test_lwt_bpf.c 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253
  1. /* Copyright (c) 2016 Thomas Graf <tgraf@tgraf.ch>
  2. *
  3. * This program is free software; you can redistribute it and/or
  4. * modify it under the terms of version 2 of the GNU General Public
  5. * License as published by the Free Software Foundation.
  6. *
  7. * This program is distributed in the hope that it will be useful, but
  8. * WITHOUT ANY WARRANTY; without even the implied warranty of
  9. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  10. * General Public License for more details.
  11. */
  12. #include <stdint.h>
  13. #include <stddef.h>
  14. #include <linux/bpf.h>
  15. #include <linux/ip.h>
  16. #include <linux/in.h>
  17. #include <linux/in6.h>
  18. #include <linux/tcp.h>
  19. #include <linux/udp.h>
  20. #include <linux/icmpv6.h>
  21. #include <linux/if_ether.h>
  22. #include <bpf/bpf_helpers.h>
  23. #include <string.h>
  24. # define printk(fmt, ...) \
  25. ({ \
  26. char ____fmt[] = fmt; \
  27. bpf_trace_printk(____fmt, sizeof(____fmt), \
  28. ##__VA_ARGS__); \
  29. })
  30. #define CB_MAGIC 1234
  31. /* Test: Pass all packets through */
  32. SEC("nop")
  33. int do_nop(struct __sk_buff *skb)
  34. {
  35. return BPF_OK;
  36. }
  37. /* Test: Verify context information can be accessed */
  38. SEC("test_ctx")
  39. int do_test_ctx(struct __sk_buff *skb)
  40. {
  41. skb->cb[0] = CB_MAGIC;
  42. printk("len %d hash %d protocol %d\n", skb->len, skb->hash,
  43. skb->protocol);
  44. printk("cb %d ingress_ifindex %d ifindex %d\n", skb->cb[0],
  45. skb->ingress_ifindex, skb->ifindex);
  46. return BPF_OK;
  47. }
  48. /* Test: Ensure skb->cb[] buffer is cleared */
  49. SEC("test_cb")
  50. int do_test_cb(struct __sk_buff *skb)
  51. {
  52. printk("cb0: %x cb1: %x cb2: %x\n", skb->cb[0], skb->cb[1],
  53. skb->cb[2]);
  54. printk("cb3: %x cb4: %x\n", skb->cb[3], skb->cb[4]);
  55. return BPF_OK;
  56. }
  57. /* Test: Verify skb data can be read */
  58. SEC("test_data")
  59. int do_test_data(struct __sk_buff *skb)
  60. {
  61. void *data = (void *)(long)skb->data;
  62. void *data_end = (void *)(long)skb->data_end;
  63. struct iphdr *iph = data;
  64. if (data + sizeof(*iph) > data_end) {
  65. printk("packet truncated\n");
  66. return BPF_DROP;
  67. }
  68. printk("src: %x dst: %x\n", iph->saddr, iph->daddr);
  69. return BPF_OK;
  70. }
  71. #define IP_CSUM_OFF offsetof(struct iphdr, check)
  72. #define IP_DST_OFF offsetof(struct iphdr, daddr)
  73. #define IP_SRC_OFF offsetof(struct iphdr, saddr)
  74. #define IP_PROTO_OFF offsetof(struct iphdr, protocol)
  75. #define TCP_CSUM_OFF offsetof(struct tcphdr, check)
  76. #define UDP_CSUM_OFF offsetof(struct udphdr, check)
  77. #define IS_PSEUDO 0x10
  78. static inline int rewrite(struct __sk_buff *skb, uint32_t old_ip,
  79. uint32_t new_ip, int rw_daddr)
  80. {
  81. int ret, off = 0, flags = IS_PSEUDO;
  82. uint8_t proto;
  83. ret = bpf_skb_load_bytes(skb, IP_PROTO_OFF, &proto, 1);
  84. if (ret < 0) {
  85. printk("bpf_l4_csum_replace failed: %d\n", ret);
  86. return BPF_DROP;
  87. }
  88. switch (proto) {
  89. case IPPROTO_TCP:
  90. off = TCP_CSUM_OFF;
  91. break;
  92. case IPPROTO_UDP:
  93. off = UDP_CSUM_OFF;
  94. flags |= BPF_F_MARK_MANGLED_0;
  95. break;
  96. case IPPROTO_ICMPV6:
  97. off = offsetof(struct icmp6hdr, icmp6_cksum);
  98. break;
  99. }
  100. if (off) {
  101. ret = bpf_l4_csum_replace(skb, off, old_ip, new_ip,
  102. flags | sizeof(new_ip));
  103. if (ret < 0) {
  104. printk("bpf_l4_csum_replace failed: %d\n");
  105. return BPF_DROP;
  106. }
  107. }
