1 // SPDX-License-Identifier: GPL-2.0
2
3 /* In-place tunneling */
4
5 #include <stdbool.h>
6 #include <string.h>
7
8 #include <linux/stddef.h>
9 #include <linux/bpf.h>
10 #include <linux/if_ether.h>
11 #include <linux/in.h>
12 #include <linux/ip.h>
13 #include <linux/ipv6.h>
14 #include <linux/mpls.h>
15 #include <linux/tcp.h>
16 #include <linux/udp.h>
17 #include <linux/pkt_cls.h>
18 #include <linux/types.h>
19
20 #include <bpf/bpf_endian.h>
21 #include <bpf/bpf_helpers.h>
22
23 static const int cfg_port = 8000;
24
25 static const int cfg_udp_src = 20000;
26
27 #define L2_PAD_SZ (sizeof(struct vxlanhdr) + ETH_HLEN)
28
29 #define UDP_PORT 5555
30 #define MPLS_OVER_UDP_PORT 6635
31 #define ETH_OVER_UDP_PORT 7777
32 #define VXLAN_UDP_PORT 8472
33
34 #define EXTPROTO_VXLAN 0x1
35
36 #define VXLAN_N_VID (1u << 24)
37 #define VXLAN_VNI_MASK bpf_htonl((VXLAN_N_VID - 1) << 8)
38 #define VXLAN_FLAGS 0x8
39 #define VXLAN_VNI 1
40
41 #ifndef NEXTHDR_DEST
42 #define NEXTHDR_DEST 60
43 #endif
44
45 /* MPLS label 1000 with S bit (last label) set and ttl of 255. */
46 static const __u32 mpls_label = __bpf_constant_htonl(1000 << 12 |
47 MPLS_LS_S_MASK | 0xff);
48
49 struct vxlanhdr {
50 __be32 vx_flags;
51 __be32 vx_vni;
52 } __attribute__((packed));
53
54 struct gre_hdr {
55 __be16 flags;
56 __be16 protocol;
57 } __attribute__((packed));
58
59 union l4hdr {
60 struct udphdr udp;
61 struct gre_hdr gre;
62 };
63
64 struct v4hdr {
65 struct iphdr ip;
66 union l4hdr l4hdr;
67 __u8 pad[L2_PAD_SZ]; /* space for L2 header / vxlan header ... */
68 } __attribute__((packed));
69
70 struct v6hdr {
71 struct ipv6hdr ip;
72 union l4hdr l4hdr;
73 __u8 pad[L2_PAD_SZ]; /* space for L2 header / vxlan header ... */
74 } __attribute__((packed));
75
set_ipv4_csum(struct iphdr * iph)76 static __always_inline void set_ipv4_csum(struct iphdr *iph)
77 {
78 __u16 *iph16 = (__u16 *)iph;
79 __u32 csum;
80 int i;
81
82 iph->check = 0;
83
84 #pragma clang loop unroll(full)
85 for (i = 0, csum = 0; i < sizeof(*iph) >> 1; i++)
86 csum += *iph16++;
87
88 iph->check = ~((csum & 0xffff) + (csum >> 16));
89 }
90
__encap_ipv4(struct __sk_buff * skb,__u8 encap_proto,__u16 l2_proto,__u16 ext_proto)91 static __always_inline int __encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
92 __u16 l2_proto, __u16 ext_proto)
93 {
94 __u16 udp_dst = UDP_PORT;
95 struct iphdr iph_inner;
96 struct v4hdr h_outer;
97 struct tcphdr tcph;
98 int olen, l2_len;
99 __u8 *l2_hdr = NULL;
100 int tcp_off;
101 __u64 flags;
102
103 /* Most tests encapsulate a packet into a tunnel with the same
104 * network protocol, and derive the outer header fields from
105 * the inner header.
106 *
107 * The 6in4 case tests different inner and outer protocols. As
108 * the inner is ipv6, but the outer expects an ipv4 header as
109 * input, manually build a struct iphdr based on the ipv6hdr.
