));
  96. nhoff += sizeof(struct vlan_hdr);
  97. }
  98. if (proto == ETH_P_8021Q) {
  99. proto = load_half(skb, nhoff + offsetof(struct vlan_hdr,
  100. h_vlan_encapsulated_proto));
  101. nhoff += sizeof(struct vlan_hdr);
  102. }
  103. if (likely(proto == ETH_P_IP))
  104. nhoff = parse_ip(skb, nhoff, &ip_proto, flow);
  105. else if (proto == ETH_P_IPV6)
  106. nhoff = parse_ipv6(skb, nhoff, &ip_proto, flow);
  107. else
  108. return false;
  109. switch (ip_proto) {
  110. case IPPROTO_GRE: {
  111. struct gre_hdr {
  112. __be16 flags;
  113. __be16 proto;
  114. };
  115. __u64 gre_flags = load_half(skb,
  116. nhoff + offsetof(struct gre_hdr, flags));
  117. __u64 gre_proto = load_half(skb,
  118. nhoff + offsetof(struct gre_hdr, proto));
  119. if (gre_flags & (GRE_VERSION|GRE_ROUTING))
  120. break;
  121. proto = gre_proto;
  122. nhoff += 4;
  123. if (gre_flags & GRE_CSUM)
  124. nhoff += 4;
  125. if (gre_flags & GRE_KEY)
  126. nhoff += 4;
  127. if (gre_flags & GRE_SEQ)
  128. nhoff += 4;
  129. if (proto == ETH_P_8021Q) {
  130. proto = load_half(skb,
  131. nhoff + offsetof(struct vlan_hdr,
  132. h_vlan_encapsulated_proto));
  133. nhoff += sizeof(struct vlan_hdr);
  134. }
  135. if (proto == ETH_P_IP)
  136. nhoff = parse_ip(skb, nhoff, &ip_proto, flow);
  137. else if (proto == ETH_P_IPV6)
  138. nhoff = parse_ipv6(skb, nhoff, &ip_proto, flow);
  139. else
  140. return false;
  141. break;
  142. }
  143. case IPPROTO_IPIP:
  144. nhoff = parse_ip(skb, nhoff, &ip_proto, flow);
  145. break;
  146. case IPPROTO_IPV6:
  147. nhoff = parse_ipv6(skb, nhoff, &ip_proto, flow);
  148. break;
  149. default:
  150. break;
  151. }
  152. flow->ip_proto = ip_proto;
  153. poff = proto_ports_offset(ip_proto);
  154. if (poff >= 0) {
  155. nhoff += poff;
  156. flow->ports = load_word(skb, nhoff);
  157. }
  158. flow->thoff = (__u16) nhoff;
  159. return true;
  160. }
  161. struct pair {
  162. long packets;
  163. long bytes;
  164. };
  165. struct {
  166. __uint(type, BPF_MAP_TYPE_HASH);
  167. __type(key, __be32);
  168. __type(value, struct pair);
  169. __uint(max_entries, 1024);
  170. } hash_map SEC(".maps");
  171. SEC("socket2")
  172. int bpf_prog2(struct __sk_buff *skb)
  173. {
  174. struct flow_key_record flow = {};
  175. struct pair *value;
  176. u32 key;
  177. if (!flow_dissector(skb, &flow))
  178. return 0;
  179. key = flow.dst;
  180. value = bpf_map_lookup_elem(&hash_map, &key);
  181. if (value) {
  182. __sync_fetch_and_add(&value->packets, 1);
  183. __sync_fetch_and_add(&value->bytes, skb->len);
  184. } else {
  185. struct pair val = {1, skb->len};
  186. bpf_map_update_elem(&hash_map, &key, &val, BPF_ANY);
  187. }
  188. return 0;
  189. }
  190. char _license[] SEC("license") = "GPL";