  108. ret = bpf_l3_csum_replace(skb, IP_CSUM_OFF, old_ip, new_ip, sizeof(new_ip));
  109. if (ret < 0) {
  110. printk("bpf_l3_csum_replace failed: %d\n", ret);
  111. return BPF_DROP;
  112. }
  113. if (rw_daddr)
  114. ret = bpf_skb_store_bytes(skb, IP_DST_OFF, &new_ip, sizeof(new_ip), 0);
  115. else
  116. ret = bpf_skb_store_bytes(skb, IP_SRC_OFF, &new_ip, sizeof(new_ip), 0);
  117. if (ret < 0) {
  118. printk("bpf_skb_store_bytes() failed: %d\n", ret);
  119. return BPF_DROP;
  120. }
  121. return BPF_OK;
  122. }
  123. /* Test: Verify skb data can be modified */
  124. SEC("test_rewrite")
  125. int do_test_rewrite(struct __sk_buff *skb)
  126. {
  127. uint32_t old_ip, new_ip = 0x3fea8c0;
  128. int ret;
  129. ret = bpf_skb_load_bytes(skb, IP_DST_OFF, &old_ip, 4);
  130. if (ret < 0) {
  131. printk("bpf_skb_load_bytes failed: %d\n", ret);
  132. return BPF_DROP;
  133. }
  134. if (old_ip == 0x2fea8c0) {
  135. printk("out: rewriting from %x to %x\n", old_ip, new_ip);
  136. return rewrite(skb, old_ip, new_ip, 1);
  137. }
  138. return BPF_OK;
  139. }
  140. static inline int __do_push_ll_and_redirect(struct __sk_buff *skb)
  141. {
  142. uint64_t smac = SRC_MAC, dmac = DST_MAC;
  143. int ret, ifindex = DST_IFINDEX;
  144. struct ethhdr ehdr;
  145. ret = bpf_skb_change_head(skb, 14, 0);
  146. if (ret < 0) {
  147. printk("skb_change_head() failed: %d\n", ret);
  148. }
  149. ehdr.h_proto = __constant_htons(ETH_P_IP);
  150. memcpy(&ehdr.h_source, &smac, 6);
  151. memcpy(&ehdr.h_dest, &dmac, 6);
  152. ret = bpf_skb_store_bytes(skb, 0, &ehdr, sizeof(ehdr), 0);
  153. if (ret < 0) {
  154. printk("skb_store_bytes() failed: %d\n", ret);
  155. return BPF_DROP;
  156. }
  157. return bpf_redirect(ifindex, 0);
  158. }
  159. SEC("push_ll_and_redirect_silent")
  160. int do_push_ll_and_redirect_silent(struct __sk_buff *skb)
  161. {
  162. return __do_push_ll_and_redirect(skb);
  163. }
  164. SEC("push_ll_and_redirect")
  165. int do_push_ll_and_redirect(struct __sk_buff *skb)
  166. {
  167. int ret, ifindex = DST_IFINDEX;
  168. ret = __do_push_ll_and_redirect(skb);
  169. if (ret >= 0)
  170. printk("redirected to %d\n", ifindex);
  171. return ret;
  172. }
  173. static inline void __fill_garbage(struct __sk_buff *skb)
  174. {
  175. uint64_t f = 0xFFFFFFFFFFFFFFFF;
  176. bpf_skb_store_bytes(skb, 0, &f, sizeof(f), 0);
  177. bpf_skb_store_bytes(skb, 8, &f, sizeof(f), 0);
  178. bpf_skb_store_bytes(skb, 16, &f, sizeof(f), 0);
  179. bpf_skb_store_bytes(skb, 24, &f, sizeof(f), 0);
  180. bpf_skb_store_bytes(skb, 32, &f, sizeof(f), 0);
  181. bpf_skb_store_bytes(skb, 40, &f, sizeof(f), 0);
  182. bpf_skb_store_bytes(skb, 48, &f, sizeof(f), 0);
  183. bpf_skb_store_bytes(skb, 56, &f, sizeof(f), 0);
  184. bpf_skb_store_bytes(skb, 64, &f, sizeof(f), 0);
  185. bpf_skb_store_bytes(skb, 72, &f, sizeof(f), 0);
  186. bpf_skb_store_bytes(skb, 80, &f, sizeof(f), 0);
  187. bpf_skb_store_bytes(skb, 88, &f, sizeof(f), 0);
  188. }
  189. SEC("fill_garbage")
  190. int do_fill_garbage(struct __sk_buff *skb)
  191. {
  192. __fill_garbage(skb);
  193. printk("Set initial 96 bytes of header to FF\n");
  194. return BPF_OK;
  195. }
  196. SEC("fill_garbage_and_redirect")
  197. int do_fill_garbage_and_redirect(struct __sk_buff *skb)
  198. {
  199. int ifindex = DST_IFINDEX;
  200. __fill_garbage(skb);
  201. printk("redirected to %d\n", ifindex);
  202. return bpf_redirect(ifindex, 0);
  203. }
  204. /* Drop all packets */
  205. SEC("drop_all")
  206. int do_drop_all(struct __sk_buff *skb)
  207. {
  208. printk("dropping with: %d\n", BPF_DROP);
  209. return BPF_DROP;
  210. }
  211. char _license[] SEC("license") = "GPL";