You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/ebpf/bypass_filter.c

235 lines
6.3 KiB
C

/* Copyright (C) 2018 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
#include <stddef.h>
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/in6.h>
#include <linux/ipv6.h>
#include <linux/filter.h>
#include "bpf_helpers.h"
#define LINUX_VERSION_CODE 263682
struct flowv4_keys {
__be32 src;
__be32 dst;
union {
__be32 ports;
__be16 port16[2];
};
__u32 ip_proto;
__u16 vlan_id[2];
};
struct flowv6_keys {
__be32 src[4];
__be32 dst[4];
union {
__be32 ports;
__be16 port16[2];
};
__u32 ip_proto;
__u16 vlan_id[2];
};
struct pair {
ebpf: take clang -target bpf include issue of stdint.h into account This patch prepares code before enabling the clang -target bpf. The clang compiler does not like #include <stdint.h> when using '-target bpf' it will fail with: fatal error: 'gnu/stubs-32.h' file not found This is because using clang -target bpf, then clang will have '__bpf__' defined instead of '__x86_64__' hence the gnu/stubs-32.h include attempt as /usr/include/gnu/stubs.h contains, on x86_64: #if !defined __x86_64__ # include <gnu/stubs-32.h> #endif #if defined __x86_64__ && defined __LP64__ # include <gnu/stubs-64.h> #endif #if defined __x86_64__ && defined __ILP32__ # include <gnu/stubs-x32.h> #endif This can be worked around by installing the 32-bit version of glibc-devel.i686 on your distribution. But the BPF programs does not really need to include stdint.h, if converting: uint64_t -> __u64 uint32_t -> __u32 uint16_t -> __u16 uint8_t -> __u8 This patch does this type syntax conversion. The build of a ebpf files had an issue for system like Debian because they don't have a asm/types.h in the include path if the architecture is not defined which is the case due to target bpf. This results in: clang-5.0 -Wall -Iinclude -O2 \ -D__KERNEL__ -D__ASM_SYSREG_H \ -target bpf -S -emit-llvm vlan_filter.c -o vlan_filter.ll In file included from vlan_filter.c:19: In file included from include/linux/bpf.h:11: /usr/include/linux/types.h:5:10: fatal error: 'asm/types.h' file not found #include <asm/types.h> ^~~~~~~~~~~~~ 1 error generated. Makefile:523: recipe for target 'vlan_filter.bpf' failed This patch fixes the issue by adding a include path setting the architecture to the one of the builder. Signed-off-by: Jesper Dangaard Brouer <netoptimizer@brouer.com> Sidned-off-by: Eric Leblond <eric@regit.org>
7 years ago
__u64 packets;
__u64 bytes;
__u32 hash;
};
struct bpf_map_def SEC("maps") flow_table_v4 = {
.type = BPF_MAP_TYPE_PERCPU_HASH,
.key_size = sizeof(struct flowv4_keys),
.value_size = sizeof(struct pair),
.max_entries = 32768,
};
struct bpf_map_def SEC("maps") flow_table_v6 = {
.type = BPF_MAP_TYPE_PERCPU_HASH,
.key_size = sizeof(struct flowv6_keys),
.value_size = sizeof(struct pair),
.max_entries = 32768,
};
/**
* IPv4 filter
*
* \return 0 to drop packet out and -1 to accept it
*/
static __always_inline int ipv4_filter(struct __sk_buff *skb)
{
ebpf: take clang -target bpf include issue of stdint.h into account This patch prepares code before enabling the clang -target bpf. The clang compiler does not like #include <stdint.h> when using '-target bpf' it will fail with: fatal error: 'gnu/stubs-32.h' file not found This is because using clang -target bpf, then clang will have '__bpf__' defined instead of '__x86_64__' hence the gnu/stubs-32.h include attempt as /usr/include/gnu/stubs.h contains, on x86_64: #if !defined __x86_64__ # include <gnu/stubs-32.h> #endif #if defined __x86_64__ && defined __LP64__ # include <gnu/stubs-64.h> #endif #if defined __x86_64__ && defined __ILP32__ # include <gnu/stubs-x32.h> #endif This can be worked around by installing the 32-bit version of glibc-devel.i686 on your distribution. But the BPF programs does not really need to include stdint.h, if converting: uint64_t -> __u64 uint32_t -> __u32 uint16_t -> __u16 uint8_t -> __u8 This patch does this type syntax conversion. The build of a ebpf files had an issue for system like Debian because they don't have a asm/types.h in the include path if the architecture is not defined which is the case due to target bpf. This results in: clang-5.0 -Wall -Iinclude -O2 \ -D__KERNEL__ -D__ASM_SYSREG_H \ -target bpf -S -emit-llvm vlan_filter.c -o vlan_filter.ll In file included from vlan_filter.c:19: In file included from include/linux/bpf.h:11: /usr/include/linux/types.h:5:10: fatal error: 'asm/types.h' file not found #include <asm/types.h> ^~~~~~~~~~~~~ 1 error generated. Makefile:523: recipe for target 'vlan_filter.bpf' failed This patch fixes the issue by adding a include path setting the architecture to the one of the builder. Signed-off-by: Jesper Dangaard Brouer <netoptimizer@brouer.com> Sidned-off-by: Eric Leblond <eric@regit.org>
7 years ago
__u32 nhoff, verlen;
struct flowv4_keys tuple;
struct pair *value;
ebpf: take clang -target bpf include issue of stdint.h into account This patch prepares code before enabling the clang -target bpf. The clang compiler does not like #include <stdint.h> when using '-target bpf' it will fail with: fatal error: 'gnu/stubs-32.h' file not found This is because using clang -target bpf, then clang will have '__bpf__' defined instead of '__x86_64__' hence the gnu/stubs-32.h include attempt as /usr/include/gnu/stubs.h contains, on x86_64: #if !defined __x86_64__ # include <gnu/stubs-32.h> #endif #if defined __x86_64__ && defined __LP64__ # include <gnu/stubs-64.h> #endif #if defined __x86_64__ && defined __ILP32__ # include <gnu/stubs-x32.h> #endif This can be worked around by installing the 32-bit version of glibc-devel.i686 on your distribution. But the BPF programs does not really need to include stdint.h, if converting: uint64_t -> __u64 uint32_t -> __u32 uint16_t -> __u16 uint8_t -> __u8 This patch does this type syntax conversion. The build of a ebpf files had an issue for system like Debian because they don't have a asm/types.h in the include path if the architecture is not defined which is the case due to target bpf. This results in: clang-5.0 -Wall -Iinclude -O2 \ -D__KERNEL__ -D__ASM_SYSREG_H \ -target bpf -S -emit-llvm vlan_filter.c -o vlan_filter.ll In file included from vlan_filter.c:19: In file included from include/linux/bpf.h:11: /usr/include/linux/types.h:5:10: fatal error: 'asm/types.h' file not found #include <asm/types.h> ^~~~~~~~~~~~~ 1 error generated. Makefile:523: recipe for target 'vlan_filter.bpf' failed This patch fixes the issue by adding a include path setting the architecture to the one of the builder. Signed-off-by: Jesper Dangaard Brouer <netoptimizer@brouer.com> Sidned-off-by: Eric Leblond <eric@regit.org>
7 years ago
__u16 port;
__u16 vlan_id = skb->vlan_tci & 0x0fff;
nhoff = skb->cb[0];
tuple.ip_proto = load_byte(skb, nhoff + offsetof(struct iphdr, protocol));
/* only support TCP and UDP for now */
switch (tuple.ip_proto) {
case IPPROTO_TCP:
case IPPROTO_UDP:
break;
default:
return -1;
}
tuple.src = load_word(skb, nhoff + offsetof(struct iphdr, saddr));
tuple.dst = load_word(skb, nhoff + offsetof(struct iphdr, daddr));
verlen = load_byte(skb, nhoff + 0/*offsetof(struct iphdr, ihl)*/);
nhoff += (verlen & 0xF) << 2;
tuple.ports = load_word(skb, nhoff);
port = tuple.port16[1];
tuple.port16[1] = tuple.port16[0];
tuple.port16[0] = port;
tuple.vlan_id[0] = vlan_id;
/* FIXME add second vlan layer */
tuple.vlan_id[1] = 0;
#if 0
if ((tuple.port16[0] == 22) || (tuple.port16[1] == 22))
{
