1 // SPDX-License-Identifier: GPL-2.0
2 #include <limits.h>
3 #include <stddef.h>
4 #include <stdbool.h>
5 #include <string.h>
6 #include <linux/pkt_cls.h>
7 #include <linux/bpf.h>
8 #include <linux/in.h>
9 #include <linux/if_ether.h>
10 #include <linux/icmp.h>
11 #include <linux/ip.h>
12 #include <linux/ipv6.h>
13 #include <linux/tcp.h>
14 #include <linux/udp.h>
15 #include <linux/if_packet.h>
16 #include <sys/socket.h>
17 #include <linux/if_tunnel.h>
18 #include <linux/mpls.h>
19 #include <bpf/bpf_helpers.h>
20 #include <bpf/bpf_endian.h>
21 
22 #define PROG(F) PROG_(F, _##F)
23 #define PROG_(NUM, NAME) SEC("flow_dissector") int flow_dissector_##NUM
24 
25 #define FLOW_CONTINUE_SADDR 0x7f00007f /* 127.0.0.127 */
26 
27 /* These are the identifiers of the BPF programs that will be used in tail
28  * calls. Name is limited to 16 characters, with the terminating character and
29  * bpf_func_ above, we have only 6 to work with, anything after will be cropped.
30  */
31 #define IP		0
32 #define IPV6		1
33 #define IPV6OP		2 /* Destination/Hop-by-Hop Options IPv6 Ext. Header */
34 #define IPV6FR		3 /* Fragmentation IPv6 Extension Header */
35 #define MPLS		4
36 #define VLAN		5
37 #define MAX_PROG	6
38 
39 #define IP_MF		0x2000
40 #define IP_OFFSET	0x1FFF
41 #define IP6_MF		0x0001
42 #define IP6_OFFSET	0xFFF8
43 
44 struct vlan_hdr {
45 	__be16 h_vlan_TCI;
46 	__be16 h_vlan_encapsulated_proto;
47 };
48 
49 struct gre_hdr {
50 	__be16 flags;
51 	__be16 proto;
52 };
53 
54 struct frag_hdr {
55 	__u8 nexthdr;
56 	__u8 reserved;
57 	__be16 frag_off;
58 	__be32 identification;
59 };
60 
61 struct {
62 	__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
63 	__uint(max_entries, MAX_PROG);
64 	__uint(key_size, sizeof(__u32));
65 	__uint(value_size, sizeof(__u32));
66 } jmp_table SEC(".maps");
67 
68 struct {
69 	__uint(type, BPF_MAP_TYPE_HASH);
70 	__uint(max_entries, 1024);
71 	__type(key, __u32);
72 	__type(value, struct bpf_flow_keys);
73 } last_dissection SEC(".maps");
74 
export_flow_keys(struct bpf_flow_keys * keys,int ret)75 static __always_inline int export_flow_keys(struct bpf_flow_keys *keys,
76 					    int ret)
77 {
78 	__u32 key = (__u32)(keys->sport) << 16 | keys->dport;
79 	struct bpf_flow_keys val;
80 
81 	memcpy(&val, keys, sizeof(val));
82 	bpf_map_update_elem(&last_dissection, &key, &val, BPF_ANY);
83 	return ret;
84 }
85 
86 #define IPV6_FLOWLABEL_MASK		__bpf_constant_htonl(0x000FFFFF)
ip6_flowlabel(const struct ipv6hdr * hdr)87 static inline __be32 ip6_flowlabel(const struct ipv6hdr *hdr)
88 {
89 	return *(__be32 *)hdr & IPV6_FLOWLABEL_MASK;
90 }
91 
bpf_flow_dissect_get_header(struct __sk_buff * skb,__u16 hdr_size,void * buffer)92 static __always_inline void *bpf_flow_dissect_get_header(struct __sk_buff *skb,
93 							 __u16 hdr_size,
94 							 void *buffer)
95 {
96 	void *data_end = (void *)(long)skb->data_end;
97 	void *data = (void *)(long)skb->data;
98 	__u16 thoff = skb->flow_keys->thoff;
99 	__u8 *hdr;
100 
101 	/* Verifies this variable offset does not overflow */
102 	if (thoff > (USHRT_MAX - hdr_size))
103 		return NULL;
104 
105 	hdr = data + thoff;
106 	if (hdr + hdr_size <= data_end)
107 		return hdr;
108 
109 	if (bpf_skb_load_bytes(skb, thoff, buffer, hdr_size))
