bpf: add bpf_xdp_adjust_tail sample prog

adding bpf's sample program which is using bpf_xdp_adjust_tail helper
by generating ICMPv4 "packet to big" message if ingress packet's size is
bigger then 600 bytes

Signed-off-by: Nikita V. Shirokov <tehnerd@tehnerd.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
index 4d6a6edd4bf6e9200f5be30c7c78ff0e26854731..aa8c392e2e52271017ad9056aaf340932b613c6c 100644 (file)
--- a/samples/bpf/Makefile
+++ b/samples/bpf/Makefile
@@ -44,6 +44,7 @@ hostprogs-y += xdp_monitor
 hostprogs-y += xdp_rxq_info
 hostprogs-y += syscall_tp
 hostprogs-y += cpustat
+hostprogs-y += xdp_adjust_tail
 
 # Libbpf dependencies
 LIBBPF := ../../tools/lib/bpf/bpf.o ../../tools/lib/bpf/nlattr.o
@@ -95,6 +96,7 @@ xdp_monitor-objs := bpf_load.o $(LIBBPF) xdp_monitor_user.o
 xdp_rxq_info-objs := bpf_load.o $(LIBBPF) xdp_rxq_info_user.o
 syscall_tp-objs := bpf_load.o $(LIBBPF) syscall_tp_user.o
 cpustat-objs := bpf_load.o $(LIBBPF) cpustat_user.o
+xdp_adjust_tail-objs := bpf_load.o $(LIBBPF) xdp_adjust_tail_user.o
 
 # Tell kbuild to always build the programs
 always := $(hostprogs-y)
@@ -148,6 +150,7 @@ always += xdp_rxq_info_kern.o
 always += xdp2skb_meta_kern.o
 always += syscall_tp_kern.o
 always += cpustat_kern.o
+always += xdp_adjust_tail_kern.o
 
 HOSTCFLAGS += -I$(objtree)/usr/include
 HOSTCFLAGS += -I$(srctree)/tools/lib/
@@ -193,6 +196,7 @@ HOSTLOADLIBES_xdp_monitor += -lelf
 HOSTLOADLIBES_xdp_rxq_info += -lelf
 HOSTLOADLIBES_syscall_tp += -lelf
 HOSTLOADLIBES_cpustat += -lelf
+HOSTLOADLIBES_xdp_adjust_tail += -lelf
 
 # Allows pointing LLC/CLANG to a LLVM backend with bpf support, redefine on cmdline:
 #  make samples/bpf/ LLC=~/git/llvm/build/bin/llc CLANG=~/git/llvm/build/bin/clang