110 */
111 if (encap_proto == IPPROTO_IPV6) {
112 const __u32 saddr = (192 << 24) | (168 << 16) | (1 << 8) | 1;
113 const __u32 daddr = (192 << 24) | (168 << 16) | (1 << 8) | 2;
114 struct ipv6hdr iph6_inner;
115
116 /* Read the IPv6 header */
117 if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph6_inner,
118 sizeof(iph6_inner)) < 0)
119 return TC_ACT_OK;
120
121 /* Derive the IPv4 header fields from the IPv6 header */
122 memset(&iph_inner, 0, sizeof(iph_inner));
123 iph_inner.version = 4;
124 iph_inner.ihl = 5;
125 iph_inner.tot_len = bpf_htons(sizeof(iph6_inner) +
126 bpf_ntohs(iph6_inner.payload_len));
127 iph_inner.ttl = iph6_inner.hop_limit - 1;
128 iph_inner.protocol = iph6_inner.nexthdr;
129 iph_inner.saddr = __bpf_constant_htonl(saddr);
130 iph_inner.daddr = __bpf_constant_htonl(daddr);
131
132 tcp_off = sizeof(iph6_inner);
133 } else {
134 if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
135 sizeof(iph_inner)) < 0)
136 return TC_ACT_OK;
137
138 tcp_off = sizeof(iph_inner);
139 }
140
141 /* filter only packets we want */
142 if (iph_inner.ihl != 5 || iph_inner.protocol != IPPROTO_TCP)
143 return TC_ACT_OK;
144
145 if (bpf_skb_load_bytes(skb, ETH_HLEN + tcp_off,
146 &tcph, sizeof(tcph)) < 0)
147 return TC_ACT_OK;
148
149 if (tcph.dest != __bpf_constant_htons(cfg_port))
150 return TC_ACT_OK;
151
152 olen = sizeof(h_outer.ip);
153 l2_len = 0;
154
155 flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV4;
156
157 switch (l2_proto) {
158 case ETH_P_MPLS_UC:
159 l2_len = sizeof(mpls_label);
160 udp_dst = MPLS_OVER_UDP_PORT;
161 break;
162 case ETH_P_TEB:
163 l2_len = ETH_HLEN;
164 if (ext_proto & EXTPROTO_VXLAN) {
165 udp_dst = VXLAN_UDP_PORT;
166 l2_len += sizeof(struct vxlanhdr);
167 } else
168 udp_dst = ETH_OVER_UDP_PORT;
169 break;
170 }
171 flags |= BPF_F_ADJ_ROOM_ENCAP_L2(l2_len);
172
173 switch (encap_proto) {
174 case IPPROTO_GRE:
175 flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
176 olen += sizeof(h_outer.l4hdr.gre);
177 h_outer.l4hdr.gre.protocol = bpf_htons(l2_proto);
178 h_outer.l4hdr.gre.flags = 0;
179 break;
180 case IPPROTO_UDP:
181 flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
182 olen += sizeof(h_outer.l4hdr.udp);
183 h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
184 h_outer.l4hdr.udp.dest = bpf_htons(udp_dst);
185 h_outer.l4hdr.udp.check = 0;
186 h_outer.l4hdr.udp.len = bpf_htons(bpf_ntohs(iph_inner.tot_len) +
187 sizeof(h_outer.l4hdr.udp) +
188 l2_len);
189 break;
190 case IPPROTO_IPIP:
191 case IPPROTO_IPV6:
192 break;
193 default:
194 return TC_ACT_OK;
195 }
196
197 /* add L2 encap (if specified) */
198 l2_hdr = (__u8 *)&h_outer + olen;
199 switch (l2_proto) {
200 case ETH_P_MPLS_UC:
201 *(__u32 *)l2_hdr = mpls_label;
202 break;
203 case ETH_P_TEB:
204 flags |= BPF_F_ADJ_ROOM_ENCAP_L2_ETH;
205
206 if (ext_proto & EXTPROTO_VXLAN) {
207 struct vxlanhdr *vxlan_hdr = (struct vxlanhdr *)l2_hdr;