ebpf: take clang -target bpf include issue of stdint.h into account This patch prepares code before enabling the clang -target bpf. The clang compiler does not like #include <stdint.h> when using '-target bpf' it will fail with: fatal error: 'gnu/stubs-32.h' file not found This is because using clang -target bpf, then clang will have '__bpf__' defined instead of '__x86_64__' hence the gnu/stubs-32.h include attempt as /usr/include/gnu/stubs.h contains, on x86_64: #if !defined __x86_64__ # include <gnu/stubs-32.h> #endif #if defined __x86_64__ && defined __LP64__ # include <gnu/stubs-64.h> #endif #if defined __x86_64__ && defined __ILP32__ # include <gnu/stubs-x32.h> #endif This can be worked around by installing the 32-bit version of glibc-devel.i686 on your distribution. But the BPF programs does not really need to include stdint.h, if converting: uint64_t -> __u64 uint32_t -> __u32 uint16_t -> __u16 uint8_t -> __u8 This patch does this type syntax conversion. The build of a ebpf files had an issue for system like Debian because they don't have a asm/types.h in the include path if the architecture is not defined which is the case due to target bpf. This results in: clang-5.0 -Wall -Iinclude -O2 \ -D__KERNEL__ -D__ASM_SYSREG_H \ -target bpf -S -emit-llvm vlan_filter.c -o vlan_filter.ll In file included from vlan_filter.c:19: In file included from include/linux/bpf.h:11: /usr/include/linux/types.h:5:10: fatal error: 'asm/types.h' file not found #include <asm/types.h> ^~~~~~~~~~~~~ 1 error generated. Makefile:523: recipe for target 'vlan_filter.bpf' failed This patch fixes the issue by adding a include path setting the architecture to the one of the builder. Signed-off-by: Jesper Dangaard Brouer <netoptimizer@brouer.com> Sidned-off-by: Eric Leblond <eric@regit.org>
7 years ago
__u16 sp = tuple.port16[0];
//__u16 dp = tuple.port16[1];
char fmt[] = "Parsed SSH flow: %u %d -> %u\n";
bpf_trace_printk(fmt, sizeof(fmt), tuple.src, sp, tuple.dst);
}
#endif
/* Test if src is in hash */
value = bpf_map_lookup_elem(&flow_table_v4, &tuple);
if (value) {
#if 0
{
ebpf: take clang -target bpf include issue of stdint.h into account This patch prepares code before enabling the clang -target bpf. The clang compiler does not like #include <stdint.h> when using '-target bpf' it will fail with: fatal error: 'gnu/stubs-32.h' file not found This is because using clang -target bpf, then clang will have '__bpf__' defined instead of '__x86_64__' hence the gnu/stubs-32.h include attempt as /usr/include/gnu/stubs.h contains, on x86_64: #if !defined __x86_64__ # include <gnu/stubs-32.h> #endif #if defined __x86_64__ && defined __LP64__ # include <gnu/stubs-64.h> #endif #if defined __x86_64__ && defined __ILP32__ # include <gnu/stubs-x32.h> #endif This can be worked around by installing the 32-bit version of glibc-devel.i686 on your distribution. But the BPF programs does not really need to include stdint.h, if converting: uint64_t -> __u64 uint32_t -> __u32 uint16_t -> __u16 uint8_t -> __u8 This patch does this type syntax conversion. The build of a ebpf files had an issue for system like Debian because they don't have a asm/types.h in the include path if the architecture is not defined which is the case due to target bpf. This results in: clang-5.0 -Wall -Iinclude -O2 \ -D__KERNEL__ -D__ASM_SYSREG_H \ -target bpf -S -emit-llvm vlan_filter.c -o vlan_filter.ll In file included from vlan_filter.c:19: In file included from include/linux/bpf.h:11: /usr/include/linux/types.h:5:10: fatal error: 'asm/types.h' file not found #include <asm/types.h> ^~~~~~~~~~~~~ 1 error generated. Makefile:523: recipe for target 'vlan_filter.bpf' failed This patch fixes the issue by adding a include path setting the architecture to the one of the builder. Signed-off-by: Jesper Dangaard Brouer <netoptimizer@brouer.com> Sidned-off-by: Eric Leblond <eric@regit.org>
7 years ago
__u16 sp = tuple.port16[0];
//__u16 dp = tuple.port16[1];
char bfmt[] = "Found flow: %u %d -> %u\n";
bpf_trace_printk(bfmt, sizeof(bfmt), tuple.src, sp, tuple.dst);
}
#endif
value->packets++;
value->bytes += skb->len;
return 0;
}
return -1;
}
/**
* IPv6 filter
*
* \return 0 to drop packet out and -1 to accept it
*/
static __always_inline int ipv6_filter(struct __sk_buff *skb)
