cce4c40b96
Previously, kfunc declarations in bpf_kfuncs.h (and others) used "user
facing" types for kfuncs prototypes while the actual kfunc definitions
used "kernel facing" types. More specifically: bpf_dynptr vs
bpf_dynptr_kern, __sk_buff vs sk_buff, and xdp_md vs xdp_buff.
It wasn't an issue before, as the verifier allows aliased types.
However, since we are now generating kfunc prototypes in vmlinux.h (in
addition to keeping bpf_kfuncs.h around), this conflict creates
compilation errors.
Fix this conflict by using "user facing" types in kfunc definitions.
This results in more casts, but otherwise has no additional runtime
cost.
Note, similar to 5b268d1ebc ("bpf: Have bpf_rdonly_cast() take a const
pointer"), we also make kfuncs take const arguments where appropriate in
order to make the kfunc more permissive.
Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
Link: https://lore.kernel.org/r/b58346a63a0e66bc9b7504da751b526b0b189a67.1718207789.git.dxu@dxuuu.xyz
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
104 lines
2.2 KiB
C
104 lines
2.2 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
#include "vmlinux.h"
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <bpf/bpf_endian.h>
|
|
#include "bpf_tracing_net.h"
|
|
|
|
#define NF_DROP 0
|
|
#define NF_ACCEPT 1
|
|
#define ETH_P_IP 0x0800
|
|
#define ETH_P_IPV6 0x86DD
|
|
#define IP_MF 0x2000
|
|
#define IP_OFFSET 0x1FFF
|
|
#define NEXTHDR_FRAGMENT 44
|
|
|
|
extern int bpf_dynptr_from_skb(struct __sk_buff *skb, __u64 flags,
|
|
struct bpf_dynptr *ptr__uninit) __ksym;
|
|
extern void *bpf_dynptr_slice(const struct bpf_dynptr *ptr, uint32_t offset,
|
|
void *buffer, uint32_t buffer__sz) __ksym;
|
|
|
|
volatile int shootdowns = 0;
|
|
|
|
static bool is_frag_v4(struct iphdr *iph)
|
|
{
|
|
int offset;
|
|
int flags;
|
|
|
|
offset = bpf_ntohs(iph->frag_off);
|
|
flags = offset & ~IP_OFFSET;
|
|
offset &= IP_OFFSET;
|
|
offset <<= 3;
|
|
|
|
return (flags & IP_MF) || offset;
|
|
}
|
|
|
|
static bool is_frag_v6(struct ipv6hdr *ip6h)
|
|
{
|
|
/* Simplifying assumption that there are no extension headers
|
|
* between fixed header and fragmentation header. This assumption
|
|
* is only valid in this test case. It saves us the hassle of
|
|
* searching all potential extension headers.
|
|
*/
|
|
return ip6h->nexthdr == NEXTHDR_FRAGMENT;
|
|
}
|
|
|
|
static int handle_v4(struct __sk_buff *skb)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
u8 iph_buf[20] = {};
|
|
struct iphdr *iph;
|
|
|
|
if (bpf_dynptr_from_skb(skb, 0, &ptr))
|
|
return NF_DROP;
|
|
|
|
iph = bpf_dynptr_slice(&ptr, 0, iph_buf, sizeof(iph_buf));
|
|
if (!iph)
|
|
return NF_DROP;
|
|
|
|
/* Shootdown any frags */
|
|
if (is_frag_v4(iph)) {
|
|
shootdowns++;
|
|
return NF_DROP;
|
|
}
|
|
|
|
return NF_ACCEPT;
|
|
}
|
|
|
|
static int handle_v6(struct __sk_buff *skb)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct ipv6hdr *ip6h;
|
|
u8 ip6h_buf[40] = {};
|
|
|
|
if (bpf_dynptr_from_skb(skb, 0, &ptr))
|
|
return NF_DROP;
|
|
|
|
ip6h = bpf_dynptr_slice(&ptr, 0, ip6h_buf, sizeof(ip6h_buf));
|
|
if (!ip6h)
|
|
return NF_DROP;
|
|
|
|
/* Shootdown any frags */
|
|
if (is_frag_v6(ip6h)) {
|
|
shootdowns++;
|
|
return NF_DROP;
|
|
}
|
|
|
|
return NF_ACCEPT;
|
|
}
|
|
|
|
SEC("netfilter")
|
|
int defrag(struct bpf_nf_ctx *ctx)
|
|
{
|
|
struct __sk_buff *skb = (struct __sk_buff *)ctx->skb;
|
|
|
|
switch (bpf_ntohs(ctx->skb->protocol)) {
|
|
case ETH_P_IP:
|
|
return handle_v4(skb);
|
|
case ETH_P_IPV6:
|
|
return handle_v6(skb);
|
|
default:
|
|
return NF_ACCEPT;
|
|
}
|
|
}
|
|
|
|
char _license[] SEC("license") = "GPL";
|