xdp_tx_iptunnel_kern.c 5.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237
  1. /* Copyright (c) 2016 Facebook
  2. *
  3. * This program is free software; you can redistribute it and/or
  4. * modify it under the terms of version 2 of the GNU General Public
  5. * License as published by the Free Software Foundation.
  6. *
  7. * This program shows how to use bpf_xdp_adjust_head() by
  8. * encapsulating the incoming packet in an IPv4/v6 header
  9. * and then XDP_TX it out.
  10. */
  11. #define KBUILD_MODNAME "foo"
  12. #include <uapi/linux/bpf.h>
  13. #include <linux/in.h>
  14. #include <linux/if_ether.h>
  15. #include <linux/if_packet.h>
  16. #include <linux/if_vlan.h>
  17. #include <linux/ip.h>
  18. #include <linux/ipv6.h>
  19. #include <bpf/bpf_helpers.h>
  20. #include "xdp_tx_iptunnel_common.h"
  21. struct {
  22. __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
  23. __type(key, __u32);
  24. __type(value, __u64);
  25. __uint(max_entries, 256);
  26. } rxcnt SEC(".maps");
  27. struct {
  28. __uint(type, BPF_MAP_TYPE_HASH);
  29. __type(key, struct vip);
  30. __type(value, struct iptnl_info);
  31. __uint(max_entries, MAX_IPTNL_ENTRIES);
  32. } vip2tnl SEC(".maps");
  33. static __always_inline void count_tx(u32 protocol)
  34. {
  35. u64 *rxcnt_count;
  36. rxcnt_count = bpf_map_lookup_elem(&rxcnt, &protocol);
  37. if (rxcnt_count)
  38. *rxcnt_count += 1;
  39. }
  40. static __always_inline int get_dport(void *trans_data, void *data_end,
  41. u8 protocol)
  42. {
  43. struct tcphdr *th;
  44. struct udphdr *uh;
  45. switch (protocol) {
  46. case IPPROTO_TCP:
  47. th = (struct tcphdr *)trans_data;
  48. if (th + 1 > data_end)
  49. return -1;
  50. return th->dest;
  51. case IPPROTO_UDP:
  52. uh = (struct udphdr *)trans_data;
  53. if (uh + 1 > data_end)
  54. return -1;
  55. return uh->dest;
  56. default:
  57. return 0;
  58. }
  59. }
  60. static __always_inline void set_ethhdr(struct ethhdr *new_eth,
  61. const struct ethhdr *old_eth,
  62. const struct iptnl_info *tnl,
  63. __be16 h_proto)
  64. {
  65. memcpy(new_eth->h_source, old_eth->h_dest, sizeof(new_eth->h_source));
  66. memcpy(new_eth->h_dest, tnl->dmac, sizeof(new_eth->h_dest));
  67. new_eth->h_proto = h_proto;
  68. }
  69. static __always_inline int handle_ipv4(struct xdp_md *xdp)
  70. {
  71. void *data_end = (void *)(long)xdp->data_end;
  72. void *data = (void *)(long)xdp->data;
  73. struct iptnl_info *tnl;
  74. struct ethhdr *new_eth;
  75. struct ethhdr *old_eth;
  76. struct iphdr *iph = data + sizeof(struct ethhdr);
  77. u16 *next_iph_u16;
  78. u16 payload_len;
  79. struct vip vip = {};
  80. int dport;
  81. u32 csum = 0;
  82. int i;
  83. if (iph + 1 > data_end)
  84. return XDP_DROP;
  85. dport = get_dport(iph + 1, data_end, iph->protocol);
  86. if (dport == -1)
  87. return XDP_DROP;
  88. vip.protocol = iph->protocol;
  89. vip.family = AF_INET;
  90. vip.daddr.v4 = iph->daddr;
  91. vip.dport = dport;
  92. payload_len = ntohs(iph->tot_len);
  93. tnl = bpf_map_lookup_elem(&vip2tnl, &vip);
  94. /* It only does v4-in-v4 */
  95. if (!tnl || tnl->family != AF_INET)
  96. return XDP_PASS;
  97. /* The vip key is found. Add an IP header and send it out */
  98. if (bpf_xdp_adjust_head(xdp, 0 - (int)sizeof(struct iphdr)))
  99. return XDP_DROP;
  100. data = (void *)(long)xdp->data;