{
ebpf: take clang -target bpf include issue of stdint.h into account This patch prepares code before enabling the clang -target bpf. The clang compiler does not like #include <stdint.h> when using '-target bpf' it will fail with: fatal error: 'gnu/stubs-32.h' file not found This is because using clang -target bpf, then clang will have '__bpf__' defined instead of '__x86_64__' hence the gnu/stubs-32.h include attempt as /usr/include/gnu/stubs.h contains, on x86_64: #if !defined __x86_64__ # include <gnu/stubs-32.h> #endif #if defined __x86_64__ && defined __LP64__ # include <gnu/stubs-64.h> #endif #if defined __x86_64__ && defined __ILP32__ # include <gnu/stubs-x32.h> #endif This can be worked around by installing the 32-bit version of glibc-devel.i686 on your distribution. But the BPF programs does not really need to include stdint.h, if converting: uint64_t -> __u64 uint32_t -> __u32 uint16_t -> __u16 uint8_t -> __u8 This patch does this type syntax conversion. The build of a ebpf files had an issue for system like Debian because they don't have a asm/types.h in the include path if the architecture is not defined which is the case due to target bpf. This results in: clang-5.0 -Wall -Iinclude -O2 \ -D__KERNEL__ -D__ASM_SYSREG_H \ -target bpf -S -emit-llvm vlan_filter.c -o vlan_filter.ll In file included from vlan_filter.c:19: In file included from include/linux/bpf.h:11: /usr/include/linux/types.h:5:10: fatal error: 'asm/types.h' file not found #include <asm/types.h> ^~~~~~~~~~~~~ 1 error generated. Makefile:523: recipe for target 'vlan_filter.bpf' failed This patch fixes the issue by adding a include path setting the architecture to the one of the builder. Signed-off-by: Jesper Dangaard Brouer <netoptimizer@brouer.com> Sidned-off-by: Eric Leblond <eric@regit.org>
7 years ago
__u32 nhoff;
__u8 nhdr;
struct flowv6_keys tuple;
struct pair *value;
ebpf: take clang -target bpf include issue of stdint.h into account This patch prepares code before enabling the clang -target bpf. The clang compiler does not like #include <stdint.h> when using '-target bpf' it will fail with: fatal error: 'gnu/stubs-32.h' file not found This is because using clang -target bpf, then clang will have '__bpf__' defined instead of '__x86_64__' hence the gnu/stubs-32.h include attempt as /usr/include/gnu/stubs.h contains, on x86_64: #if !defined __x86_64__ # include <gnu/stubs-32.h> #endif #if defined __x86_64__ && defined __LP64__ # include <gnu/stubs-64.h> #endif #if defined __x86_64__ && defined __ILP32__ # include <gnu/stubs-x32.h> #endif This can be worked around by installing the 32-bit version of glibc-devel.i686 on your distribution. But the BPF programs does not really need to include stdint.h, if converting: uint64_t -> __u64 uint32_t -> __u32 uint16_t -> __u16 uint8_t -> __u8 This patch does this type syntax conversion. The build of a ebpf files had an issue for system like Debian because they don't have a asm/types.h in the include path if the architecture is not defined which is the case due to target bpf. This results in: clang-5.0 -Wall -Iinclude -O2 \ -D__KERNEL__ -D__ASM_SYSREG_H \ -target bpf -S -emit-llvm vlan_filter.c -o vlan_filter.ll In file included from vlan_filter.c:19: In file included from include/linux/bpf.h:11: /usr/include/linux/types.h:5:10: fatal error: 'asm/types.h' file not found #include <asm/types.h> ^~~~~~~~~~~~~ 1 error generated. Makefile:523: recipe for target 'vlan_filter.bpf' failed This patch fixes the issue by adding a include path setting the architecture to the one of the builder. Signed-off-by: Jesper Dangaard Brouer <netoptimizer@brouer.com> Sidned-off-by: Eric Leblond <eric@regit.org>
7 years ago
__u16 port;
__u16 vlan_id = skb->vlan_tci & 0x0fff;
nhoff = skb->cb[0];
/* get next header */
nhdr = load_byte(skb, nhoff + offsetof(struct ipv6hdr, nexthdr));