208
209 vxlan_hdr->vx_flags = VXLAN_FLAGS;
210 vxlan_hdr->vx_vni = bpf_htonl((VXLAN_VNI & VXLAN_VNI_MASK) << 8);
211
212 l2_hdr += sizeof(struct vxlanhdr);
213 }
214
215 if (bpf_skb_load_bytes(skb, 0, l2_hdr, ETH_HLEN))
216 return TC_ACT_SHOT;
217
218 break;
219 }
220 olen += l2_len;
221
222 /* add room between mac and network header */
223 if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
224 return TC_ACT_SHOT;
225
226 /* prepare new outer network header */
227 h_outer.ip = iph_inner;
228 h_outer.ip.tot_len = bpf_htons(olen +
229 bpf_ntohs(h_outer.ip.tot_len));
230 h_outer.ip.protocol = encap_proto;
231
232 set_ipv4_csum((void *)&h_outer.ip);
233
234 /* store new outer network header */
235 if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
236 BPF_F_INVALIDATE_HASH) < 0)
237 return TC_ACT_SHOT;
238
239 /* if changing outer proto type, update eth->h_proto */
240 if (encap_proto == IPPROTO_IPV6) {
241 struct ethhdr eth;
242
243 if (bpf_skb_load_bytes(skb, 0, ð, sizeof(eth)) < 0)
244 return TC_ACT_SHOT;
245 eth.h_proto = bpf_htons(ETH_P_IP);
246 if (bpf_skb_store_bytes(skb, 0, ð, sizeof(eth), 0) < 0)
247 return TC_ACT_SHOT;
248 }
249
250 return TC_ACT_OK;
251 }
252
encap_ipv4(struct __sk_buff * skb,__u8 encap_proto,__u16 l2_proto)253 static __always_inline int encap_ipv4(struct __sk_buff *skb, __u8 encap_proto,
254 __u16 l2_proto)
255 {
256 return __encap_ipv4(skb, encap_proto, l2_proto, 0);
257 }
258
__encap_ipv6(struct __sk_buff * skb,__u8 encap_proto,__u16 l2_proto,__u16 ext_proto)259 static __always_inline int __encap_ipv6(struct __sk_buff *skb, __u8 encap_proto,
260 __u16 l2_proto, __u16 ext_proto)
261 {
262 __u16 udp_dst = UDP_PORT;
263 struct ipv6hdr iph_inner;
264 struct v6hdr h_outer;
265 struct tcphdr tcph;
266 int olen, l2_len;
267 __u8 *l2_hdr = NULL;
268 __u16 tot_len;
269 __u64 flags;
270
271 if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
272 sizeof(iph_inner)) < 0)
273 return TC_ACT_OK;
274
275 /* filter only packets we want */
276 if (bpf_skb_load_bytes(skb, ETH_HLEN + sizeof(iph_inner),
277 &tcph, sizeof(tcph)) < 0)
278 return TC_ACT_OK;
279
280 if (tcph.dest != __bpf_constant_htons(cfg_port))
281 return TC_ACT_OK;
282
283 olen = sizeof(h_outer.ip);
284 l2_len = 0;
285
286 flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV6;
287
288 switch (l2_proto) {
289 case ETH_P_MPLS_UC:
290 l2_len = sizeof(mpls_label);
291 udp_dst = MPLS_OVER_UDP_PORT;
292 break;
293 case ETH_P_TEB:
294 l2_len = ETH_HLEN;
295 if (ext_proto & EXTPROTO_VXLAN) {
296 udp_dst = VXLAN_UDP_PORT;
297 l2_len += sizeof(struct vxlanhdr);
298 } else
299 udp_dst = ETH_OVER_UDP_PORT;
300 break;
301 }
302 flags |= BPF_F_ADJ_ROOM_ENCAP_L2(l2_len);
303
304 switch (encap_proto) {
305 case IPPROTO_GRE:
306 flags |= BPF_F_ADJ_ROOM_ENCAP_L4_GRE;
307 olen += sizeof(h_outer.l4hdr.gre);
308 h_outer.l4hdr.gre.protocol = bpf_htons(l2_proto);
