xdp_fwd_kern.c 4.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158
  1. // SPDX-License-Identifier: GPL-2.0
  2. /* Copyright (c) 2017-18 David Ahern <dsahern@gmail.com>
  3. *
  4. * This program is free software; you can redistribute it and/or
  5. * modify it under the terms of version 2 of the GNU General Public
  6. * License as published by the Free Software Foundation.
  7. *
  8. * This program is distributed in the hope that it will be useful, but
  9. * WITHOUT ANY WARRANTY; without even the implied warranty of
  10. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  11. * General Public License for more details.
  12. */
  13. #define KBUILD_MODNAME "foo"
  14. #include <uapi/linux/bpf.h>
  15. #include <linux/in.h>
  16. #include <linux/if_ether.h>
  17. #include <linux/if_packet.h>
  18. #include <linux/if_vlan.h>
  19. #include <linux/ip.h>
  20. #include <linux/ipv6.h>
  21. #include <bpf/bpf_helpers.h>
  22. #define IPV6_FLOWINFO_MASK cpu_to_be32(0x0FFFFFFF)
  23. struct {
  24. __uint(type, BPF_MAP_TYPE_DEVMAP);
  25. __uint(key_size, sizeof(int));
  26. __uint(value_size, sizeof(int));
  27. __uint(max_entries, 64);
  28. } xdp_tx_ports SEC(".maps");
  29. /* from include/net/ip.h */
  30. static __always_inline int ip_decrease_ttl(struct iphdr *iph)
  31. {
  32. u32 check = (__force u32)iph->check;
  33. check += (__force u32)htons(0x0100);
  34. iph->check = (__force __sum16)(check + (check >= 0xFFFF));
  35. return --iph->ttl;
  36. }
  37. static __always_inline int xdp_fwd_flags(struct xdp_md *ctx, u32 flags)
  38. {
  39. void *data_end = (void *)(long)ctx->data_end;
  40. void *data = (void *)(long)ctx->data;
  41. struct bpf_fib_lookup fib_params;
  42. struct ethhdr *eth = data;
  43. struct ipv6hdr *ip6h;
  44. struct iphdr *iph;
  45. u16 h_proto;
  46. u64 nh_off;
  47. int rc;
  48. nh_off = sizeof(*eth);
  49. if (data + nh_off > data_end)
  50. return XDP_DROP;
  51. __builtin_memset(&fib_params, 0, sizeof(fib_params));
  52. h_proto = eth->h_proto;
  53. if (h_proto == htons(ETH_P_IP)) {
  54. iph = data + nh_off;
  55. if (iph + 1 > data_end)
  56. return XDP_DROP;
  57. if (iph->ttl <= 1)
  58. return XDP_PASS;
  59. fib_params.family = AF_INET;
  60. fib_params.tos = iph->tos;
  61. fib_params.l4_protocol = iph->protocol;
  62. fib_params.sport = 0;
  63. fib_params.dport = 0;
  64. fib_params.tot_len = ntohs(iph->tot_len);
  65. fib_params.ipv4_src = iph->saddr;
  66. fib_params.ipv4_dst = iph->daddr;
  67. } else if (h_proto == htons(ETH_P_IPV6)) {
  68. struct in6_addr *src = (struct in6_addr *) fib_params.ipv6_src;
  69. struct in6_addr *dst = (struct in6_addr *) fib_params.ipv6_dst;
  70. ip6h = data + nh_off;
  71. if (ip6h + 1 > data_end)
  72. return XDP_DROP;
  73. if (ip6h->hop_limit <= 1)
  74. return XDP_PASS;
  75. fib_params.family = AF_INET6;
  76. fib_params.flowinfo = *(__be32 *)ip6h & IPV6_FLOWINFO_MASK;
  77. fib_params.l4_protocol = ip6h->nexthdr;
  78. fib_params.sport = 0;
  79. fib_params.dport = 0;
  80. fib_params.tot_len = ntohs(ip6h->payload_len);
  81. *src = ip6h->saddr;
  82. *dst = ip6h->daddr;
  83. } else {
  84. return XDP_PASS;
  85. }
  86. fib_params.ifindex = ctx->ingress_ifindex;
  87. rc = bpf_fib_lookup(ctx, &fib_params, sizeof(fib_params), flags);
  88. /*
  89. * Some rc (return codes) from bpf_fib_lookup() are important,
  90. * to understand how this XDP-prog interacts with network stack.
  91. *
  92. * BPF_FIB_LKUP_RET_NO_NEIGH:
  93. * Even if route lookup was a success, then the MAC-addresses are also
  94. * needed. This is obtained from arp/neighbour table, but if table is
  95. * (still) empty then BPF_FIB_LKUP_RET_NO_NEIGH is returned. To avoid
  96. * doing ARP lookup directly from XDP, then send packet to normal
  97. * network stack via XDP_PASS and expect it will do ARP resolution.
  98. *
  99. * BPF_FIB_LKUP_RET_FWD_DISABLED:
  100. * The bpf_fib_lookup respect sysctl net.ipv{4,6}.conf.all.forwarding
  101. * setting, and will return BPF_FIB_LKUP_RET_FWD_DISABLED if not
  102. * enabled this on ingress device.
  103. */
  104. if (rc == BPF_FIB_LKUP_RET_SUCCESS) {
  105. /* Verify egress index has been configured as TX-port.
  106. * (Note: User can still have inserted an egress ifindex that
  107. * doesn't support XDP xmit, which will result in packet drops).
  108. *
  109. * Note: lookup in devmap supported since 0cdbb4b09a0.
  110. * If not supported will fail with:
  111. * cannot pass map_type 14 into func bpf_map_lookup_elem#1:
  112. */
  113. if (!bpf_map_lookup_elem(&xdp_tx_ports, &fib_params.ifindex))
  114. return XDP_PASS;
  115. if (h_proto == htons(ETH_P_IP))
  116. ip_decrease_ttl(iph);
  117. else if (h_proto == htons(ETH_P_IPV6))
  118. ip6h->hop_limit--;
  119. memcpy(eth->h_dest, fib_params.dmac, ETH_ALEN);
  120. memcpy(eth->h_source, fib_params.smac, ETH_ALEN);
  121. return bpf_redirect_map(&xdp_tx_ports, fib_params.ifindex, 0);
  122. }
  123. return XDP_PASS;
  124. }
  125. SEC("xdp_fwd")
  126. int xdp_fwd_prog(struct xdp_md *ctx)
  127. {
  128. return xdp_fwd_flags(ctx, 0);
  129. }
  130. SEC("xdp_fwd_direct")
  131. int xdp_fwd_direct_prog(struct xdp_md *ctx)
  132. {
  133. return xdp_fwd_flags(ctx, BPF_FIB_LOOKUP_DIRECT);
  134. }
  135. char _license[] SEC("license") = "GPL";