1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Copyright (c) 2017 Facebook 3 */ 4 #include <stddef.h> 5 #include <string.h> 6 #include <linux/bpf.h> 7 #include <linux/if_ether.h> 8 #include <linux/if_packet.h> 9 #include <linux/ip.h> 10 #include <linux/ipv6.h> 11 #include <linux/in.h> 12 #include <linux/tcp.h> 13 #include <linux/pkt_cls.h> 14 #include <bpf/bpf_helpers.h> 15 #include <bpf/bpf_endian.h> 16 17 /* llvm will optimize both subprograms into exactly the same BPF assembly 18 * 19 * Disassembly of section .text: 20 * 21 * 0000000000000000 test_pkt_access_subprog1: 22 * ; return skb->len * 2; 23 * 0: 61 10 00 00 00 00 00 00 r0 = *(u32 *)(r1 + 0) 24 * 1: 64 00 00 00 01 00 00 00 w0 <<= 1 25 * 2: 95 00 00 00 00 00 00 00 exit 26 * 27 * 0000000000000018 test_pkt_access_subprog2: 28 * ; return skb->len * val; 29 * 3: 61 10 00 00 00 00 00 00 r0 = *(u32 *)(r1 + 0) 30 * 4: 64 00 00 00 01 00 00 00 w0 <<= 1 31 * 5: 95 00 00 00 00 00 00 00 exit 32 * 33 * Which makes it an interesting test for BTF-enabled verifier. 34 */ 35 static __attribute__ ((noinline)) 36 int test_pkt_access_subprog1(volatile struct __sk_buff *skb) 37 { 38 return skb->len * 2; 39 } 40 41 static __attribute__ ((noinline)) 42 int test_pkt_access_subprog2(int val, volatile struct __sk_buff *skb) 43 { 44 return skb->len * val; 45 } 46 47 #define MAX_STACK (512 - 2 * 32) 48 49 __attribute__ ((noinline)) 50 int get_skb_len(struct __sk_buff *skb) 51 { 52 volatile char buf[MAX_STACK] = {}; 53 54 return skb->len; 55 } 56 57 __attribute__ ((noinline)) 58 int get_constant(long val) 59 { 60 return val - 122; 61 } 62 63 int get_skb_ifindex(int, struct __sk_buff *skb, int); 64 65 __attribute__ ((noinline)) 66 int test_pkt_access_subprog3(int val, struct __sk_buff *skb) 67 { 68 return get_skb_len(skb) * get_skb_ifindex(val, skb, get_constant(123)); 69 } 70 71 __attribute__ ((noinline)) 72 int get_skb_ifindex(int val, struct __sk_buff *skb, int var) 73 { 74 volatile char buf[MAX_STACK] = {}; 75 76 return skb->ifindex * val * var; 77 } 78 79 __attribute__ ((noinline)) 80 int test_pkt_write_access_subprog(struct __sk_buff *skb, __u32 off) 81 { 82 void *data = (void *)(long)skb->data; 83 void *data_end = (void *)(long)skb->data_end; 84 struct tcphdr *tcp = NULL; 85 86 if (off > sizeof(struct ethhdr) + sizeof(struct ipv6hdr)) 87 return -1; 88 89 tcp = data + off; 90 if (tcp + 1 > data_end) 91 return -1; 92 /* make modification to the packet data */ 93 tcp->check++; 94 return 0; 95 } 96 97 SEC("tc") 98 int test_pkt_access(struct __sk_buff *skb) 99 { 100 void *data_end = (void *)(long)skb->data_end; 101 void *data = (void *)(long)skb->data; 102 struct ethhdr *eth = (struct ethhdr *)(data); 103 struct tcphdr *tcp = NULL; 104 __u8 proto = 255; 105 __u64 ihl_len; 106 107 if (eth + 1 > data_end) 108 return TC_ACT_SHOT; 109 110 if (eth->h_proto == bpf_htons(ETH_P_IP)) { 111 struct iphdr *iph = (struct iphdr *)(eth + 1); 112 113 if (iph + 1 > data_end) 114 return TC_ACT_SHOT; 115 ihl_len = iph->ihl * 4; 116 proto = iph->protocol; 117 tcp = (struct tcphdr *)((void *)(iph) + ihl_len); 118 } else if (eth->h_proto == bpf_htons(ETH_P_IPV6)) { 119 struct ipv6hdr *ip6h = (struct ipv6hdr *)(eth + 1); 120 121 if (ip6h + 1 > data_end) 122 return TC_ACT_SHOT; 123 ihl_len = sizeof(*ip6h); 124 proto = ip6h->nexthdr; 125 tcp = (struct tcphdr *)((void *)(ip6h) + ihl_len); 126 } 127 128 if (test_pkt_access_subprog1(skb) != skb->len * 2) 129 return TC_ACT_SHOT; 130 if (test_pkt_access_subprog2(2, skb) != skb->len * 2) 131 return TC_ACT_SHOT; 132 if (test_pkt_access_subprog3(3, skb) != skb->len * 3 * skb->ifindex) 133 return TC_ACT_SHOT; 134 if (tcp) { 135 if (test_pkt_write_access_subprog(skb, (void *)tcp - data)) 136 return TC_ACT_SHOT; 137 if (((void *)(tcp) + 20) > data_end || proto != 6) 138 return TC_ACT_SHOT; 139 barrier(); /* to force ordering of checks */ 140 if (((void *)(tcp) + 18) > data_end) 141 return TC_ACT_SHOT; 142 if (tcp->urg_ptr == 123) 143 return TC_ACT_OK; 144 } 145 146 return TC_ACT_UNSPEC; 147 } 148