  101. data_end = (void *)(long)xdp->data_end;
  102. new_eth = data;
  103. iph = data + sizeof(*new_eth);
  104. old_eth = data + sizeof(*iph);
  105. if (new_eth + 1 > data_end ||
  106. old_eth + 1 > data_end ||
  107. iph + 1 > data_end)
  108. return XDP_DROP;
  109. set_ethhdr(new_eth, old_eth, tnl, htons(ETH_P_IP));
  110. iph->version = 4;
  111. iph->ihl = sizeof(*iph) >> 2;
  112. iph->frag_off = 0;
  113. iph->protocol = IPPROTO_IPIP;
  114. iph->check = 0;
  115. iph->tos = 0;
  116. iph->tot_len = htons(payload_len + sizeof(*iph));
  117. iph->daddr = tnl->daddr.v4;
  118. iph->saddr = tnl->saddr.v4;
  119. iph->ttl = 8;
  120. next_iph_u16 = (u16 *)iph;
  121. #pragma clang loop unroll(full)
  122. for (i = 0; i < sizeof(*iph) >> 1; i++)
  123. csum += *next_iph_u16++;
  124. iph->check = ~((csum & 0xffff) + (csum >> 16));
  125. count_tx(vip.protocol);
  126. return XDP_TX;
  127. }
  128. static __always_inline int handle_ipv6(struct xdp_md *xdp)
  129. {
  130. void *data_end = (void *)(long)xdp->data_end;
  131. void *data = (void *)(long)xdp->data;
  132. struct iptnl_info *tnl;
  133. struct ethhdr *new_eth;
  134. struct ethhdr *old_eth;
  135. struct ipv6hdr *ip6h = data + sizeof(struct ethhdr);
  136. __u16 payload_len;
  137. struct vip vip = {};
  138. int dport;
  139. if (ip6h + 1 > data_end)
  140. return XDP_DROP;
  141. dport = get_dport(ip6h + 1, data_end, ip6h->nexthdr);
  142. if (dport == -1)
  143. return XDP_DROP;
  144. vip.protocol = ip6h->nexthdr;
  145. vip.family = AF_INET6;
  146. memcpy(vip.daddr.v6, ip6h->daddr.s6_addr32, sizeof(vip.daddr));
  147. vip.dport = dport;
  148. payload_len = ip6h->payload_len;
  149. tnl = bpf_map_lookup_elem(&vip2tnl, &vip);
  150. /* It only does v6-in-v6 */
  151. if (!tnl || tnl->family != AF_INET6)
  152. return XDP_PASS;
  153. /* The vip key is found. Add an IP header and send it out */
  154. if (bpf_xdp_adjust_head(xdp, 0 - (int)sizeof(struct ipv6hdr)))
  155. return XDP_DROP;
  156. data = (void *)(long)xdp->data;
  157. data_end = (void *)(long)xdp->data_end;
  158. new_eth = data;
  159. ip6h = data + sizeof(*new_eth);
  160. old_eth = data + sizeof(*ip6h);
  161. if (new_eth + 1 > data_end ||
  162. old_eth + 1 > data_end ||
  163. ip6h + 1 > data_end)
  164. return XDP_DROP;
  165. set_ethhdr(new_eth, old_eth, tnl, htons(ETH_P_IPV6));
  166. ip6h->version = 6;
  167. ip6h->priority = 0;
  168. memset(ip6h->flow_lbl, 0, sizeof(ip6h->flow_lbl));
  169. ip6h->payload_len = htons(ntohs(payload_len) + sizeof(*ip6h));
  170. ip6h->nexthdr = IPPROTO_IPV6;
  171. ip6h->hop_limit = 8;
  172. memcpy(ip6h->saddr.s6_addr32, tnl->saddr.v6, sizeof(tnl->saddr.v6));
  173. memcpy(ip6h->daddr.s6_addr32, tnl->daddr.v6, sizeof(tnl->daddr.v6));
  174. count_tx(vip.protocol);
  175. return XDP_TX;
  176. }
  177. SEC("xdp_tx_iptunnel")
  178. int _xdp_tx_iptunnel(struct xdp_md *xdp)
  179. {
  180. void *data_end = (void *)(long)xdp->data_end;
  181. void *data = (void *)(long)xdp->data;
  182. struct ethhdr *eth = data;
  183. __u16 h_proto;
  184. if (eth + 1 > data_end)
  185. return XDP_DROP;
  186. h_proto = eth->h_proto;
  187. if (h_proto == htons(ETH_P_IP))
  188. return handle_ipv4(xdp);
  189. else if (h_proto == htons(ETH_P_IPV6))
  190. return handle_ipv6(xdp);
  191. else
  192. return XDP_PASS;
  193. }
  194. char _license[] SEC("license") = "GPL";