Skip to content
This repository has been archived by the owner on Apr 28, 2024. It is now read-only.

backported fix for matched map from zfw #110

Merged
merged 1 commit into from
Feb 23, 2024
Merged

backported fix for matched map from zfw #110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/map_update.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ static char *prefix_interface;
static char *tc_interface;
static char *object_file;
static char *direction_string;
const char *argp_program_version = "0.2.7";
const char *argp_program_version = "0.2.8";

static __u8 if_list[MAX_IF_LIST_ENTRIES];
int ifcount = 0;
Expand Down
51 changes: 31 additions & 20 deletions src/tproxy_splicer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,14 @@ struct match_tracker {
struct tproxy_key matched_keys[MATCHED_KEY_DEPTH];
};


/*key to matched_map*/
struct match_key {
__u32 saddr;
__u32 daddr;
__u16 sport;
__u16 dport;
__u32 ifindex;
};

/*value to ifindex_ip_map*/
struct ifindex_ip4 {
Expand Down Expand Up @@ -153,11 +160,10 @@ then used to search for port mappings. This was required when source filtering
added to accommodate the additional intructions per ebpf program. The search now spans
5 ebpf programs */
struct {
__uint(type, BPF_MAP_TYPE_ARRAY);
__uint(id, BPF_MAP_ID_MATCHED_KEY);
__uint(key_size, sizeof(unsigned int));
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__uint(key_size, sizeof(struct match_key));
__uint(value_size, sizeof(struct match_tracker));
__uint(max_entries, MATCHED_INT_DEPTH);
__uint(max_entries, 65535);
__uint(pinning, LIBBPF_PIN_BY_NAME);
} matched_map SEC(".maps");

Expand Down Expand Up @@ -304,19 +310,19 @@ future use*/
}*/

/*function to update the matched_map locally from ebpf*/
static inline void insert_matched_key(struct match_tracker matched_keys, unsigned int key){
static inline void insert_matched_key(struct match_tracker matched_keys, struct match_key key){
bpf_map_update_elem(&matched_map, &key, &matched_keys,0);
}

/*Function to get stored matched tracker*/
static inline struct match_tracker *get_matched_keys(unsigned int key){
static inline struct match_tracker *get_matched_keys(struct match_key key){
struct match_tracker *mt;
mt = bpf_map_lookup_elem(&matched_map, &key);
return mt;
}

/*Function to get stored matched key count*/
static inline __u16 get_matched_count(unsigned key){
static inline __u16 get_matched_count(struct match_key key){
struct match_tracker *mt;
__u16 mc = 0;
mt = bpf_map_lookup_elem(&matched_map,&key);
Expand All @@ -327,9 +333,8 @@ static inline __u16 get_matched_count(unsigned key){
}

/*Function to clear matched tracker*/
static inline void clear_match_tracker(__u32 key){
struct match_tracker mt = {0};
bpf_map_update_elem(&matched_map, &key, &mt,0);
static inline void clear_match_tracker(struct match_key key){
bpf_map_delete_elem(&matched_map, &key);
}

