mirror of https://github.com/OISF/suricata
af-packet: kernel bypass implementation
This patch implements bypass capability for af-packet. The filter only bypass TCP and UDP in IPv4 and IPv6. It don't don't bypass IPv6 with extended headers. This patch also introduces a bypassed flow manager that takes care of timeouting the bypassed flows. It uses a 60 sec timeout on flow. As they are supposed to be active we can try that. If they are not active then we don't care to get them back in Suricata.pull/3221/head
Eric Leblond
7 years ago
parent
91e1256b01
commit
06173267c6
@ -0,0 +1,193 @@
|
||||
//#include <bcc/proto.h>
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
#include <linux/bpf.h>
|
||||
|
||||
#include <linux/if_ether.h>
|
||||
#include <linux/in.h>
|
||||
#include <linux/ip.h>
|
||||
#include <linux/in6.h>
|
||||
#include <linux/ipv6.h>
|
||||
#include <linux/filter.h>
|
||||
|
||||
#include "bpf_helpers.h"
|
||||
|
||||
#define LINUX_VERSION_CODE 263682
|
||||
|
||||
struct flowv4_keys {
|
||||
__be32 src;
|
||||
__be32 dst;
|
||||
union {
|
||||
__be32 ports;
|
||||
__be16 port16[2];
|
||||
};
|
||||
__u32 ip_proto;
|
||||
} __attribute__((__aligned__(8)));
|
||||
|
||||
struct flowv6_keys {
|
||||
__be32 src[4];
|
||||
__be32 dst[4];
|
||||
union {
|
||||
__be32 ports;
|
||||
__be16 port16[2];
|
||||
};
|
||||
__u32 ip_proto;
|
||||
} __attribute__((__aligned__(8)));
|
||||
|
||||
struct pair {
|
||||
uint64_t time;
|
||||
uint64_t packets;
|
||||
uint64_t bytes;
|
||||
} __attribute__((__aligned__(8)));
|
||||
|
||||
struct bpf_map_def SEC("maps") flow_table_v4 = {
|
||||
.type = BPF_MAP_TYPE_HASH,
|
||||
.key_size = sizeof(struct flowv4_keys),
|
||||
.value_size = sizeof(struct pair),
|
||||
.max_entries = 32768,
|
||||
};
|
||||
|
||||
struct bpf_map_def SEC("maps") flow_table_v6 = {
|
||||
.type = BPF_MAP_TYPE_HASH,
|
||||
.key_size = sizeof(struct flowv6_keys),
|
||||
.value_size = sizeof(struct pair),
|
||||
.max_entries = 32768,
|
||||
};
|
||||
|
||||
static __always_inline int ipv4_filter(struct __sk_buff *skb)
|
||||
{
|
||||
uint32_t nhoff, verlen;
|
||||
struct flowv4_keys tuple;
|
||||
struct pair *value;
|
||||
uint16_t port;
|
||||
|
||||
nhoff = skb->cb[0];
|
||||
|
||||
tuple.ip_proto = load_byte(skb, nhoff + offsetof(struct iphdr, protocol));
|
||||
/* only support TCP and UDP for now */
|
||||
switch (tuple.ip_proto) {
|
||||
case IPPROTO_TCP:
|
||||
case IPPROTO_UDP:
|
||||
break;
|
||||
default:
|
||||
return -1;
|
||||
}
|
||||
|
||||
tuple.src = load_word(skb, nhoff + offsetof(struct iphdr, saddr));
|
||||
tuple.dst = load_word(skb, nhoff + offsetof(struct iphdr, daddr));
|
||||
|
||||
verlen = load_byte(skb, nhoff + 0/*offsetof(struct iphdr, ihl)*/);
|
||||
nhoff += (verlen & 0xF) << 2;
|
||||
tuple.ports = load_word(skb, nhoff);
|
||||
port = tuple.port16[1];
|
||||
tuple.port16[1] = tuple.port16[0];
|
||||
tuple.port16[0] = port;
|
||||
|
||||
#if 0
|
||||
if ((tuple.port16[0] == 22) || (tuple.port16[1] == 22))
|
||||
{
|
||||
uint16_t sp = tuple.port16[0];
|
||||
//uint16_t dp = tuple.port16[1];
|
||||
char fmt[] = "Parsed SSH flow: %u %d -> %u\n";
|
||||
bpf_trace_printk(fmt, sizeof(fmt), tuple.src, sp, tuple.dst);
|
||||
}