110 		return NULL;
111 
112 	return buffer;
113 }
114 
115 /* Dispatches on ETHERTYPE */
parse_eth_proto(struct __sk_buff * skb,__be16 proto)116 static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
117 {
118 	struct bpf_flow_keys *keys = skb->flow_keys;
119 
120 	switch (proto) {
121 	case bpf_htons(ETH_P_IP):
122 		bpf_tail_call_static(skb, &jmp_table, IP);
123 		break;
124 	case bpf_htons(ETH_P_IPV6):
125 		bpf_tail_call_static(skb, &jmp_table, IPV6);
126 		break;
127 	case bpf_htons(ETH_P_MPLS_MC):
128 	case bpf_htons(ETH_P_MPLS_UC):
129 		bpf_tail_call_static(skb, &jmp_table, MPLS);
130 		break;
131 	case bpf_htons(ETH_P_8021Q):
132 	case bpf_htons(ETH_P_8021AD):
133 		bpf_tail_call_static(skb, &jmp_table, VLAN);
134 		break;
135 	default:
136 		/* Protocol not supported */
137 		return export_flow_keys(keys, BPF_DROP);
138 	}
139 
140 	return export_flow_keys(keys, BPF_DROP);
141 }
142 
143 SEC("flow_dissector")
_dissect(struct __sk_buff * skb)144 int _dissect(struct __sk_buff *skb)
145 {
146 	struct bpf_flow_keys *keys = skb->flow_keys;
147 
148 	if (keys->n_proto == bpf_htons(ETH_P_IP)) {
149 		/* IP traffic from FLOW_CONTINUE_SADDR falls-back to
150 		 * standard dissector
151 		 */
152 		struct iphdr *iph, _iph;
153 
154 		iph = bpf_flow_dissect_get_header(skb, sizeof(*iph), &_iph);
155 		if (iph && iph->ihl == 5 &&
156 		    iph->saddr == bpf_htonl(FLOW_CONTINUE_SADDR)) {
157 			return BPF_FLOW_DISSECTOR_CONTINUE;
158 		}
159 	}
160 
161 	return parse_eth_proto(skb, keys->n_proto);
162 }
163 
164 /* Parses on IPPROTO_* */
parse_ip_proto(struct __sk_buff * skb,__u8 proto)165 static __always_inline int parse_ip_proto(struct __sk_buff *skb, __u8 proto)
166 {
167 	struct bpf_flow_keys *keys = skb->flow_keys;
168 	void *data_end = (void *)(long)skb->data_end;
169 	struct icmphdr *icmp, _icmp;
170 	struct gre_hdr *gre, _gre;
171 	struct ethhdr *eth, _eth;
172 	struct tcphdr *tcp, _tcp;
173 	struct udphdr *udp, _udp;
174 
175 	switch (proto) {
176 	case IPPROTO_ICMP:
177 		icmp = bpf_flow_dissect_get_header(skb, sizeof(*icmp), &_icmp);
178 		if (!icmp)
179 			return export_flow_keys(keys, BPF_DROP);
180 		return export_flow_keys(keys, BPF_OK);
181 	case IPPROTO_IPIP:
182 		keys->is_encap = true;
183 		if (keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP)
184 			return export_flow_keys(keys, BPF_OK);
185 
186 		return parse_eth_proto(skb, bpf_htons(ETH_P_IP));
187 	case IPPROTO_IPV6:
188 		keys->is_encap = true;
189 		if (keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP)
190 			return export_flow_keys(keys, BPF_OK);
191 
192 		return parse_eth_proto(skb, bpf_htons(ETH_P_IPV6));
193 	case IPPROTO_GRE:
194 		gre = bpf_flow_dissect_get_header(skb, sizeof(*gre), &_gre);
195 		if (!gre)
196 			return export_flow_keys(keys, BPF_DROP);
197 
198 		if (bpf_htons(gre->flags & GRE_VERSION))
199 			/* Only inspect standard GRE packets with version 0 */
200 			return export_flow_keys(keys, BPF_OK);
201 
202 		keys->thoff += sizeof(*gre); /* Step over GRE Flags and Proto */
203 		if (GRE_IS_CSUM(gre->flags))
204 			keys->thoff += 4; /* Step over chksum and Padding */
205 		if (GRE_IS_KEY(gre->flags))
206 			keys->thoff += 4; /* Step over key */