309 h_outer.l4hdr.gre.flags = 0;
310 break;
311 case IPPROTO_UDP:
312 flags |= BPF_F_ADJ_ROOM_ENCAP_L4_UDP;
313 olen += sizeof(h_outer.l4hdr.udp);
314 h_outer.l4hdr.udp.source = __bpf_constant_htons(cfg_udp_src);
315 h_outer.l4hdr.udp.dest = bpf_htons(udp_dst);
316 tot_len = bpf_ntohs(iph_inner.payload_len) + sizeof(iph_inner) +
317 sizeof(h_outer.l4hdr.udp) + l2_len;
318 h_outer.l4hdr.udp.check = 0;
319 h_outer.l4hdr.udp.len = bpf_htons(tot_len);
320 break;
321 case IPPROTO_IPV6:
322 break;
323 default:
324 return TC_ACT_OK;
325 }
326
327 /* add L2 encap (if specified) */
328 l2_hdr = (__u8 *)&h_outer + olen;
329 switch (l2_proto) {
330 case ETH_P_MPLS_UC:
331 *(__u32 *)l2_hdr = mpls_label;
332 break;
333 case ETH_P_TEB:
334 flags |= BPF_F_ADJ_ROOM_ENCAP_L2_ETH;
335
336 if (ext_proto & EXTPROTO_VXLAN) {
337 struct vxlanhdr *vxlan_hdr = (struct vxlanhdr *)l2_hdr;
338
339 vxlan_hdr->vx_flags = VXLAN_FLAGS;
340 vxlan_hdr->vx_vni = bpf_htonl((VXLAN_VNI & VXLAN_VNI_MASK) << 8);
341
342 l2_hdr += sizeof(struct vxlanhdr);
343 }
344
345 if (bpf_skb_load_bytes(skb, 0, l2_hdr, ETH_HLEN))
346 return TC_ACT_SHOT;
347 break;
348 }
349 olen += l2_len;
350
351 /* add room between mac and network header */
352 if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
353 return TC_ACT_SHOT;
354
355 /* prepare new outer network header */
356 h_outer.ip = iph_inner;
357 h_outer.ip.payload_len = bpf_htons(olen +
358 bpf_ntohs(h_outer.ip.payload_len));
359
360 h_outer.ip.nexthdr = encap_proto;
361
362 /* store new outer network header */
363 if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
364 BPF_F_INVALIDATE_HASH) < 0)
365 return TC_ACT_SHOT;
366
367 return TC_ACT_OK;
368 }
369
encap_ipv6_ipip6(struct __sk_buff * skb)370 static int encap_ipv6_ipip6(struct __sk_buff *skb)
371 {
372 struct iphdr iph_inner;
373 struct v6hdr h_outer;
374 struct tcphdr tcph;
375 struct ethhdr eth;
376 __u64 flags;
377 int olen;
378
379 if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_inner,
380 sizeof(iph_inner)) < 0)
381 return TC_ACT_OK;
382
383 /* filter only packets we want */
384 if (bpf_skb_load_bytes(skb, ETH_HLEN + (iph_inner.ihl << 2),
385 &tcph, sizeof(tcph)) < 0)
386 return TC_ACT_OK;
387
388 if (tcph.dest != __bpf_constant_htons(cfg_port))
389 return TC_ACT_OK;
390
391 olen = sizeof(h_outer.ip);
392
393 flags = BPF_F_ADJ_ROOM_FIXED_GSO | BPF_F_ADJ_ROOM_ENCAP_L3_IPV6;
394
395 /* add room between mac and network header */
396 if (bpf_skb_adjust_room(skb, olen, BPF_ADJ_ROOM_MAC, flags))
397 return TC_ACT_SHOT;
398
399 /* prepare new outer network header */
400 memset(&h_outer.ip, 0, sizeof(h_outer.ip));
401 h_outer.ip.version = 6;
402 h_outer.ip.hop_limit = iph_inner.ttl;
403 h_outer.ip.saddr.s6_addr[1] = 0xfd;
404 h_outer.ip.saddr.s6_addr[15] = 1;
405 h_outer.ip.daddr.s6_addr[1] = 0xfd;
406 h_outer.ip.daddr.s6_addr[15] = 2;