|
||||
#endif
|
||||
/* Test if src is in hash */
|
||||
value = bpf_map_lookup_elem(&flow_table_v4, &tuple);
|
||||
if (value) {
|
||||
#if 0
|
||||
{
|
||||
uint16_t sp = tuple.port16[0];
|
||||
//uint16_t dp = tuple.port16[1];
|
||||
char bfmt[] = "Found flow: %u %d -> %u\n";
|
||||
bpf_trace_printk(bfmt, sizeof(bfmt), tuple.src, sp, tuple.dst);
|
||||
}
|
||||
#endif
|
||||
__sync_fetch_and_add(&value->packets, 1);
|
||||
__sync_fetch_and_add(&value->bytes, skb->len);
|
||||
value->time = bpf_ktime_get_ns();
|
||||
return 0;
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
|
||||
static __always_inline int ipv6_filter(struct __sk_buff *skb)
|
||||
{
|
||||
uint32_t nhoff;
|
||||
uint8_t nhdr;
|
||||
struct flowv6_keys tuple;
|
||||
struct pair *value;
|
||||
uint16_t port;
|
||||
|
||||
nhoff = skb->cb[0];
|
||||
|
||||
tuple.src[0] = load_word(skb, nhoff + offsetof(struct ipv6hdr, saddr));
|
||||
tuple.src[1] = load_word(skb, nhoff + offsetof(struct ipv6hdr, saddr) + 4);
|
||||
tuple.src[2] = load_word(skb, nhoff + offsetof(struct ipv6hdr, saddr) + 8);
|
||||
tuple.src[3] = load_word(skb, nhoff + offsetof(struct ipv6hdr, saddr) + 12);
|
||||
tuple.dst[0] = load_word(skb, nhoff + offsetof(struct ipv6hdr, daddr));
|
||||
tuple.dst[1] = load_word(skb, nhoff + offsetof(struct ipv6hdr, daddr) + 4);
|
||||
tuple.dst[2] = load_word(skb, nhoff + offsetof(struct ipv6hdr, daddr) + 8);
|
||||
tuple.dst[3] = load_word(skb, nhoff + offsetof(struct ipv6hdr, daddr) + 12);
|
||||
|
||||
/* get next header */
|
||||
nhdr = load_byte(skb, nhoff + offsetof(struct ipv6hdr, nexthdr));
|
||||
|
||||
/* only support direct TCP and UDP for now */
|
||||
switch (nhdr) {
|
||||
case IPPROTO_TCP:
|
||||
case IPPROTO_UDP:
|
||||
break;
|
||||
default:
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Parse TCP */
|
||||
tuple.ports = load_word(skb, nhoff + 40 /* IPV6_HEADER_LEN */);
|
||||
port = tuple.port16[1];
|
||||
tuple.port16[1] = tuple.port16[0];
|
||||
tuple.port16[0] = port;
|
||||
tuple.ip_proto = nhdr;
|
||||
|
||||
//char fmt[] = "Now Got IPv6 port %u and %u\n";
|
||||
//bpf_trace_printk(fmt, sizeof(fmt), tuple.port16[0], tuple.port16[1]);
|
||||
/* Test if src is in hash */
|
||||
value = bpf_map_lookup_elem(&flow_table_v6, &tuple);
|
||||
if (value) {
|
||||
//char fmt[] = "Got a match IPv6: %u and %u\n";
|
||||
//bpf_trace_printk(fmt, sizeof(fmt), tuple.port16[0], tuple.port16[1]);
|
||||
__sync_fetch_and_add(&value->packets, 1);
|
||||
__sync_fetch_and_add(&value->bytes, skb->len);
|
||||
value->time = bpf_ktime_get_ns();
|
||||
return 0;
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
|
||||
int SEC("filter") hashfilter(struct __sk_buff *skb) {
|
||||
__u32 nhoff = BPF_LL_OFF + ETH_HLEN;
|
||||
|
||||
skb->cb[0] = nhoff;
|
||||
switch (skb->protocol) {
|
||||
case __constant_htons(ETH_P_IP):
|
||||
return ipv4_filter(skb);
|
||||
case __constant_htons(ETH_P_IPV6):
|
||||
return ipv6_filter(skb);
|
||||
default:
|
||||
#if 0
|
||||
{
|
||||
char fmt[] = "Got proto %u\n";
|
||||
bpf_trace_printk(fmt, sizeof(fmt), h_proto);
|
||||
break;
|
||||
}
|
||||
#else
|
||||
break;
|
||||
#endif
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
||||