207 		if (GRE_IS_SEQ(gre->flags))
208 			keys->thoff += 4; /* Step over sequence number */
209 
210 		keys->is_encap = true;
211 		if (keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP)
212 			return export_flow_keys(keys, BPF_OK);
213 
214 		if (gre->proto == bpf_htons(ETH_P_TEB)) {
215 			eth = bpf_flow_dissect_get_header(skb, sizeof(*eth),
216 							  &_eth);
217 			if (!eth)
218 				return export_flow_keys(keys, BPF_DROP);
219 
220 			keys->thoff += sizeof(*eth);
221 
222 			return parse_eth_proto(skb, eth->h_proto);
223 		} else {
224 			return parse_eth_proto(skb, gre->proto);
225 		}
226 	case IPPROTO_TCP:
227 		tcp = bpf_flow_dissect_get_header(skb, sizeof(*tcp), &_tcp);
228 		if (!tcp)
229 			return export_flow_keys(keys, BPF_DROP);
230 
231 		if (tcp->doff < 5)
232 			return export_flow_keys(keys, BPF_DROP);
233 
234 		if ((__u8 *)tcp + (tcp->doff << 2) > data_end)
235 			return export_flow_keys(keys, BPF_DROP);
236 
237 		keys->sport = tcp->source;
238 		keys->dport = tcp->dest;
239 		return export_flow_keys(keys, BPF_OK);
240 	case IPPROTO_UDP:
241 	case IPPROTO_UDPLITE:
242 		udp = bpf_flow_dissect_get_header(skb, sizeof(*udp), &_udp);
243 		if (!udp)
244 			return export_flow_keys(keys, BPF_DROP);
245 
246 		keys->sport = udp->source;
247 		keys->dport = udp->dest;
248 		return export_flow_keys(keys, BPF_OK);
249 	default:
250 		return export_flow_keys(keys, BPF_DROP);
251 	}
252 
253 	return export_flow_keys(keys, BPF_DROP);
254 }
255 
parse_ipv6_proto(struct __sk_buff * skb,__u8 nexthdr)256 static __always_inline int parse_ipv6_proto(struct __sk_buff *skb, __u8 nexthdr)
257 {
258 	struct bpf_flow_keys *keys = skb->flow_keys;
259 
260 	switch (nexthdr) {
261 	case IPPROTO_HOPOPTS:
262 	case IPPROTO_DSTOPTS:
263 		bpf_tail_call_static(skb, &jmp_table, IPV6OP);
264 		break;
265 	case IPPROTO_FRAGMENT:
266 		bpf_tail_call_static(skb, &jmp_table, IPV6FR);
267 		break;
268 	default:
269 		return parse_ip_proto(skb, nexthdr);
270 	}
271 
272 	return export_flow_keys(keys, BPF_DROP);
273 }
274 
PROG(IP)275 PROG(IP)(struct __sk_buff *skb)
276 {
277 	void *data_end = (void *)(long)skb->data_end;
278 	struct bpf_flow_keys *keys = skb->flow_keys;
279 	void *data = (void *)(long)skb->data;
280 	struct iphdr *iph, _iph;
281 	bool done = false;
282 
283 	iph = bpf_flow_dissect_get_header(skb, sizeof(*iph), &_iph);
284 	if (!iph)
285 		return export_flow_keys(keys, BPF_DROP);
286 
287 	/* IP header cannot be smaller than 20 bytes */
288 	if (iph->ihl < 5)
289 		return export_flow_keys(keys, BPF_DROP);
290 
291 	keys->addr_proto = ETH_P_IP;
292 	keys->ipv4_src = iph->saddr;
293 	keys->ipv4_dst = iph->daddr;
294 	keys->ip_proto = iph->protocol;
295 
296 	keys->thoff += iph->ihl << 2;
297 	if (data + keys->thoff > data_end)
298 		return export_flow_keys(keys, BPF_DROP);
299 
300 	if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET)) {
301 		keys->is_frag = true;
302 		if (iph->frag_off & bpf_htons(IP_OFFSET)) {
303 			/* From second fragment on, packets do not have headers
304 			 * we can parse.
305 			 */
306 			done = true;
307 		} else {
308 			keys->is_first_frag = true;
309 			/* No need to parse fragmented packet unless
310 			 * explicitly asked for.