/* only support direct TCP and UDP for now */
switch (nhdr) {
case IPPROTO_TCP:
case IPPROTO_UDP:
break;
default:
return -1;
}
tuple.src[0] = load_word(skb, nhoff + offsetof(struct ipv6hdr, saddr));
tuple.src[1] = load_word(skb, nhoff + offsetof(struct ipv6hdr, saddr) + 4);
tuple.src[2] = load_word(skb, nhoff + offsetof(struct ipv6hdr, saddr) + 8);
tuple.src[3] = load_word(skb, nhoff + offsetof(struct ipv6hdr, saddr) + 12);
tuple.dst[0] = load_word(skb, nhoff + offsetof(struct ipv6hdr, daddr));
tuple.dst[1] = load_word(skb, nhoff + offsetof(struct ipv6hdr, daddr) + 4);
tuple.dst[2] = load_word(skb, nhoff + offsetof(struct ipv6hdr, daddr) + 8);
tuple.dst[3] = load_word(skb, nhoff + offsetof(struct ipv6hdr, daddr) + 12);
/* Parse TCP */
tuple.ports = load_word(skb, nhoff + 40 /* IPV6_HEADER_LEN */);
port = tuple.port16[1];
tuple.port16[1] = tuple.port16[0];
tuple.port16[0] = port;
tuple.ip_proto = nhdr;
tuple.vlan_id[0] = vlan_id;
/* FIXME add second vlan layer */
tuple.vlan_id[1] = 0;
//char fmt[] = "Now Got IPv6 port %u and %u\n";
//bpf_trace_printk(fmt, sizeof(fmt), tuple.port16[0], tuple.port16[1]);
/* Test if src is in hash */
value = bpf_map_lookup_elem(&flow_table_v6, &tuple);
if (value) {
//char fmt[] = "Got a match IPv6: %u and %u\n";
//bpf_trace_printk(fmt, sizeof(fmt), tuple.port16[0], tuple.port16[1]);
value->packets++;
value->bytes += skb->len;
return 0;
}
return -1;
}
/**
* filter function
*
* It is loaded in kernel by Suricata that uses the section name specified
* by the SEC call to find it in the Elf binary object and load it.
*
* \return 0 to drop packet out and -1 to accept it
*/
int SEC("filter") hashfilter(struct __sk_buff *skb) {
__u32 nhoff = BPF_LL_OFF + ETH_HLEN;
skb->cb[0] = nhoff;
switch (skb->protocol) {
case __constant_htons(ETH_P_IP):
return ipv4_filter(skb);
case __constant_htons(ETH_P_IPV6):
return ipv6_filter(skb);
default:
#if 0
{
char fmt[] = "Got proto %u\n";
bpf_trace_printk(fmt, sizeof(fmt), h_proto);
break;
}
#else
break;
#endif
}
return -1;
}
char __license[] SEC("license") = "GPL";
ebpf: take clang -target bpf include issue of stdint.h into account This patch prepares code before enabling the clang -target bpf. The clang compiler does not like #include <stdint.h> when using '-target bpf' it will fail with: fatal error: 'gnu/stubs-32.h' file not found This is because using clang -target bpf, then clang will have '__bpf__' defined instead of '__x86_64__' hence the gnu/stubs-32.h include attempt as /usr/include/gnu/stubs.h contains, on x86_64: #if !defined __x86_64__ # include <gnu/stubs-32.h> #endif #if defined __x86_64__ && defined __LP64__ # include <gnu/stubs-64.h> #endif #if defined __x86_64__ && defined __ILP32__ # include <gnu/stubs-x32.h> #endif This can be worked around by installing the 32-bit version of glibc-devel.i686 on your distribution. But the BPF programs does not really need to include stdint.h, if converting: uint64_t -> __u64 uint32_t -> __u32 uint16_t -> __u16 uint8_t -> __u8 This patch does this type syntax conversion. The build of a ebpf files had an issue for system like Debian because they don't have a asm/types.h in the include path if the architecture is not defined which is the case due to target bpf. This results in: clang-5.0 -Wall -Iinclude -O2 \ -D__KERNEL__ -D__ASM_SYSREG_H \ -target bpf -S -emit-llvm vlan_filter.c -o vlan_filter.ll In file included from vlan_filter.c:19: In file included from include/linux/bpf.h:11: /usr/include/linux/types.h:5:10: fatal error: 'asm/types.h' file not found #include <asm/types.h> ^~~~~~~~~~~~~ 1 error generated. Makefile:523: recipe for target 'vlan_filter.bpf' failed This patch fixes the issue by adding a include path setting the architecture to the one of the builder. Signed-off-by: Jesper Dangaard Brouer <netoptimizer@brouer.com> Sidned-off-by: Eric Leblond <eric@regit.org>
7 years ago
__u32 __version SEC("version") = LINUX_VERSION_CODE;