Track and print rule source in drop prints

[flowspec-xdp] / xdp.c

diff --git a/xdp.c b/xdp.c
index 74e8e8cb0e850c8556b68877c0faa6de194f51b4..4e4d6c6308437ed759239c1f166f982dca36256c 100644 (file)
--- a/xdp.c
+++ b/xdp.c
@@ -159,6 +159,12 @@ struct bpf_map_def SEC("maps") drop_cnt_map = {
 
 SEC("xdp_drop")
 #endif
+
+// It seems (based on drop counts) that data_end points to the last byte, not one-past-the-end.
+// This feels strange, but some documentation suggests > here as well, so we stick with that.
+#define CHECK_LEN(start, struc) \
+       if (unlikely((void*)(start) + sizeof(struct struc) > data_end)) DO_RETURN(PKT_LEN_DROP, XDP_DROP);
+
 int xdp_drop_prog(struct xdp_md *ctx)
 {
        const void *const data_end = (void *)(size_t)ctx->data_end;
@@ -167,14 +173,12 @@ int xdp_drop_prog(struct xdp_md *ctx)
        unsigned short eth_proto;
 
        {
-               if (unlikely((void*)(size_t)ctx->data + sizeof(struct ethhdr) > data_end))
-                       DO_RETURN(PKT_LEN_DROP, XDP_DROP);
+               CHECK_LEN((size_t)ctx->data, ethhdr);
                const struct ethhdr *const eth = (void*)(size_t)ctx->data;
 
 #if PARSE_8021Q == PARSE
                if (likely(eth->h_proto == BE16(ETH_P_8021Q))) {
-                       if (unlikely((void*)(size_t)ctx->data + sizeof(struct ethhdr_vlan) > data_end))
-                               DO_RETURN(PKT_LEN_DROP, XDP_DROP);
+                       CHECK_LEN((size_t)ctx->data, ethhdr_vlan);
                        const struct ethhdr_vlan *const eth_vlan = (void*)(size_t)ctx->data;
 
 #ifdef REQ_8021Q
@@ -198,25 +202,15 @@ int xdp_drop_prog(struct xdp_md *ctx)
                }
        }
 
-#ifdef NEED_V4_PARSE
-       const struct iphdr *ip = NULL;
-       const struct icmphdr *icmp = NULL;
-#endif
-#ifdef NEED_V6_PARSE
-       const struct ip6hdr *ip6 = NULL;
-       const struct icmp6hdr *icmpv6 = NULL;
-       const struct ip6_fraghdr *frag6 = NULL;
-#endif
-
        const void *l4hdr = NULL;
        const struct tcphdr *tcp = NULL;
-       const struct udphdr *udp = NULL;
+       uint8_t ports_valid = 0;
+       uint16_t sport, dport; // Host Endian! Only valid with tcp || udp
 
 #ifdef NEED_V4_PARSE
        if (eth_proto == BE16(ETH_P_IP)) {
-               if (unlikely(pktdata + sizeof(struct iphdr) > data_end))
-                       DO_RETURN(PKT_LEN_DROP, XDP_DROP);
-               ip = (struct iphdr*) pktdata;
+               CHECK_LEN(pktdata, iphdr);
+               const struct iphdr *ip = (struct iphdr*) pktdata;
 
 #if PARSE_IHL == PARSE
                if (unlikely(ip->ihl < 5)) DO_RETURN(IHL_DROP, XDP_DROP);
@@ -226,37 +220,42 @@ int xdp_drop_prog(struct xdp_md *ctx)
                l4hdr = pktdata + 5*4;
 #endif
 
