diff options
Diffstat (limited to 'bpf')
-rw-r--r-- | bpf/filter/bpf.c | 82 | ||||
-rw-r--r-- | bpf/filter/bpf_bpfel.go | 119 | ||||
-rw-r--r-- | bpf/filter/bpf_bpfel.o | bin | 0 -> 3728 bytes | |||
-rw-r--r-- | bpf/filter/gen.go | 3 | ||||
-rw-r--r-- | bpf/filter/main.go | 95 |
5 files changed, 299 insertions, 0 deletions
diff --git a/bpf/filter/bpf.c b/bpf/filter/bpf.c new file mode 100644 index 0000000..ae62cb8 --- /dev/null +++ b/bpf/filter/bpf.c @@ -0,0 +1,82 @@ +#include <linux/bpf.h> +#include <linux/if_ether.h> +#include <linux/ip.h> + +#include <bpf/bpf_endian.h> +#include <bpf/bpf_helpers.h> + +#define MAX_MAP_ENTRIES 4096 + +char __license[] SEC("license") = "GPL"; + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(max_entries, MAX_MAP_ENTRIES); + __type(key, __u64); // blocked mac address + // i just like her for the o(1) key lookup + // we don't care about the value + __type(value, __u16); +} mac_blacklist_map SEC(".maps"); + +static __always_inline __u64 nchar6_to_u64(unsigned char bytes[6]) +{ + union { + char bytes[6]; + __u64 i; + } ret; + + ret.i = 0; +#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ + ret.bytes[0] = bytes[5]; + ret.bytes[1] = bytes[4]; + ret.bytes[2] = bytes[3]; + ret.bytes[3] = bytes[2]; + ret.bytes[4] = bytes[1]; + ret.bytes[5] = bytes[0]; +#elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ + ret.bytes[0] = bytes[0]; + ret.bytes[1] = bytes[1]; + ret.bytes[2] = bytes[2]; + ret.bytes[3] = bytes[3]; + ret.bytes[4] = bytes[4]; + ret.bytes[5] = bytes[5]; +#endif + + return ret.i; +} + +static __always_inline int mac_src_parse(struct xdp_md *ctx, __u64 *mac) +{ + __u64 len, *usage; + + void *data_end = (void *)(long)ctx->data_end; + struct ethhdr *eth = (void *)(long)ctx->data; + + if ((void *) (eth + 1) > data_end) + return -1; + + if (eth->h_proto != bpf_htons(ETH_P_IP) && + eth->h_proto != bpf_htons(ETH_P_IPV6)) { + return -1; + } + + *mac = nchar6_to_u64(eth->h_source); + return 0; +} + +SEC("xdp") +int mac_filter(struct xdp_md *ctx) +{ + __u64 mac; + int ret, *blocked; + + ret = mac_src_parse(ctx, &mac); + if (ret < 0) + return XDP_PASS; + + blocked = bpf_map_lookup_elem(&mac_blacklist_map, &mac); + if (blocked) + return XDP_DROP; + + return XDP_PASS; +} diff --git a/bpf/filter/bpf_bpfel.go b/bpf/filter/bpf_bpfel.go new file mode 100644 index 0000000..53ec23f --- /dev/null +++ b/bpf/filter/bpf_bpfel.go @@ -0,0 +1,119 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build 386 || amd64 || arm || arm64 || loong64 || mips64le || mipsle || ppc64le || riscv64 + +package filter + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + MacFilter *ebpf.ProgramSpec `ebpf:"mac_filter"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { + MacBlacklistMap *ebpf.MapSpec `ebpf:"mac_blacklist_map"` +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { + MacBlacklistMap *ebpf.Map `ebpf:"mac_blacklist_map"` +} + +func (m *bpfMaps) Close() error { + return _BpfClose( + m.MacBlacklistMap, + ) +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + MacFilter *ebpf.Program `ebpf:"mac_filter"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.MacFilter, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfel.o +var _BpfBytes []byte diff --git a/bpf/filter/bpf_bpfel.o b/bpf/filter/bpf_bpfel.o Binary files differnew file mode 100644 index 0000000..2167b99 --- /dev/null +++ b/bpf/filter/bpf_bpfel.o diff --git a/bpf/filter/gen.go b/bpf/filter/gen.go new file mode 100644 index 0000000..d70c549 --- /dev/null +++ b/bpf/filter/gen.go @@ -0,0 +1,3 @@ +package filter + +//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -target bpfel bpf bpf.c diff --git a/bpf/filter/main.go b/bpf/filter/main.go new file mode 100644 index 0000000..4df312c --- /dev/null +++ b/bpf/filter/main.go @@ -0,0 +1,95 @@ +package filter + +import ( + "context" + "fmt" + "log" + "net" + + "github.com/cilium/ebpf/link" + "sinanmohd.com/redq/db" +) + +type Filter struct { + ctxDb context.Context + queries *db.Queries + objs bpfObjects + xdpLink link.Link +} + +func Close(f *Filter) { + f.objs.Close() + f.xdpLink.Close() +} + +func New(iface *net.Interface, queries *db.Queries, ctxDb context.Context) (*Filter, error) { + var err error + var f Filter + + if err := loadBpfObjects(&f.objs, nil); err != nil { + log.Printf("loading objects: %s", err) + return nil, err + } + defer func() { + if err != nil { + f.objs.Close() + } + }() + + f.xdpLink, err = link.AttachXDP(link.XDPOptions{ + Interface: iface.Index, + Program: f.objs.MacFilter, + }) + if err != nil { + log.Printf("could not attach TCx program: %s", err) + return nil, err + } + defer func() { + if err != nil { + f.xdpLink.Close() + } + }() + + blackList, err := queries.GetMacBlackList(ctxDb) + zeros := make([]uint16, len(blackList)) + _, err = f.objs.bpfMaps.MacBlacklistMap.BatchUpdate(blackList[:], zeros, nil) + if err != nil { + log.Printf("loading mac blacklist: %s", err) + return nil, err + } + + f.queries = queries + return &f, nil +} + +func (f *Filter) Block(mac uint64) error { + err := f.queries.EnterMacBlackList(f.ctxDb, int64(mac)) + if err != nil { + log.Printf("adding mac blacklist: %s", err) + return err + } + + err = f.objs.bpfMaps.MacBlacklistMap.Put(mac, true) + if err != nil { + log.Printf("adding mac blacklist: %s", err) + return err + } + + return nil +} + +func (f *Filter) Unblock(mac uint64) error { + err := f.queries.DeleteDnsBlackList(f.ctxDb, fmt.Sprintf("%v", mac)) + if err != nil { + log.Printf("adding mac blacklist: %s", err) + return err + } + + err = f.objs.bpfMaps.MacBlacklistMap.Delete(mac) + if err != nil { + log.Printf("adding mac blacklist: %s", err) + return err + } + + return nil +} |