|
| 1 | +use core::mem; |
| 2 | + |
| 3 | +use aya_bpf::{ |
| 4 | + bindings::TC_ACT_PIPE, |
| 5 | + helpers::bpf_csum_diff, |
| 6 | + programs::TcContext, |
| 7 | +}; |
| 8 | +use aya_log_ebpf::info; |
| 9 | + |
| 10 | +use crate::{ |
| 11 | + bindings::{iphdr, icmphdr}, |
| 12 | + utils::{csum_fold_helper, ip_from_int, ptr_at, ETH_HDR_LEN, IP_HDR_LEN}, |
| 13 | + BLIXT_CONNTRACK, |
| 14 | +}; |
| 15 | + |
| 16 | +const ICMP_HDR_LEN: usize = mem::size_of::<icmphdr>(); |
| 17 | +const ICMP_PROTO_TYPE_UNREACH: u8 = 3; |
| 18 | + |
| 19 | +pub fn handle_icmp_egress(ctx: TcContext) -> Result<i32, i64> { |
| 20 | + let ip_hdr: *mut iphdr = unsafe { ptr_at(&ctx, ETH_HDR_LEN) }?; |
| 21 | + |
| 22 | + let icmp_header_offset = ETH_HDR_LEN + IP_HDR_LEN; |
| 23 | + |
| 24 | + let icmp_hdr: *mut icmphdr = unsafe { |
| 25 | + ptr_at( |
| 26 | + &ctx, |
| 27 | + icmp_header_offset |
| 28 | + )? |
| 29 | + }; |
| 30 | + |
| 31 | + // We only care about redirecting port unreachable messages currently so a |
| 32 | + // UDP client can tell when the server is shutdown |
| 33 | + if unsafe { (*icmp_hdr).type_ } != ICMP_PROTO_TYPE_UNREACH { |
| 34 | + return Ok(TC_ACT_PIPE); |
| 35 | + } |
| 36 | + |
| 37 | + let dest_addr = unsafe { (*ip_hdr).daddr }; |
| 38 | + |
| 39 | + let new_src = unsafe { BLIXT_CONNTRACK.get(&dest_addr) }.ok_or(TC_ACT_PIPE)?; |
| 40 | + |
| 41 | + let daddr_dot_dec = ip_from_int(unsafe { (*ip_hdr).daddr }); |
| 42 | + info!( |
| 43 | + &ctx, |
| 44 | + "Received a ICMP Unreachable packet destined for svc ip: {}.{}.{}.{}", |
| 45 | + daddr_dot_dec[0], |
| 46 | + daddr_dot_dec[1], |
| 47 | + daddr_dot_dec[2], |
| 48 | + daddr_dot_dec[3], |
| 49 | + ); |
| 50 | + |
| 51 | + // redirect icmp unreachable message back to client |
| 52 | + unsafe { |
| 53 | + (*ip_hdr).saddr = *new_src; |
| 54 | + (*ip_hdr).check = 0; |
| 55 | + } |
| 56 | + |
| 57 | + let full_cksum = unsafe { |
| 58 | + bpf_csum_diff( |
| 59 | + mem::MaybeUninit::zeroed().assume_init(), |
| 60 | + 0, |
| 61 | + ip_hdr as *mut u32, |
| 62 | + mem::size_of::<iphdr>() as u32, |
| 63 | + 0 |
| 64 | + ) |
| 65 | + } as u64; |
| 66 | + unsafe { (*ip_hdr).check = csum_fold_helper(full_cksum) }; |
| 67 | + |
| 68 | + // Get inner ipheader since we need to update that as well |
| 69 | + let icmp_inner_ip_hdr: *mut iphdr = unsafe { ptr_at(&ctx, icmp_header_offset + ICMP_HDR_LEN)}?; |
| 70 | + |
| 71 | + unsafe { |
| 72 | + (*icmp_inner_ip_hdr).daddr = *new_src; |
| 73 | + (*icmp_inner_ip_hdr).check = 0; |
| 74 | + } |
| 75 | + |
| 76 | + let full_cksum = unsafe { |
| 77 | + bpf_csum_diff( |
| 78 | + mem::MaybeUninit::zeroed().assume_init(), |
| 79 | + 0, |
| 80 | + icmp_inner_ip_hdr as *mut u32, |
| 81 | + mem::size_of::<iphdr>() as u32, |
| 82 | + 0 |
| 83 | + ) |
| 84 | + } as u64; |
| 85 | + unsafe { (*icmp_inner_ip_hdr).check = csum_fold_helper(full_cksum) }; |
| 86 | + |
| 87 | + unsafe { BLIXT_CONNTRACK.remove(&dest_addr)? }; |
| 88 | + |
| 89 | + return Ok(TC_ACT_PIPE); |
| 90 | +} |
0 commit comments