+               const struct icmphdr *icmp = NULL;
                if ((ip->frag_off & BE16(IP_OFFSET)) == 0) {
                        if (ip->protocol == IP_PROTO_TCP) {
-                               if (unlikely(l4hdr + sizeof(struct tcphdr) > data_end))
-                                       DO_RETURN(PKT_LEN_DROP, XDP_DROP);
+                               CHECK_LEN(l4hdr, tcphdr);
                                tcp = (struct tcphdr*) l4hdr;
+                               sport = BE16(tcp->source);
+                               dport = BE16(tcp->dest);
+                               ports_valid = 1;
                        } else if (ip->protocol == IP_PROTO_UDP) {
-                               if (unlikely(l4hdr + sizeof(struct udphdr) > data_end))
-                                       DO_RETURN(PKT_LEN_DROP, XDP_DROP);
-                               udp = (struct udphdr*) l4hdr;
+                               CHECK_LEN(l4hdr, udphdr);
+                               const struct udphdr *udp = (struct udphdr*) l4hdr;
+                               sport = BE16(udp->source);
+                               dport = BE16(udp->dest);
+                               ports_valid = 1;
                        } else if (ip->protocol == IP_PROTO_ICMP) {
-                               if (unlikely(l4hdr + sizeof(struct icmphdr) > data_end))
-                                       DO_RETURN(PKT_LEN_DROP, XDP_DROP);
+                               CHECK_LEN(l4hdr, icmphdr);
                                icmp = (struct icmphdr*) l4hdr;
                        }
                }
+
+               RULES4
        }
 #endif
 #ifdef NEED_V6_PARSE
        if (eth_proto == BE16(ETH_P_IPV6)) {
-               if (unlikely(pktdata + sizeof(struct ip6hdr) > data_end))
-                       DO_RETURN(PKT_LEN_DROP, XDP_DROP);
-               ip6 = (struct ip6hdr*) pktdata;
+               CHECK_LEN(pktdata, ip6hdr);
+               const struct ip6hdr *ip6 = (struct ip6hdr*) pktdata;
 
                l4hdr = pktdata + 40;
 
                uint8_t v6nexthdr = ip6->nexthdr;
+               const struct ip6_fraghdr *frag6 = NULL;
 #ifdef PARSE_V6_FRAG
 #if PARSE_V6_FRAG == PARSE
                if (ip6->nexthdr == IP6_PROTO_FRAG) {
-                       if (unlikely(l4hdr + sizeof(struct ip6_fraghdr) > data_end))
-                               DO_RETURN(PKT_LEN_DROP, XDP_DROP);
+                       CHECK_LEN(l4hdr, ip6_fraghdr);
                        frag6 = (struct ip6_fraghdr*) l4hdr;
                        l4hdr = l4hdr + sizeof(struct ip6_fraghdr);
                        v6nexthdr = frag6->nexthdr;
@@ -268,34 +267,29 @@ int xdp_drop_prog(struct xdp_md *ctx)
 #endif
                // TODO: Handle more options?
 
+               const struct icmp6hdr *icmpv6 = NULL;
                if (frag6 == NULL || (frag6->frag_off & BE16(IP6_FRAGOFF)) == 0) {
                        if (v6nexthdr == IP_PROTO_TCP) {
-                               if (unlikely(l4hdr + sizeof(struct tcphdr) > data_end))
-                                       DO_RETURN(PKT_LEN_DROP, XDP_DROP);
+                               CHECK_LEN(l4hdr, tcphdr);
                                tcp = (struct tcphdr*) l4hdr;
+                               sport = BE16(tcp->source);
+                               dport = BE16(tcp->dest);
+                               ports_valid = 1;
                        } else if (v6nexthdr == IP_PROTO_UDP) {
-                               if (unlikely(l4hdr + sizeof(struct udphdr) > data_end))
-                                       DO_RETURN(PKT_LEN_DROP, XDP_DROP);
-                               udp = (struct udphdr*) l4hdr;
+                               CHECK_LEN(l4hdr, udphdr);
+                               const struct udphdr *udp = (struct udphdr*) l4hdr;
+                               sport = BE16(udp->source);
+                               dport = BE16(udp->dest);
+                               ports_valid = 1;
                        } else if (v6nexthdr == IP6_PROTO_ICMPV6) {
-                               if (unlikely(l4hdr + sizeof(struct icmp6hdr) > data_end))
-                                       DO_RETURN(PKT_LEN_DROP, XDP_DROP);
+                               CHECK_LEN(l4hdr, icmp6hdr);
                                icmpv6 = (struct icmp6hdr*) l4hdr;
                        }
                }
-       }
-#endif
 
-       uint16_t sport, dport; // Host Endian! Only valid with tcp || udp
-       if (tcp != NULL) {
-               sport = BE16(tcp->source);
-               dport = BE16(tcp->dest);
-       } else if (udp != NULL) {
-               sport = BE16(udp->source);
-               dport = BE16(udp->dest);
+               RULES6
        }
-
-       RULES
+#endif
 
        return XDP_PASS;
 }