/* function to determine if an incomming packet is a udp/tcp IP tuple
Expand Down Expand Up @@ -710,7 +715,8 @@ int bpf_sk_splice(struct __sk_buff *skb){
}
}
//init the match_count_map
clear_match_tracker(skb->ifindex);
struct match_key mkey = {tuple->ipv4.saddr, tuple->ipv4.daddr, tuple->ipv4.sport, tuple->ipv4.dport, skb->ifindex};
clear_match_tracker(mkey);
bpf_tail_call(skb, &prog_map, 1);
if(skb->ingress_ifindex == 1){
return TC_ACT_OK;
Expand Down Expand Up @@ -763,9 +769,10 @@ int bpf_sk_splice1(struct __sk_buff *skb){
__u16 smaxlen = 32; /* max number ip ipv4 prefixes */
/*Main loop to lookup tproxy prefix matches in the zt_tproxy_map*/
struct match_tracker key_tracker = {0,{}};
insert_matched_key(key_tracker, skb->ifindex);
struct match_tracker *tracked_key_data = get_matched_keys(skb->ifindex);
if(!tracked_key_data){
struct match_key mkey = {tuple->ipv4.saddr, tuple->ipv4.daddr, tuple->ipv4.sport, tuple->ipv4.dport, skb->ifindex};
insert_matched_key(key_tracker, mkey);
struct match_tracker *tracked_key_data = get_matched_keys(mkey);
if(!tracked_key_data){
return TC_ACT_SHOT;
}
for (__u16 dcount = 0;dcount <= maxlen; dcount++){
Expand Down Expand Up @@ -835,7 +842,8 @@ int bpf_sk_splice2(struct __sk_buff *skb){
__u16 maxlen = 8; /* max number ip ipv4 prefixes */
__u16 smaxlen = 32; /* max number ip ipv4 prefixes */
/*Main loop to lookup tproxy prefix matches in the zt_tproxy_map*/
struct match_tracker *tracked_key_data = get_matched_keys(skb->ifindex);
struct match_key mkey = {tuple->ipv4.saddr, tuple->ipv4.daddr, tuple->ipv4.sport, tuple->ipv4.dport, skb->ifindex};
struct match_tracker *tracked_key_data = get_matched_keys(mkey);
if(!tracked_key_data){
return TC_ACT_SHOT;
}
Expand Down Expand Up @@ -907,7 +915,8 @@ int bpf_sk_splice3(struct __sk_buff *skb){
__u16 maxlen = 8; /* max number ip ipv4 prefixes */
__u16 smaxlen = 32; /* max number ip ipv4 prefixes */
/*Main loop to lookup tproxy prefix matches in the zt_tproxy_map*/
struct match_tracker *tracked_key_data = get_matched_keys(skb->ifindex);
struct match_key mkey = {tuple->ipv4.saddr, tuple->ipv4.daddr, tuple->ipv4.sport, tuple->ipv4.dport, skb->ifindex};
struct match_tracker *tracked_key_data = get_matched_keys(mkey);
if(!tracked_key_data){
return TC_ACT_SHOT;
}
Expand Down Expand Up @@ -978,7 +987,8 @@ int bpf_sk_splice4(struct __sk_buff *skb){
__u16 maxlen = 8; /* max number ip ipv4 prefixes */
__u16 smaxlen = 32; /* max number ip ipv4 prefixes */
/*Main loop to lookup tproxy prefix matches in the zt_tproxy_map*/
struct match_tracker *tracked_key_data = get_matched_keys(skb->ifindex);
struct match_key mkey = {tuple->ipv4.saddr, tuple->ipv4.daddr, tuple->ipv4.sport, tuple->ipv4.dport, skb->ifindex};
struct match_tracker *tracked_key_data = get_matched_keys(mkey);
if(!tracked_key_data){
return TC_ACT_SHOT;
}
Expand Down Expand Up @@ -1062,12 +1072,13 @@ int bpf_sk_splice5(struct __sk_buff *skb){
}
struct tproxy_tuple *tproxy;
struct match_tracker *key_tracker;
__u16 match_count = get_matched_count(skb->ifindex);
struct match_key mkey = {tuple->ipv4.saddr, tuple->ipv4.daddr, tuple->ipv4.sport, tuple->ipv4.dport, skb->ifindex};
__u16 match_count = get_matched_count(mkey);
if (match_count > MATCHED_KEY_DEPTH){
match_count = MATCHED_KEY_DEPTH;
}
for(__u16 count =0; count < match_count; count++){
key_tracker = get_matched_keys(skb->ifindex);
key_tracker = get_matched_keys(mkey);
if(key_tracker){
key = key_tracker->matched_keys[count];
}else{
Expand Down
Loading