+ rules4 += last_checks
+
+ # Now write the match handling!
+ first_action = None
+ stats_action = ""
+ last_action = None
+ for community in line.split("("):
+ if not community.startswith("generic, "):
+ continue
+ blocks = community.split(",")
+ assert len(blocks) == 3
+ if len(blocks[1].strip()) != 10: # Should be 0x12345678
+ continue
+ ty = blocks[1].strip()[:6]
+ high_byte = int(blocks[1].strip()[6:8], 16)
+ mid_byte = int(blocks[1].strip()[8:], 16)
+ low_bytes = int(blocks[2].strip(") \n"), 16)
+ if ty == "0x8006" or ty == "0x800c" or ty == "0x8306" or ty == "0x830c":
+ if first_action is not None:
+ # Two ratelimit actions, just drop the old one. RFC 8955 says we can.
+ first_action = None
+ exp = (low_bytes & (0xff << 23)) >> 23
+ if low_bytes == 0:
+ first_action = "{stats_replace}\nreturn XDP_DROP;"
+ elif low_bytes & (1 << 31) != 0:
+ # Negative limit, just drop
+ first_action = "{stats_replace}\nreturn XDP_DROP;"
+ elif exp == 0xff:
+ # NaN/INF. Just treat as INF and accept
+ first_action = None
+ elif exp < 127: # < 1
+ first_action = "{stats_replace}\nreturn XDP_DROP;"
+ elif exp >= 127 + 29: # We can't handle the precision required with ns this high
+ first_action = None
+ else:
+ mantissa = low_bytes & ((1 << 23) - 1)
+ value = 1.0 + mantissa / (2**23)
+ value *= 2**(exp-127)
+
+ first_action = "int64_t time_masked = bpf_ktime_get_ns() & RATE_TIME_MASK;\n"
+ first_action += f"int64_t per_pkt_ns = (1000000000LL << RATE_BUCKET_INTEGER_BITS) / {math.floor(value)};\n"
+ if ty == "0x8006" or ty == "0x8306":
+ first_action += "uint64_t amt = data_end - pktdata;\n"
+ else:
+ first_action += "uint64_t amt = 1;\n"
+ if ty == "0x8006" or ty == "0x800c":
+ first_action += f"const uint32_t ratelimitidx = {ratelimitcnt};\n"
+ first_action += "struct ratelimit *rate = bpf_map_lookup_elem(&rate_map, &ratelimitidx);\n"
+ ratelimitcnt += 1
+ first_action += "int matched = 0;\n"
+ first_action += "DO_RATE_LIMIT(bpf_spin_lock(&rate->lock), rate, time_masked, amt, per_pkt_ns, matched);\n"
+ first_action += "if (rate) { bpf_spin_unlock(&rate->lock); }\n"
+ else:
+ if proto == 4:
+ if mid_byte > 32:
+ continue
+ first_action += f"const uint32_t srcip = ip->saddr & MASK4({mid_byte});\n"
+ first_action += f"void *rate_map = &v4_src_rate_{len(v4persrcratelimits)};\n"
+ first_action += f"int matched = check_v4_persrc_ratelimit(srcip, rate_map, {(high_byte + 1) * 4096}, time_masked, amt, per_pkt_ns);\n"
+ v4persrcratelimits.append((high_byte + 1) * 4096)
+ elif mid_byte <= 64:
+ first_action += f"const uint64_t srcip = BE128BEHIGH64(ip6->saddr & MASK6({mid_byte}));\n"
+ first_action += f"void *rate_map = &v5_src_rate_{len(v5persrcratelimits)};\n"
+ first_action += f"int matched = check_v5_persrc_ratelimit(srcip, rate_map, {(high_byte + 1) * 4096}, time_masked, amt, per_pkt_ns);\n"
+ v5persrcratelimits.append((high_byte + 1) * 4096)
+ else:
+ if mid_byte > 128:
+ continue
+ first_action += f"const uint128_t srcip = ip6->saddr & MASK6({mid_byte});\n"
+ first_action += f"void *rate_map = &v6_src_rate_{len(v6persrcratelimits)};\n"
+ first_action += f"int matched = check_v6_persrc_ratelimit(srcip, rate_map, {(high_byte + 1) * 4096}, time_masked, amt, per_pkt_ns);\n"
+ v6persrcratelimits.append((high_byte + 1) * 4096)
+ first_action += "if (matched) {\n"
+ first_action += "\t{stats_replace}\n"
+ first_action += "\treturn XDP_DROP;\n"
+ first_action += "}\n"
+ elif ty == "0x8007":
+ if low_bytes & 1 == 0:
+ last_action = "return XDP_PASS;"
+ if low_bytes & 2 == 2:
+ stats_action = f"const uint32_t ruleidx = STATIC_RULE_CNT + {stats_rulecnt};\n"
+ stats_action += "INCREMENT_MATCH(ruleidx);"
+ elif ty == "0x8008":
+ assert False # We do not implement the redirect action
+ elif ty == "0x8009":
+ if low_bytes & ~0b111111 != 0:
+ assert False # Invalid DSCP value
+ if proto == 4:
+ write_rule("int32_t chk = ~BE16(ip->check) & 0xffff;")
+ write_rule("uint8_t orig_tos = ip->tos;")
+ write_rule("ip->tos = (ip->tos & 3) | " + str(low_bytes << 2) + ";")
+ write_rule("chk = (chk - orig_tos + ip->tos);")
+ write_rule("if (unlikely(chk > 0xffff)) { chk -= 65535; }")
+ write_rule("else if (unlikely(chk < 0)) { chk += 65535; }")
+ write_rule("ip->check = ~BE16(chk);")
+ else:
+ write_rule("ip6->priority = " + str(low_bytes >> 2) + ";")
+ write_rule("ip6->flow_lbl[0] = (ip6->flow_lbl[0] & 0x3f) | " + str((low_bytes & 3) << 6) + ";")
+ if first_action is not None:
+ write_rule(first_action.replace("{stats_replace}", stats_action))
+ if stats_action != "" and (first_action is None or "{stats_replace}" not in first_action):
+ write_rule(stats_action)
+ if last_action is not None:
+ write_rule(last_action)
+ if proto == 6:
+ rules6 += "\t} while(0);\\\n"
+ else:
+ rules4 += "\t} while(0);\\\n"
+ if stats_action != "":
+ print(rule)
+ stats_rulecnt += 1
+ lastrule = None