summaryrefslogtreecommitdiff
path: root/bpf
diff options
context:
space:
mode:
authorsinanmohd <sinan@sinanmohd.com>2024-07-08 06:05:08 +0530
committersinanmohd <sinan@sinanmohd.com>2024-07-08 06:05:08 +0530
commitd08ae9402429bfca69d72c7a7d99975aa356539f (patch)
treebb4d4d4ddc28030ab419eb4ce3377c3d0426af9e /bpf
parent3da7837e2e51763b00b2f7af80973b2d5d61933d (diff)
bpf/filter: init
Diffstat (limited to 'bpf')
-rw-r--r--bpf/filter/bpf.c82
-rw-r--r--bpf/filter/bpf_bpfel.go119
-rw-r--r--bpf/filter/bpf_bpfel.obin0 -> 3728 bytes
-rw-r--r--bpf/filter/gen.go3
-rw-r--r--bpf/filter/main.go95
5 files changed, 299 insertions, 0 deletions
diff --git a/bpf/filter/bpf.c b/bpf/filter/bpf.c
new file mode 100644
index 0000000..ae62cb8
--- /dev/null
+++ b/bpf/filter/bpf.c
@@ -0,0 +1,82 @@
+#include <linux/bpf.h>
+#include <linux/if_ether.h>
+#include <linux/ip.h>
+
+#include <bpf/bpf_endian.h>
+#include <bpf/bpf_helpers.h>
+
+#define MAX_MAP_ENTRIES 4096
+
+char __license[] SEC("license") = "GPL";
+
+struct {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __uint(max_entries, MAX_MAP_ENTRIES);
+ __type(key, __u64); // blocked mac address
+ // i just like her for the o(1) key lookup
+ // we don't care about the value
+ __type(value, __u16);
+} mac_blacklist_map SEC(".maps");
+
+static __always_inline __u64 nchar6_to_u64(unsigned char bytes[6])
+{
+ union {
+ char bytes[6];
+ __u64 i;
+ } ret;
+
+ ret.i = 0;
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+ ret.bytes[0] = bytes[5];
+ ret.bytes[1] = bytes[4];
+ ret.bytes[2] = bytes[3];
+ ret.bytes[3] = bytes[2];
+ ret.bytes[4] = bytes[1];
+ ret.bytes[5] = bytes[0];
+#elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+ ret.bytes[0] = bytes[0];
+ ret.bytes[1] = bytes[1];
+ ret.bytes[2] = bytes[2];
+ ret.bytes[3] = bytes[3];
+ ret.bytes[4] = bytes[4];
+ ret.bytes[5] = bytes[5];
+#endif
+
+ return ret.i;
+}
+
+static __always_inline int mac_src_parse(struct xdp_md *ctx, __u64 *mac)
+{
+ __u64 len, *usage;
+
+ void *data_end = (void *)(long)ctx->data_end;
+ struct ethhdr *eth = (void *)(long)ctx->data;
+
+ if ((void *) (eth + 1) > data_end)
+ return -1;
+
+ if (eth->h_proto != bpf_htons(ETH_P_IP) &&
+ eth->h_proto != bpf_htons(ETH_P_IPV6)) {
+ return -1;
+ }
+
+ *mac = nchar6_to_u64(eth->h_source);
+ return 0;
+}
+
+SEC("xdp")
+int mac_filter(struct xdp_md *ctx)
+{
+ __u64 mac;
+ int ret, *blocked;
+
+ ret = mac_src_parse(ctx, &mac);
+ if (ret < 0)
+ return XDP_PASS;
+
+ blocked = bpf_map_lookup_elem(&mac_blacklist_map, &mac);
+ if (blocked)
+ return XDP_DROP;
+
+ return XDP_PASS;
+}
diff --git a/bpf/filter/bpf_bpfel.go b/bpf/filter/bpf_bpfel.go
new file mode 100644
index 0000000..53ec23f
--- /dev/null
+++ b/bpf/filter/bpf_bpfel.go
@@ -0,0 +1,119 @@
+// Code generated by bpf2go; DO NOT EDIT.
+//go:build 386 || amd64 || arm || arm64 || loong64 || mips64le || mipsle || ppc64le || riscv64
+
+package filter
+
+import (
+ "bytes"
+ _ "embed"
+ "fmt"
+ "io"
+
+ "github.com/cilium/ebpf"
+)
+
+// loadBpf returns the embedded CollectionSpec for bpf.
+func loadBpf() (*ebpf.CollectionSpec, error) {
+ reader := bytes.NewReader(_BpfBytes)
+ spec, err := ebpf.LoadCollectionSpecFromReader(reader)
+ if err != nil {
+ return nil, fmt.Errorf("can't load bpf: %w", err)
+ }
+
+ return spec, err
+}
+
+// loadBpfObjects loads bpf and converts it into a struct.
+//
+// The following types are suitable as obj argument:
+//
+// *bpfObjects
+// *bpfPrograms
+// *bpfMaps
+//
+// See ebpf.CollectionSpec.LoadAndAssign documentation for details.
+func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error {
+ spec, err := loadBpf()
+ if err != nil {
+ return err
+ }
+
+ return spec.LoadAndAssign(obj, opts)
+}
+
+// bpfSpecs contains maps and programs before they are loaded into the kernel.
+//
+// It can be passed ebpf.CollectionSpec.Assign.
