cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

xdp_fwd_kern.c (4652B)

      1// SPDX-License-Identifier: GPL-2.0
      2/* Copyright (c) 2017-18 David Ahern <dsahern@gmail.com>
      3 *
      4 * This program is free software; you can redistribute it and/or
      5 * modify it under the terms of version 2 of the GNU General Public
      6 * License as published by the Free Software Foundation.
      7 *
      8 * This program is distributed in the hope that it will be useful, but
      9 * WITHOUT ANY WARRANTY; without even the implied warranty of
     10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
     11 * General Public License for more details.
     12 */
     13#define KBUILD_MODNAME "foo"
     14#include <uapi/linux/bpf.h>
     15#include <linux/in.h>
     16#include <linux/if_ether.h>
     17#include <linux/if_packet.h>
     18#include <linux/if_vlan.h>
     19#include <linux/ip.h>
     20#include <linux/ipv6.h>
     21
     22#include <bpf/bpf_helpers.h>
     23
     24#define IPV6_FLOWINFO_MASK              cpu_to_be32(0x0FFFFFFF)
     25
     26struct {
     27	__uint(type, BPF_MAP_TYPE_DEVMAP);
     28	__uint(key_size, sizeof(int));
     29	__uint(value_size, sizeof(int));
     30	__uint(max_entries, 64);
     31} xdp_tx_ports SEC(".maps");
     32
     33/* from include/net/ip.h */
     34static __always_inline int ip_decrease_ttl(struct iphdr *iph)
     35{
     36	u32 check = (__force u32)iph->check;
     37
     38	check += (__force u32)htons(0x0100);
     39	iph->check = (__force __sum16)(check + (check >= 0xFFFF));
     40	return --iph->ttl;
     41}
     42
     43static __always_inline int xdp_fwd_flags(struct xdp_md *ctx, u32 flags)
     44{
     45	void *data_end = (void *)(long)ctx->data_end;
     46	void *data = (void *)(long)ctx->data;
     47	struct bpf_fib_lookup fib_params;
     48	struct ethhdr *eth = data;
     49	struct ipv6hdr *ip6h;
     50	struct iphdr *iph;
     51	u16 h_proto;
     52	u64 nh_off;
     53	int rc;
     54
     55	nh_off = sizeof(*eth);
     56	if (data + nh_off > data_end)
     57		return XDP_DROP;
     58
     59	__builtin_memset(&fib_params, 0, sizeof(fib_params));
     60
     61	h_proto = eth->h_proto;
     62	if (h_proto == htons(ETH_P_IP)) {
     63		iph = data + nh_off;
     64
     65		if (iph + 1 > data_end)
     66			return XDP_DROP;
     67
     68		if (iph->ttl <= 1)
     69			return XDP_PASS;
     70
     71		fib_params.family	= AF_INET;
     72		fib_params.tos		= iph->tos;
     73		fib_params.l4_protocol	= iph->protocol;
     74		fib_params.sport	= 0;
     75		fib_params.dport	= 0;
     76		fib_params.tot_len	= ntohs(iph->tot_len);
     77		fib_params.ipv4_src	= iph->saddr;
     78		fib_params.ipv4_dst	= iph->daddr;
     79	} else if (h_proto == htons(ETH_P_IPV6)) {
     80		struct in6_addr *src = (struct in6_addr *) fib_params.ipv6_src;
     81		struct in6_addr *dst = (struct in6_addr *) fib_params.ipv6_dst;
     82
     83		ip6h = data + nh_off;
     84		if (ip6h + 1 > data_end)
     85			return XDP_DROP;
     86
     87		if (ip6h->hop_limit <= 1)
     88			return XDP_PASS;
     89
     90		fib_params.family	= AF_INET6;
     91		fib_params.flowinfo	= *(__be32 *)ip6h & IPV6_FLOWINFO_MASK;
     92		fib_params.l4_protocol	= ip6h->nexthdr;
     93		fib_params.sport	= 0;
     94		fib_params.dport	= 0;
     95		fib_params.tot_len	= ntohs(ip6h->payload_len);
     96		*src			= ip6h->saddr;
     97		*dst			= ip6h->daddr;
     98	} else {
     99		return XDP_PASS;
    100	}
    101
    102	fib_params.ifindex = ctx->ingress_ifindex;
    103
    104	rc = bpf_fib_lookup(ctx, &fib_params, sizeof(fib_params), flags);
    105	/*
    106	 * Some rc (return codes) from bpf_fib_lookup() are important,
    107	 * to understand how this XDP-prog interacts with network stack.
    108	 *
    109	 * BPF_FIB_LKUP_RET_NO_NEIGH:
    110	 *  Even if route lookup was a success, then the MAC-addresses are also
    111	 *  needed.  This is obtained from arp/neighbour table, but if table is
    112	 *  (still) empty then BPF_FIB_LKUP_RET_NO_NEIGH is returned.  To avoid
    113	 *  doing ARP lookup directly from XDP, then send packet to normal
    114	 *  network stack via XDP_PASS and expect it will do ARP resolution.
    115	 *
    116	 * BPF_FIB_LKUP_RET_FWD_DISABLED:
    117	 *  The bpf_fib_lookup respect sysctl net.ipv{4,6}.conf.all.forwarding
    118	 *  setting, and will return BPF_FIB_LKUP_RET_FWD_DISABLED if not
    119	 *  enabled this on ingress device.
    120	 */
    121	if (rc == BPF_FIB_LKUP_RET_SUCCESS) {
    122		/* Verify egress index has been configured as TX-port.
    123		 * (Note: User can still have inserted an egress ifindex that
    124		 * doesn't support XDP xmit, which will result in packet drops).
    125		 *
    126		 * Note: lookup in devmap supported since 0cdbb4b09a0.
    127		 * If not supported will fail with:
    128		 *  cannot pass map_type 14 into func bpf_map_lookup_elem#1:
    129		 */
    130		if (!bpf_map_lookup_elem(&xdp_tx_ports, &fib_params.ifindex))
    131			return XDP_PASS;
    132
    133		if (h_proto == htons(ETH_P_IP))
    134			ip_decrease_ttl(iph);
    135		else if (h_proto == htons(ETH_P_IPV6))
    136			ip6h->hop_limit--;
    137
    138		memcpy(eth->h_dest, fib_params.dmac, ETH_ALEN);
    139		memcpy(eth->h_source, fib_params.smac, ETH_ALEN);
    140		return bpf_redirect_map(&xdp_tx_ports, fib_params.ifindex, 0);
    141	}
    142
    143	return XDP_PASS;
    144}
    145
    146SEC("xdp_fwd")
    147int xdp_fwd_prog(struct xdp_md *ctx)
    148{
    149	return xdp_fwd_flags(ctx, 0);
    150}
    151
    152SEC("xdp_fwd_direct")
    153int xdp_fwd_direct_prog(struct xdp_md *ctx)
    154{
    155	return xdp_fwd_flags(ctx, BPF_FIB_LOOKUP_DIRECT);
    156}
    157
    158char _license[] SEC("license") = "GPL";