Line data    Source code

       1              : /* SPDX-License-Identifier: GPL-2.0-only */
       2              : /*
       3              :  * Copyright (c) 2023 Meta Platforms, Inc. and affiliates.
       4              :  */
       5              : 
       6              : #include "bpfilter/cgen/cgroup.h"
       7              : 
       8              : #include <linux/bpf_common.h>
       9              : #include <linux/if_ether.h>
      10              : 
      11              : #include <stddef.h>
      12              : #include <stdint.h>
      13              : #include <sys/socket.h>
      14              : 
      15              : #include "bpfilter/cgen/cgen.h"
      16              : #include "bpfilter/cgen/program.h"
      17              : #include "bpfilter/cgen/stub.h"
      18              : #include "bpfilter/cgen/swich.h"
      19              : #include "core/btf.h"
      20              : #include "core/flavor.h"
      21              : #include "core/helper.h"
      22              : #include "core/verdict.h"
      23              : #include "linux/bpf.h"
      24              : 
      25              : #include "external/filter.h"
      26              : 
      27              : // Forward definition to avoid headers clusterfuck.
      28              : uint16_t htons(uint16_t hostshort);
      29              : 
      30            0 : static int _bf_cgroup_gen_inline_prologue(struct bf_program *program)
      31              : {
      32              :     int offset;
      33              :     int r;
      34              : 
      35            0 :     bf_assert(program);
      36              : 
      37              :     // Copy the packet size (+ETH_HLEN) into the runtime context
      38            0 :     EMIT(program, BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
      39              :                               offsetof(struct __sk_buff, len)));
      40            0 :     EMIT(program, BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, ETH_HLEN));
      41            0 :     EMIT(program,
      42              :          BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, BF_PROG_CTX_OFF(pkt_size)));
      43              : 
      44              :     /** The @c __sk_buff structure contains two fields related to the interface
      45              :      * index: @c ingress_ifindex and @c ifindex . @c ingress_ifindex is the
      46              :      * interface index the packet has been received on. However, we use
      47              :      * @c ifindex which is the interface index the packet is processed by: if
      48              :      * a packet is redirected locally from interface #1 to interface #2, then
      49              :      * @c ingress_ifindex will contain @c 1 but @c ifindex will contains @c 2 .
      50              :      * For egress, only @c ifindex is used.
      51              :      */
      52            0 :     if ((r = bf_btf_get_field_off("__sk_buff", "ifindex")) < 0)
      53              :         return r;
      54            0 :     EMIT(program, BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, r));
      55            0 :     EMIT(program,
      56              :          BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_2, BF_PROG_CTX_OFF(ifindex)));
      57              : 
      58              :     /* BPF_PROG_TYPE_CGROUP_SKB doesn't provide access the the Ethernet header,
      59              :      * so we can't parse it and discover the L3 protocol ID.
      60              :      * Instead, we use the __sk_buff.family value and convert it to the
      61              :      * corresponding ethertype. */
      62            0 :     if ((offset = bf_btf_get_field_off("__sk_buff", "family")) < 0)
      63              :         return offset;
      64            0 :     EMIT(program, BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offset));
      65              : 
      66              :     {
      67            0 :         _clean_bf_swich_ struct bf_swich swich =
      68            0 :             bf_swich_get(program, BPF_REG_2);
      69              : 
      70            0 :         EMIT_SWICH_OPTION(&swich, AF_INET,
      71              :                           BPF_MOV64_IMM(BPF_REG_7, htons(ETH_P_IP)));
      72            0 :         EMIT_SWICH_OPTION(&swich, AF_INET6,
      73              :                           BPF_MOV64_IMM(BPF_REG_7, htons(ETH_P_IPV6)));
      74            0 :         EMIT_SWICH_DEFAULT(&swich, BPF_MOV64_IMM(BPF_REG_7, 0));
      75              : 
      76            0 :         r = bf_swich_generate(&swich);
      77            0 :         if (r)
      78              :             return r;
      79              :     }
      80              : 
      81            0 :     EMIT(program, BPF_ST_MEM(BPF_W, BPF_REG_10, BF_PROG_CTX_OFF(l3_offset), 0));
      82              : 
      83            0 :     r = bf_stub_make_ctx_skb_dynptr(program, BPF_REG_1);
      84            0 :     if (r)
      85              :         return r;
      86              : 
      87            0 :     r = bf_stub_parse_l3_hdr(program);
      88            0 :     if (r)
      89              :         return r;
      90              : 
      91            0 :     r = bf_stub_parse_l4_hdr(program);
      92              :     if (r)
      93              :         return r;
      94              : 
      95              :     return 0;
      96              : }
      97              : 
      98            0 : static int _bf_cgroup_gen_inline_epilogue(struct bf_program *program)
      99              : {
     100              :     UNUSED(program);
     101              : 
     102            0 :     return 0;
     103              : }
     104              : 
     105              : /**
     106              :  * Convert a standard verdict into a return value.
     107              :  *
     108              :  * @param verdict Verdict to convert. Must be valid.
     109              :  * @return TC return code corresponding to the verdict, as an integer.
     110              :  */
     111            0 : static int _bf_cgroup_get_verdict(enum bf_verdict verdict)
     112              : {
     113            0 :     bf_assert(0 <= verdict && verdict < _BF_TERMINAL_VERDICT_MAX);
     114              : 
     115              :     static const int verdicts[] = {
     116              :         [BF_VERDICT_ACCEPT] = 1,
     117              :         [BF_VERDICT_DROP] = 0,
     118              :     };
     119              : 
     120              :     static_assert(ARRAY_SIZE(verdicts) == _BF_TERMINAL_VERDICT_MAX);
     121              : 
     122            0 :     return verdicts[verdict];
     123              : }
     124              : 
     125              : const struct bf_flavor_ops bf_flavor_ops_cgroup = {
     126              :     .gen_inline_prologue = _bf_cgroup_gen_inline_prologue,
     127              :     .gen_inline_epilogue = _bf_cgroup_gen_inline_epilogue,
     128              :     .get_verdict = _bf_cgroup_get_verdict,
     129              : };