diff --git a/samples/bpf/xdp_adjust_tail_kern.c b/samples/bpf/xdp_adjust_tail_kern.c
new file mode 100644 (file)
index 0000000..411fdb2
--- /dev/null
+++ b/samples/bpf/xdp_adjust_tail_kern.c
@@ -0,0 +1,152 @@
+/* SPDX-License-Identifier: GPL-2.0
+ * Copyright (c) 2018 Facebook
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program shows how to use bpf_xdp_adjust_tail() by
+ * generating ICMPv4 "packet to big" (unreachable/ df bit set frag needed
+ * to be more preice in case of v4)" where receiving packets bigger then
+ * 600 bytes.
+ */
+#define KBUILD_MODNAME "foo"
+#include <uapi/linux/bpf.h>
+#include <linux/in.h>
+#include <linux/if_ether.h>
+#include <linux/if_packet.h>
+#include <linux/if_vlan.h>
+#include <linux/ip.h>
+#include <linux/icmp.h>
+#include "bpf_helpers.h"
+
+#define DEFAULT_TTL 64
+#define MAX_PCKT_SIZE 600
+#define ICMP_TOOBIG_SIZE 98
+#define ICMP_TOOBIG_PAYLOAD_SIZE 92
+
+struct bpf_map_def SEC("maps") icmpcnt = {
+       .type = BPF_MAP_TYPE_ARRAY,
+       .key_size = sizeof(__u32),
+       .value_size = sizeof(__u64),
+       .max_entries = 1,
+};
+
+static __always_inline void count_icmp(void)
+{
+       u64 key = 0;
+       u64 *icmp_count;
+
+       icmp_count = bpf_map_lookup_elem(&icmpcnt, &key);
+       if (icmp_count)
+               *icmp_count += 1;
+}
+
+static __always_inline void swap_mac(void *data, struct ethhdr *orig_eth)
+{
+       struct ethhdr *eth;
+
+       eth = data;
+       memcpy(eth->h_source, orig_eth->h_dest, ETH_ALEN);
+       memcpy(eth->h_dest, orig_eth->h_source, ETH_ALEN);
+       eth->h_proto = orig_eth->h_proto;
+}
+
+static __always_inline __u16 csum_fold_helper(__u32 csum)
+{
+       return ~((csum & 0xffff) + (csum >> 16));
+}
+
+static __always_inline void ipv4_csum(void *data_start, int data_size,
+                                     __u32 *csum)
+{
+       *csum = bpf_csum_diff(0, 0, data_start, data_size, *csum);
+       *csum = csum_fold_helper(*csum);
+}
+
+static __always_inline int send_icmp4_too_big(struct xdp_md *xdp)
+{
+       int headroom = (int)sizeof(struct iphdr) + (int)sizeof(struct icmphdr);
+
+       if (bpf_xdp_adjust_head(xdp, 0 - headroom))
+               return XDP_DROP;
+       void *data = (void *)(long)xdp->data;
+       void *data_end = (void *)(long)xdp->data_end;
+
+       if (data + (ICMP_TOOBIG_SIZE + headroom) > data_end)
+               return XDP_DROP;
+
+       struct iphdr *iph, *orig_iph;
+       struct icmphdr *icmp_hdr;
+       struct ethhdr *orig_eth;
+       __u32 csum = 0;
+       __u64 off = 0;
+
+       orig_eth = data + headroom;
+       swap_mac(data, orig_eth);
+       off += sizeof(struct ethhdr);
+       iph = data + off;
+       off += sizeof(struct iphdr);
+       icmp_hdr = data + off;
+       off += sizeof(struct icmphdr);
+       orig_iph = data + off;
+       icmp_hdr->type = ICMP_DEST_UNREACH;
+       icmp_hdr->code = ICMP_FRAG_NEEDED;
+       icmp_hdr->un.frag.mtu = htons(MAX_PCKT_SIZE-sizeof(struct ethhdr));
+       icmp_hdr->checksum = 0;
+       ipv4_csum(icmp_hdr, ICMP_TOOBIG_PAYLOAD_SIZE, &csum);
+       icmp_hdr->checksum = csum;
+       iph->ttl = DEFAULT_TTL;
+       iph->daddr = orig_iph->saddr;
+       iph->saddr = orig_iph->daddr;
+       iph->version = 4;
+       iph->ihl = 5;
+       iph->protocol = IPPROTO_ICMP;
+       iph->tos = 0;
+       iph->tot_len = htons(
+               ICMP_TOOBIG_SIZE + headroom - sizeof(struct ethhdr));
+       iph->check = 0;
+       csum = 0;
+       ipv4_csum(iph, sizeof(struct iphdr), &csum);
+       iph->check = csum;
+       count_icmp();
+       return XDP_TX;
+}
+
+
+static __always_inline int handle_ipv4(struct xdp_md *xdp)
+{
+       void *data_end = (void *)(long)xdp->data_end;
+       void *data = (void *)(long)xdp->data;
+       int pckt_size = data_end - data;
+       int offset;
+
+       if (pckt_size > MAX_PCKT_SIZE) {
+               offset = pckt_size - ICMP_TOOBIG_SIZE;
+               if (bpf_xdp_adjust_tail(xdp, 0 - offset))
+                       return XDP_PASS;
+               return send_icmp4_too_big(xdp);
+       }
+       return XDP_PASS;
+}
+
+SEC("xdp_icmp")
+int _xdp_icmp(struct xdp_md *xdp)
+{
+       void *data_end = (void *)(long)xdp->data_end;
+       void *data = (void *)(long)xdp->data;
+       struct ethhdr *eth = data;
+       __u16 h_proto;
+
+       if (eth + 1 > data_end)
+               return XDP_DROP;
+
+       h_proto = eth->h_proto;
+
+       if (h_proto == htons(ETH_P_IP))
+               return handle_ipv4(xdp);
+       else
+               return XDP_PASS;
+}
+
+char _license[] SEC("license") = "GPL";