+type bpfSpecs struct {
+ bpfProgramSpecs
+ bpfMapSpecs
+}
+
+// bpfSpecs contains programs before they are loaded into the kernel.
+//
+// It can be passed ebpf.CollectionSpec.Assign.
+type bpfProgramSpecs struct {
+ MacFilter *ebpf.ProgramSpec `ebpf:"mac_filter"`
+}
+
+// bpfMapSpecs contains maps before they are loaded into the kernel.
+//
+// It can be passed ebpf.CollectionSpec.Assign.
+type bpfMapSpecs struct {
+ MacBlacklistMap *ebpf.MapSpec `ebpf:"mac_blacklist_map"`
+}
+
+// bpfObjects contains all objects after they have been loaded into the kernel.
+//
+// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
+type bpfObjects struct {
+ bpfPrograms
+ bpfMaps
+}
+
+func (o *bpfObjects) Close() error {
+ return _BpfClose(
+ &o.bpfPrograms,
+ &o.bpfMaps,
+ )
+}
+
+// bpfMaps contains all maps after they have been loaded into the kernel.
+//
+// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
+type bpfMaps struct {
+ MacBlacklistMap *ebpf.Map `ebpf:"mac_blacklist_map"`
+}
+
+func (m *bpfMaps) Close() error {
+ return _BpfClose(
+ m.MacBlacklistMap,
+ )
+}
+
+// bpfPrograms contains all programs after they have been loaded into the kernel.
+//
+// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
+type bpfPrograms struct {
+ MacFilter *ebpf.Program `ebpf:"mac_filter"`
+}
+
+func (p *bpfPrograms) Close() error {
+ return _BpfClose(
+ p.MacFilter,
+ )
+}
+
+func _BpfClose(closers ...io.Closer) error {
+ for _, closer := range closers {
+ if err := closer.Close(); err != nil {
+ return err
+ }
+ }
+ return nil
+}
+
+// Do not access this directly.
+//
+//go:embed bpf_bpfel.o
+var _BpfBytes []byte
diff --git a/bpf/filter/bpf_bpfel.o b/bpf/filter/bpf_bpfel.o
new file mode 100644
index 0000000..2167b99
--- /dev/null
+++ b/bpf/filter/bpf_bpfel.o
Binary files differ
diff --git a/bpf/filter/gen.go b/bpf/filter/gen.go
new file mode 100644
index 0000000..d70c549
--- /dev/null
+++ b/bpf/filter/gen.go
@@ -0,0 +1,3 @@
+package filter
+
+//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -target bpfel bpf bpf.c
diff --git a/bpf/filter/main.go b/bpf/filter/main.go
new file mode 100644
index 0000000..4df312c
--- /dev/null
+++ b/bpf/filter/main.go
@@ -0,0 +1,95 @@
+package filter
+
+import (
+ "context"
+ "fmt"
+ "log"
+ "net"
+
+ "github.com/cilium/ebpf/link"
+ "sinanmohd.com/redq/db"
+)
+
+type Filter struct {
+ ctxDb context.Context
+ queries *db.Queries
+ objs bpfObjects
+ xdpLink link.Link
+}
+
+func Close(f *Filter) {
+ f.objs.Close()
+ f.xdpLink.Close()
+}
+
+func New(iface *net.Interface, queries *db.Queries, ctxDb context.Context) (*Filter, error) {
+ var err error
+ var f Filter
+
+ if err := loadBpfObjects(&f.objs, nil); err != nil {
+ log.Printf("loading objects: %s", err)
+ return nil, err
+ }
+ defer func() {
+ if err != nil {
+ f.objs.Close()
+ }
+ }()
+
+ f.xdpLink, err = link.AttachXDP(link.XDPOptions{
+ Interface: iface.Index,
+ Program: f.objs.MacFilter,
+ })
+ if err != nil {
+ log.Printf("could not attach TCx program: %s", err)
+ return nil, err
+ }
+ defer func() {
+ if err != nil {
+ f.xdpLink.Close()
+ }
+ }()
+
+ blackList, err := queries.GetMacBlackList(ctxDb)
+ zeros := make([]uint16, len(blackList))
+ _, err = f.objs.bpfMaps.MacBlacklistMap.BatchUpdate(blackList[:], zeros, nil)
+ if err != nil {
+ log.Printf("loading mac blacklist: %s", err)
+ return nil, err
+ }
+
+ f.queries = queries
+ return &f, nil
+}
+
+func (f *Filter) Block(mac uint64) error {
+ err := f.queries.EnterMacBlackList(f.ctxDb, int64(mac))
+ if err != nil {
+ log.Printf("adding mac blacklist: %s", err)
+ return err
+ }
+
+ err = f.objs.bpfMaps.MacBlacklistMap.Put(mac, true)
+ if err != nil {
+ log.Printf("adding mac blacklist: %s", err)
+ return err
+ }
+
+ return nil
+}
+
+func (f *Filter) Unblock(mac uint64) error {
+ err := f.queries.DeleteDnsBlackList(f.ctxDb, fmt.Sprintf("%v", mac))
+ if err != nil {
+ log.Printf("adding mac blacklist: %s", err)
+ return err
+ }
+
+ err = f.objs.bpfMaps.MacBlacklistMap.Delete(mac)
+ if err != nil {
+ log.Printf("adding mac blacklist: %s", err)
+ return err
+ }
+
+ return nil
+}