407 h_outer.ip.payload_len = iph_inner.tot_len;
408 h_outer.ip.nexthdr = IPPROTO_IPIP;
409
410 /* store new outer network header */
411 if (bpf_skb_store_bytes(skb, ETH_HLEN, &h_outer, olen,
412 BPF_F_INVALIDATE_HASH) < 0)
413 return TC_ACT_SHOT;
414
415 /* update eth->h_proto */
416 if (bpf_skb_load_bytes(skb, 0, ð, sizeof(eth)) < 0)
417 return TC_ACT_SHOT;
418 eth.h_proto = bpf_htons(ETH_P_IPV6);
419 if (bpf_skb_store_bytes(skb, 0, ð, sizeof(eth), 0) < 0)
420 return TC_ACT_SHOT;
421
422 return TC_ACT_OK;
423 }
424
encap_ipv6(struct __sk_buff * skb,__u8 encap_proto,__u16 l2_proto)425 static __always_inline int encap_ipv6(struct __sk_buff *skb, __u8 encap_proto,
426 __u16 l2_proto)
427 {
428 return __encap_ipv6(skb, encap_proto, l2_proto, 0);
429 }
430
431 SEC("encap_ipip_none")
__encap_ipip_none(struct __sk_buff * skb)432 int __encap_ipip_none(struct __sk_buff *skb)
433 {
434 if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
435 return encap_ipv4(skb, IPPROTO_IPIP, ETH_P_IP);
436 else
437 return TC_ACT_OK;
438 }
439
440 SEC("encap_gre_none")
__encap_gre_none(struct __sk_buff * skb)441 int __encap_gre_none(struct __sk_buff *skb)
442 {
443 if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
444 return encap_ipv4(skb, IPPROTO_GRE, ETH_P_IP);
445 else
446 return TC_ACT_OK;
447 }
448
449 SEC("encap_gre_mpls")
__encap_gre_mpls(struct __sk_buff * skb)450 int __encap_gre_mpls(struct __sk_buff *skb)
451 {
452 if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
453 return encap_ipv4(skb, IPPROTO_GRE, ETH_P_MPLS_UC);
454 else
455 return TC_ACT_OK;
456 }
457
458 SEC("encap_gre_eth")
__encap_gre_eth(struct __sk_buff * skb)459 int __encap_gre_eth(struct __sk_buff *skb)
460 {
461 if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
462 return encap_ipv4(skb, IPPROTO_GRE, ETH_P_TEB);
463 else
464 return TC_ACT_OK;
465 }
466
467 SEC("encap_udp_none")
__encap_udp_none(struct __sk_buff * skb)468 int __encap_udp_none(struct __sk_buff *skb)
469 {
470 if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
471 return encap_ipv4(skb, IPPROTO_UDP, ETH_P_IP);
472 else
473 return TC_ACT_OK;
474 }
475
476 SEC("encap_udp_mpls")
__encap_udp_mpls(struct __sk_buff * skb)477 int __encap_udp_mpls(struct __sk_buff *skb)
478 {
479 if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
480 return encap_ipv4(skb, IPPROTO_UDP, ETH_P_MPLS_UC);
481 else
482 return TC_ACT_OK;
483 }
484
485 SEC("encap_udp_eth")
__encap_udp_eth(struct __sk_buff * skb)486 int __encap_udp_eth(struct __sk_buff *skb)
487 {
488 if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
489 return encap_ipv4(skb, IPPROTO_UDP, ETH_P_TEB);
490 else
491 return TC_ACT_OK;
492 }
493
494 SEC("encap_vxlan_eth")
__encap_vxlan_eth(struct __sk_buff * skb)495 int __encap_vxlan_eth(struct __sk_buff *skb)
496 {
497 if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
498 return __encap_ipv4(skb, IPPROTO_UDP,