diff --git a/samples/bpf/xdp_adjust_tail_user.c b/samples/bpf/xdp_adjust_tail_user.c
new file mode 100644 (file)
index 0000000..f621a54
--- /dev/null
+++ b/samples/bpf/xdp_adjust_tail_user.c
@@ -0,0 +1,142 @@
+/* SPDX-License-Identifier: GPL-2.0
+ * Copyright (c) 2018 Facebook
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ */
+#include <linux/bpf.h>
+#include <linux/if_link.h>
+#include <assert.h>
+#include <errno.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/resource.h>
+#include <arpa/inet.h>
+#include <netinet/ether.h>
+#include <unistd.h>
+#include <time.h>
+#include "bpf_load.h"
+#include "libbpf.h"
+#include "bpf_util.h"
+
+#define STATS_INTERVAL_S 2U
+
+static int ifindex = -1;
+static __u32 xdp_flags;
+
+static void int_exit(int sig)
+{
+       if (ifindex > -1)
+               bpf_set_link_xdp_fd(ifindex, -1, xdp_flags);
+       exit(0);
+}
+
+/* simple "icmp packet too big sent" counter
+ */
+static void poll_stats(unsigned int kill_after_s)
+{
+       time_t started_at = time(NULL);
+       __u64 value = 0;
+       int key = 0;
+
+
+       while (!kill_after_s || time(NULL) - started_at <= kill_after_s) {
+               sleep(STATS_INTERVAL_S);
+
+               assert(bpf_map_lookup_elem(map_fd[0], &key, &value) == 0);
+
+               printf("icmp \"packet too big\" sent: %10llu pkts\n", value);
+       }
+}
+
+static void usage(const char *cmd)
+{
+       printf("Start a XDP prog which send ICMP \"packet too big\" \n"
+               "messages if ingress packet is bigger then MAX_SIZE bytes\n");
+       printf("Usage: %s [...]\n", cmd);
+       printf("    -i <ifindex> Interface Index\n");
+       printf("    -T <stop-after-X-seconds> Default: 0 (forever)\n");
+       printf("    -S use skb-mode\n");
+       printf("    -N enforce native mode\n");
+       printf("    -h Display this help\n");
+}
+
+int main(int argc, char **argv)
+{
+       unsigned char opt_flags[256] = {};
+       unsigned int kill_after_s = 0;
+       const char *optstr = "i:T:SNh";
+       struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
+       char filename[256];
+       int opt;
+       int i;
+
+
+       for (i = 0; i < strlen(optstr); i++)
+               if (optstr[i] != 'h' && 'a' <= optstr[i] && optstr[i] <= 'z')
+                       opt_flags[(unsigned char)optstr[i]] = 1;
+
+       while ((opt = getopt(argc, argv, optstr)) != -1) {
+
+               switch (opt) {
+               case 'i':
+                       ifindex = atoi(optarg);
+                       break;
+               case 'T':
+                       kill_after_s = atoi(optarg);
+                       break;
+               case 'S':
+                       xdp_flags |= XDP_FLAGS_SKB_MODE;
+                       break;
+               case 'N':
+                       xdp_flags |= XDP_FLAGS_DRV_MODE;
+                       break;
+               default:
+                       usage(argv[0]);
+                       return 1;
+               }
+               opt_flags[opt] = 0;
+       }
+
+       for (i = 0; i < strlen(optstr); i++) {
+               if (opt_flags[(unsigned int)optstr[i]]) {
+                       fprintf(stderr, "Missing argument -%c\n", optstr[i]);
+                       usage(argv[0]);
+                       return 1;
+               }
+       }
+
+       if (setrlimit(RLIMIT_MEMLOCK, &r)) {
+               perror("setrlimit(RLIMIT_MEMLOCK, RLIM_INFINITY)");
+               return 1;
+       }
+
+       snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
+
+       if (load_bpf_file(filename)) {
+               printf("%s", bpf_log_buf);
+               return 1;
+       }
+
+       if (!prog_fd[0]) {
+               printf("load_bpf_file: %s\n", strerror(errno));
+               return 1;
+       }
+
+       signal(SIGINT, int_exit);
+       signal(SIGTERM, int_exit);
+
+       if (bpf_set_link_xdp_fd(ifindex, prog_fd[0], xdp_flags) < 0) {
+               printf("link set xdp fd failed\n");
+               return 1;
+       }
+
+       poll_stats(kill_after_s);
+
+       bpf_set_link_xdp_fd(ifindex, -1, xdp_flags);
+
+       return 0;
+}

diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h
index 50c607014b22163e3cd9fa0ffb9a81ab3d610f4a..9271576bdc8f26410a1df1a5ab679dd5cab768d8 100644 (file)
--- a/tools/testing/selftests/bpf/bpf_helpers.h
+++ b/tools/testing/selftests/bpf/bpf_helpers.h
@@ -132,6 +132,8 @@ static int (*bpf_l3_csum_replace)(void *ctx, int off, int from, int to, int flag
        (void *) BPF_FUNC_l3_csum_replace;
 static int (*bpf_l4_csum_replace)(void *ctx, int off, int from, int to, int flags) =
        (void *) BPF_FUNC_l4_csum_replace;
+static int (*bpf_csum_diff)(void *from, int from_size, void *to, int to_size, int seed) =
+       (void *) BPF_FUNC_csum_diff;
 static int (*bpf_skb_under_cgroup)(void *ctx, void *map, int index) =
        (void *) BPF_FUNC_skb_under_cgroup;
 static int (*bpf_skb_change_head)(void *, int len, int flags) =