char __license[] SEC("license") = "GPL";
|
||||
|
||||
uint32_t __version SEC("version") = LINUX_VERSION_CODE;
|
||||
@ -0,0 +1,178 @@
|
||||
/* Copyright (C) 2016 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Eric Leblond <eleblond@stamus-networks.com>
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "tm-threads.h"
|
||||
#include "flow.h"
|
||||
#include "flow-bypass.h"
|
||||
#include "flow-private.h"
|
||||
#include "util-ebpf.h"
|
||||
|
||||
#define BYPASSED_FLOW_TIMEOUT 60
|
||||
#define FLOW_BYPASS_DELAY 10
|
||||
|
||||
typedef struct BypassedFlowManagerThreadData_ {
|
||||
uint16_t flow_bypassed_cnt_clo;
|
||||
uint16_t flow_bypassed_pkts;
|
||||
uint16_t flow_bypassed_bytes;
|
||||
} BypassedFlowManagerThreadData;
|
||||
|
||||
#ifdef HAVE_PACKET_EBPF
|
||||
|
||||
static int BypassedFlowV4Timeout(int fd, struct flowv4_keys *key, struct pair *value, void *data)
|
||||
{
|
||||
struct timespec *curtime = (struct timespec *)data;
|
||||
SCLogDebug("Got curtime %" PRIu64 " and value %" PRIu64 " (sp:%d, dp:%d)",
|
||||
curtime->tv_sec, value->time / 1000000000,
|
||||
key->port16[0], key->port16[1]
|
||||
);
|
||||
|
||||
if (curtime->tv_sec - value->time / 1000000000 > BYPASSED_FLOW_TIMEOUT) {
|
||||
SCLogDebug("Got no packet for %d -> %d at %" PRIu64,
|
||||
key->port16[0], key->port16[1], value->time);
|
||||
EBPFDeleteKey(fd, key);
|
||||
return 1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int BypassedFlowV6Timeout(int fd, struct flowv6_keys *key, struct pair *value, void *data)
|
||||
{
|
||||
struct timespec *curtime = (struct timespec *)data;
|
||||
SCLogDebug("Got curtime %" PRIu64 " and value %" PRIu64 " (sp:%d, dp:%d)",
|
||||
curtime->tv_sec, value->time / 1000000000,
|
||||
key->port16[0], key->port16[1]
|
||||
);
|
||||
|
||||
if (curtime->tv_sec - value->time / 1000000000 > BYPASSED_FLOW_TIMEOUT) {
|
||||
SCLogDebug("Got no packet for %d -> %d at %" PRIu64,
|
||||
key->port16[0], key->port16[1], value->time);
|
||||
EBPFDeleteKey(fd, key);
|
||||
return 1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
static TmEcode BypassedFlowManager(ThreadVars *th_v, void *thread_data)
|
||||
{
|
||||
#ifdef HAVE_PACKET_EBPF
|
||||
int tcount = 0;
|
||||
BypassedFlowManagerThreadData *ftd = thread_data;
|
||||
|
||||
while (1) {
|
||||
SCLogDebug("Dumping the table");
|
||||
struct timespec curtime;
|
||||
struct flows_stats bypassstats = { 0, 0, 0};
|
||||
if (clock_gettime(CLOCK_MONOTONIC, &curtime) != 0) {
|
||||
SCLogWarning(SC_ERR_INVALID_VALUE, "Can't get time: %s (%d)",
|
||||
strerror(errno), errno);
|
||||
sleep(1);
|
||||
continue;
|
||||
}
|
||||
/* TODO indirection here: AF_PACKET and NFQ should be able to give their iterate function */
|
||||
tcount = EBPFForEachFlowV4Table("flow_table_v4", BypassedFlowV4Timeout, &bypassstats, &curtime);
|
||||
if (tcount) {
|
||||
StatsAddUI64(th_v, ftd->flow_bypassed_cnt_clo, (uint64_t)bypassstats.count);
|
||||
StatsAddUI64(th_v, ftd->flow_bypassed_pkts, (uint64_t)bypassstats.packets);
|
||||
StatsAddUI64(th_v, ftd->flow_bypassed_bytes, (uint64_t)bypassstats.bytes);
|
||||
}
|
||||
memset(&bypassstats, 0, sizeof(bypassstats));
|
||||
/* TODO indirection here: AF_PACKET and NFQ should be able to give their iterate function */