311 			 */
312 			if (!(keys->flags &
313 			      BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG))
314 				done = true;
315 		}
316 	}
317 
318 	if (done)
319 		return export_flow_keys(keys, BPF_OK);
320 
321 	return parse_ip_proto(skb, iph->protocol);
322 }
323 
PROG(IPV6)324 PROG(IPV6)(struct __sk_buff *skb)
325 {
326 	struct bpf_flow_keys *keys = skb->flow_keys;
327 	struct ipv6hdr *ip6h, _ip6h;
328 
329 	ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
330 	if (!ip6h)
331 		return export_flow_keys(keys, BPF_DROP);
332 
333 	keys->addr_proto = ETH_P_IPV6;
334 	memcpy(&keys->ipv6_src, &ip6h->saddr, 2*sizeof(ip6h->saddr));
335 
336 	keys->thoff += sizeof(struct ipv6hdr);
337 	keys->ip_proto = ip6h->nexthdr;
338 	keys->flow_label = ip6_flowlabel(ip6h);
339 
340 	if (keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL)
341 		return export_flow_keys(keys, BPF_OK);
342 
343 	return parse_ipv6_proto(skb, ip6h->nexthdr);
344 }
345 
PROG(IPV6OP)346 PROG(IPV6OP)(struct __sk_buff *skb)
347 {
348 	struct bpf_flow_keys *keys = skb->flow_keys;
349 	struct ipv6_opt_hdr *ip6h, _ip6h;
350 
351 	ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
352 	if (!ip6h)
353 		return export_flow_keys(keys, BPF_DROP);
354 
355 	/* hlen is in 8-octets and does not include the first 8 bytes
356 	 * of the header
357 	 */
358 	keys->thoff += (1 + ip6h->hdrlen) << 3;
359 	keys->ip_proto = ip6h->nexthdr;
360 
361 	return parse_ipv6_proto(skb, ip6h->nexthdr);
362 }
363 
PROG(IPV6FR)364 PROG(IPV6FR)(struct __sk_buff *skb)
365 {
366 	struct bpf_flow_keys *keys = skb->flow_keys;
367 	struct frag_hdr *fragh, _fragh;
368 
369 	fragh = bpf_flow_dissect_get_header(skb, sizeof(*fragh), &_fragh);
370 	if (!fragh)
371 		return export_flow_keys(keys, BPF_DROP);
372 
373 	keys->thoff += sizeof(*fragh);
374 	keys->is_frag = true;
375 	keys->ip_proto = fragh->nexthdr;
376 
377 	if (!(fragh->frag_off & bpf_htons(IP6_OFFSET))) {
378 		keys->is_first_frag = true;
379 
380 		/* No need to parse fragmented packet unless
381 		 * explicitly asked for.
382 		 */
383 		if (!(keys->flags & BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG))
384 			return export_flow_keys(keys, BPF_OK);
385 	} else {
386 		return export_flow_keys(keys, BPF_OK);
387 	}
388 
389 	return parse_ipv6_proto(skb, fragh->nexthdr);
390 }
391 
PROG(MPLS)392 PROG(MPLS)(struct __sk_buff *skb)
393 {
394 	struct bpf_flow_keys *keys = skb->flow_keys;
395 	struct mpls_label *mpls, _mpls;
396 
397 	mpls = bpf_flow_dissect_get_header(skb, sizeof(*mpls), &_mpls);
398 	if (!mpls)
399 		return export_flow_keys(keys, BPF_DROP);
400 
401 	return export_flow_keys(keys, BPF_OK);
402 }
403 
PROG(VLAN)404 PROG(VLAN)(struct __sk_buff *skb)
405 {
406 	struct bpf_flow_keys *keys = skb->flow_keys;
407 	struct vlan_hdr *vlan, _vlan;
408 
409 	/* Account for double-tagging */
410 	if (keys->n_proto == bpf_htons(ETH_P_8021AD)) {
411 		vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
412 		if (!vlan)
413 			return export_flow_keys(keys, BPF_DROP);
414 
415 		if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q))
416 			return export_flow_keys(keys, BPF_DROP);
417 
418 		keys->nhoff += sizeof(*vlan);
419 		keys->thoff += sizeof(*vlan);
420 	}
421 
422 	vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
423 	if (!vlan)
424 		return export_flow_keys(keys, BPF_DROP);
425 
426 	keys->nhoff += sizeof(*vlan);
427 	keys->thoff += sizeof(*vlan);
428 	/* Only allow 8021AD + 8021Q double tagging and no triple tagging.*/
429 	if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) ||
430 	    vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q))
431 		return export_flow_keys(keys, BPF_DROP);
432 
433 	keys->n_proto = vlan->h_vlan_encapsulated_proto;
434 	return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto);
435 }
436 
437 char __license[] SEC("license") = "GPL";
438