499 ETH_P_TEB,
500 EXTPROTO_VXLAN);
501 else
502 return TC_ACT_OK;
503 }
504
505 SEC("encap_sit_none")
__encap_sit_none(struct __sk_buff * skb)506 int __encap_sit_none(struct __sk_buff *skb)
507 {
508 if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
509 return encap_ipv4(skb, IPPROTO_IPV6, ETH_P_IP);
510 else
511 return TC_ACT_OK;
512 }
513
514 SEC("encap_ip6tnl_none")
__encap_ip6tnl_none(struct __sk_buff * skb)515 int __encap_ip6tnl_none(struct __sk_buff *skb)
516 {
517 if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
518 return encap_ipv6(skb, IPPROTO_IPV6, ETH_P_IPV6);
519 else
520 return TC_ACT_OK;
521 }
522
523 SEC("encap_ipip6_none")
__encap_ipip6_none(struct __sk_buff * skb)524 int __encap_ipip6_none(struct __sk_buff *skb)
525 {
526 if (skb->protocol == __bpf_constant_htons(ETH_P_IP))
527 return encap_ipv6_ipip6(skb);
528 else
529 return TC_ACT_OK;
530 }
531
532 SEC("encap_ip6gre_none")
__encap_ip6gre_none(struct __sk_buff * skb)533 int __encap_ip6gre_none(struct __sk_buff *skb)
534 {
535 if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
536 return encap_ipv6(skb, IPPROTO_GRE, ETH_P_IPV6);
537 else
538 return TC_ACT_OK;
539 }
540
541 SEC("encap_ip6gre_mpls")
__encap_ip6gre_mpls(struct __sk_buff * skb)542 int __encap_ip6gre_mpls(struct __sk_buff *skb)
543 {
544 if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
545 return encap_ipv6(skb, IPPROTO_GRE, ETH_P_MPLS_UC);
546 else
547 return TC_ACT_OK;
548 }
549
550 SEC("encap_ip6gre_eth")
__encap_ip6gre_eth(struct __sk_buff * skb)551 int __encap_ip6gre_eth(struct __sk_buff *skb)
552 {
553 if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
554 return encap_ipv6(skb, IPPROTO_GRE, ETH_P_TEB);
555 else
556 return TC_ACT_OK;
557 }
558
559 SEC("encap_ip6udp_none")
__encap_ip6udp_none(struct __sk_buff * skb)560 int __encap_ip6udp_none(struct __sk_buff *skb)
561 {
562 if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
563 return encap_ipv6(skb, IPPROTO_UDP, ETH_P_IPV6);
564 else
565 return TC_ACT_OK;
566 }
567
568 SEC("encap_ip6udp_mpls")
__encap_ip6udp_mpls(struct __sk_buff * skb)569 int __encap_ip6udp_mpls(struct __sk_buff *skb)
570 {
571 if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
572 return encap_ipv6(skb, IPPROTO_UDP, ETH_P_MPLS_UC);
573 else
574 return TC_ACT_OK;
575 }
576
577 SEC("encap_ip6udp_eth")
__encap_ip6udp_eth(struct __sk_buff * skb)578 int __encap_ip6udp_eth(struct __sk_buff *skb)
579 {
580 if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
581 return encap_ipv6(skb, IPPROTO_UDP, ETH_P_TEB);
582 else
583 return TC_ACT_OK;
584 }
585
586 SEC("encap_ip6vxlan_eth")
__encap_ip6vxlan_eth(struct __sk_buff * skb)587 int __encap_ip6vxlan_eth(struct __sk_buff *skb)
588 {
589 if (skb->protocol == __bpf_constant_htons(ETH_P_IPV6))
590 return __encap_ipv6(skb, IPPROTO_UDP,
591 ETH_P_TEB,
592 EXTPROTO_VXLAN);
593 else