|
||||
tcount = EBPFForEachFlowV6Table("flow_table_v6", BypassedFlowV6Timeout, &bypassstats, &curtime);
|
||||
if (tcount) {
|
||||
StatsAddUI64(th_v, ftd->flow_bypassed_cnt_clo, (uint64_t)bypassstats.count);
|
||||
StatsAddUI64(th_v, ftd->flow_bypassed_pkts, (uint64_t)bypassstats.packets);
|
||||
StatsAddUI64(th_v, ftd->flow_bypassed_bytes, (uint64_t)bypassstats.bytes);
|
||||
}
|
||||
|
||||
if (TmThreadsCheckFlag(th_v, THV_KILL)) {
|
||||
StatsSyncCounters(th_v);
|
||||
return TM_ECODE_OK;
|
||||
}
|
||||
sleep(FLOW_BYPASS_DELAY);
|
||||
StatsSyncCountersIfSignalled(th_v);
|
||||
}
|
||||
#endif
|
||||
return TM_ECODE_OK;
|
||||
}
|
||||
|
||||
|
||||
static TmEcode BypassedFlowManagerThreadInit(ThreadVars *t, const void *initdata, void **data)
|
||||
{
|
||||
BypassedFlowManagerThreadData *ftd = SCCalloc(1, sizeof(BypassedFlowManagerThreadData));
|
||||
if (ftd == NULL)
|
||||
return TM_ECODE_FAILED;
|
||||
|
||||
*data = ftd;
|
||||
|
||||
ftd->flow_bypassed_cnt_clo = StatsRegisterCounter("flow_bypassed.closed", t);
|
||||
ftd->flow_bypassed_pkts = StatsRegisterCounter("flow_bypassed.pkts", t);
|
||||
ftd->flow_bypassed_bytes = StatsRegisterCounter("flow_bypassed.bytes", t);
|
||||
|
||||
return TM_ECODE_OK;
|
||||
}
|
||||
|
||||
static TmEcode BypassedFlowManagerThreadDeinit(ThreadVars *t, void *data)
|
||||
{
|
||||
if (data)
|
||||
SCFree(data);
|
||||
return TM_ECODE_OK;
|
||||
}
|
||||
|
||||
/** \brief spawn the flow manager thread */
|
||||
void BypassedFlowManagerThreadSpawn()
|
||||
{
|
||||
#ifdef AFLFUZZ_DISABLE_MGTTHREADS
|
||||
return;
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_PACKET_EBPF
|
||||
ThreadVars *tv_flowmgr = NULL;
|
||||
tv_flowmgr = TmThreadCreateMgmtThreadByName("BypassedFlowManager",
|
||||
"BypassedFlowManager", 0);
|
||||
BUG_ON(tv_flowmgr == NULL);
|
||||
|
||||
if (tv_flowmgr == NULL) {
|
||||
printf("ERROR: TmThreadsCreate failed\n");
|
||||
exit(1);
|
||||
}
|
||||
if (TmThreadSpawn(tv_flowmgr) != TM_ECODE_OK) {
|
||||
printf("ERROR: TmThreadSpawn failed\n");
|
||||
exit(1);
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
void TmModuleBypassedFlowManagerRegister (void)
|
||||
{
|
||||
tmm_modules[TMM_BYPASSEDFLOWMANAGER].name = "BypassedFlowManager";
|
||||
tmm_modules[TMM_BYPASSEDFLOWMANAGER].ThreadInit = BypassedFlowManagerThreadInit;
|
||||
tmm_modules[TMM_BYPASSEDFLOWMANAGER].ThreadDeinit = BypassedFlowManagerThreadDeinit;
|
||||
tmm_modules[TMM_BYPASSEDFLOWMANAGER].Management = BypassedFlowManager;
|
||||
tmm_modules[TMM_BYPASSEDFLOWMANAGER].cap_flags = 0;
|
||||
tmm_modules[TMM_BYPASSEDFLOWMANAGER].flags = TM_FLAG_MANAGEMENT_TM;
|
||||
SCLogDebug("%s registered", tmm_modules[TMM_BYPASSEDFLOWMANAGER].name);
|
||||
}
|
||||
|
||||
@ -0,0 +1,34 @@
|
||||
/* Copyright (C) 2016 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Eric Leblond <eleblond@stamus-networks.com>
|
||||
*/
|
||||
|
||||
#ifndef __FLOW_BYPASS_H__
|
||||
#define __FLOW_BYPASS_H__
|
||||
|
||||
void FlowAddToBypassed(Flow *f);
|
||||
|
||||
void BypassedFlowManagerThreadSpawn(void);
|
||||
void TmModuleBypassedFlowManagerRegister(void);
|
||||
|
||||
#endif
|
||||
|
||||
|
||||
Loading…
Reference in New Issue