594 return TC_ACT_OK;
595 }
596
decap_internal(struct __sk_buff * skb,int off,int len,char proto)597 static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
598 {
599 __u64 flags = BPF_F_ADJ_ROOM_FIXED_GSO;
600 struct ipv6_opt_hdr ip6_opt_hdr;
601 struct gre_hdr greh;
602 struct udphdr udph;
603 int olen = len;
604
605 switch (proto) {
606 case IPPROTO_IPIP:
607 flags |= BPF_F_ADJ_ROOM_DECAP_L3_IPV4;
608 break;
609 case IPPROTO_IPV6:
610 flags |= BPF_F_ADJ_ROOM_DECAP_L3_IPV6;
611 break;
612 case NEXTHDR_DEST:
613 if (bpf_skb_load_bytes(skb, off + len, &ip6_opt_hdr,
614 sizeof(ip6_opt_hdr)) < 0)
615 return TC_ACT_OK;
616 switch (ip6_opt_hdr.nexthdr) {
617 case IPPROTO_IPIP:
618 flags |= BPF_F_ADJ_ROOM_DECAP_L3_IPV4;
619 break;
620 case IPPROTO_IPV6:
621 flags |= BPF_F_ADJ_ROOM_DECAP_L3_IPV6;
622 break;
623 default:
624 return TC_ACT_OK;
625 }
626 break;
627 case IPPROTO_GRE:
628 olen += sizeof(struct gre_hdr);
629 if (bpf_skb_load_bytes(skb, off + len, &greh, sizeof(greh)) < 0)
630 return TC_ACT_OK;
631 switch (bpf_ntohs(greh.protocol)) {
632 case ETH_P_MPLS_UC:
633 olen += sizeof(mpls_label);
634 break;
635 case ETH_P_TEB:
636 olen += ETH_HLEN;
637 break;
638 }
639 break;
640 case IPPROTO_UDP:
641 olen += sizeof(struct udphdr);
642 if (bpf_skb_load_bytes(skb, off + len, &udph, sizeof(udph)) < 0)
643 return TC_ACT_OK;
644 switch (bpf_ntohs(udph.dest)) {
645 case MPLS_OVER_UDP_PORT:
646 olen += sizeof(mpls_label);
647 break;
648 case ETH_OVER_UDP_PORT:
649 olen += ETH_HLEN;
650 break;
651 case VXLAN_UDP_PORT:
652 olen += ETH_HLEN + sizeof(struct vxlanhdr);
653 break;
654 }
655 break;
656 default:
657 return TC_ACT_OK;
658 }
659
660 if (bpf_skb_adjust_room(skb, -olen, BPF_ADJ_ROOM_MAC, flags))
661 return TC_ACT_SHOT;
662
663 return TC_ACT_OK;
664 }
665
decap_ipv4(struct __sk_buff * skb)666 static int decap_ipv4(struct __sk_buff *skb)
667 {
668 struct iphdr iph_outer;
669
670 if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_outer,
671 sizeof(iph_outer)) < 0)
672 return TC_ACT_OK;
673
674 if (iph_outer.ihl != 5)
675 return TC_ACT_OK;
676
677 return decap_internal(skb, ETH_HLEN, sizeof(iph_outer),
678 iph_outer.protocol);
679 }
680
decap_ipv6(struct __sk_buff * skb)681 static int decap_ipv6(struct __sk_buff *skb)
682 {
683 struct ipv6hdr iph_outer;
684
685 if (bpf_skb_load_bytes(skb, ETH_HLEN, &iph_outer,
686 sizeof(iph_outer)) < 0)
687 return TC_ACT_OK;
688
689 return decap_internal(skb, ETH_HLEN, sizeof(iph_outer),
690 iph_outer.nexthdr);
691 }
692
693 SEC("decap")
decap_f(struct __sk_buff * skb)694 int decap_f(struct __sk_buff *skb)
695 {
696 switch (skb->protocol) {
697 case __bpf_constant_htons(ETH_P_IP):
698 return decap_ipv4(skb);
699 case __bpf_constant_htons(ETH_P_IPV6):
700 return decap_ipv6(skb);
701 default:
702 /* does not match, ignore */
703 return TC_ACT_OK;
704 }
705 }
706
707 char __license[] SEC("license") = "GPL";
708
