#include <bcc/proto.h>

#include <uapi/linux/ip.h>

#include <uapi/linux/ipv6.h>

#include <uapi/linux/tcp.h>

#include <uapi/linux/udp.h>

#include <uapi/linux/icmp.h>

#include <uapi/linux/icmpv6.h>

#include <net/inet_sock.h>

#include <linux/netfilter/x_tables.h>

#define ROUTE_EVT_IF 1

#define ROUTE_EVT_IPTABLE 2

struct route_evt_t {

};

BPF_PERF_OUTPUT(route_evt);

struct ipt_do_table_args

};

BPF_HASH(cur_ipt_do_table_args, u32, struct ipt_do_table_args);

#define MAC_HEADER_SIZE 14;

#define member_address(source_struct, source_member) \

({ \

void* __ret; \

__ret = (void*) (((char*)source_struct) + offsetof(typeof(*source_struct), source_member)); \

__ret; \

})

#define member_read(destination, source_struct, source_member) \

do{ \

bpf_probe_read( \

destination, \

sizeof(source_struct->source_member), \

member_address(source_struct, source_member) \

); \

} while(0)

static inline int do_trace_skb(struct route_evt_t *evt, void *ctx, struct sk_buff *skb)

{

// Prepare event for userland

evt->flags |= ROUTE_EVT_IF;

// Compute MAC header address

char* head;

u16 mac_header;

u16 network_header;

member_read(&head, skb, head);

member_read(&mac_header, skb, mac_header);

member_read(&network_header, skb, network_header);

if(network_header == 0) {

network_header = mac_header + MAC_HEADER_SIZE;

}

// Compute IP Header address

char *ip_header_address = head + network_header;

// Abstract IPv4 / IPv6

u8 proto_icmp;

u8 proto_icmp_echo_request;

u8 proto_icmp_echo_reply;

u8 icmp_offset_from_ip_header;

u8 l4proto;

// Load IP protocol version

bpf_probe_read(&evt->ip_version, sizeof(u8), ip_header_address);

evt->ip_version = evt->ip_version >> 4 & 0xf;

// *********************

// Filter IP packets

if (evt->ip_version == 4) {

// Load IP Header

struct iphdr iphdr;

bpf_probe_read(&iphdr, sizeof(iphdr), ip_header_address);

// Load protocol and address

icmp_offset_from_ip_header = iphdr.ihl * 4;

l4proto = iphdr.protocol;

evt->saddr[0] = iphdr.saddr;

evt->daddr[0] = iphdr.daddr;

// Load constants

proto_icmp = IPPROTO_ICMP;

proto_icmp_echo_request = ICMP_ECHO;

proto_icmp_echo_reply = ICMP_ECHOREPLY;

} else if (evt->ip_version == 6) {

// Assume no option header --> fixed size header

struct ipv6hdr* ipv6hdr = (struct ipv6hdr*)ip_header_address;

icmp_offset_from_ip_header = sizeof(*ipv6hdr);

// Load protocol and address

bpf_probe_read(&l4proto, sizeof(ipv6hdr->nexthdr), (char*)ipv6hdr + offsetof(struct ipv6hdr, nexthdr));

bpf_probe_read(evt->saddr, sizeof(ipv6hdr->saddr), (char*)ipv6hdr + offsetof(struct ipv6hdr, saddr));

bpf_probe_read(evt->daddr, sizeof(ipv6hdr->daddr), (char*)ipv6hdr + offsetof(struct ipv6hdr, daddr));

// Load constants

proto_icmp = IPPROTO_ICMPV6;

proto_icmp_echo_request = ICMPV6_ECHO_REQUEST;

proto_icmp_echo_reply = ICMPV6_ECHO_REPLY;

} else {

}

// Filter ICMP packets

// Compute ICMP header address and load ICMP header

char* icmp_header_address = ip_header_address + icmp_offset_from_ip_header;

struct icmphdr icmphdr;

bpf_probe_read(&icmphdr, sizeof(icmphdr), icmp_header_address);

// Filter ICMP echo request and echo reply

// Get ICMP info

evt->icmptype = icmphdr.type;

evt->icmpid = icmphdr.un.echo.id;

evt->icmpseq = icmphdr.un.echo.sequence;

// Fix endian

evt->icmpid = be16_to_cpu(evt->icmpid);

evt->icmpseq = be16_to_cpu(evt->icmpseq);

// *********************

// bpf_trace_printk("flow sport=%d\n", evt->icmptype);

// Get device pointer, we'll need it to get the name and network namespace

struct net_device *dev;

member_read(&dev, skb, dev);

// Load interface name

bpf_probe_read(&evt->ifname, IFNAMSIZ, dev->name);

#ifdef CONFIG_NET_NS

struct net* net;

// Get netns id. The code below is equivalent to: evt->netns = dev->nd_net.net->ns.inum

possible_net_t *skc_net = &dev->nd_net;

member_read(&net, skc_net, net);

struct ns_common* ns = member_address(net, ns);

member_read(&evt->netns, ns, inum);

return 0;

}

static inline int __ipt_do_table_in(struct pt_regs *ctx, struct sk_buff *skb, const struct nf_hook_state *state, struct xt_table *table)

{

u32 pid = bpf_get_current_pid_tgid();

// stash the arguments for use in retprobe

struct ipt_do_table_args args = {

.skb = skb,

.state = state,

.table = table,

};

cur_ipt_do_table_args.update(&pid, &args);

return 0;

};

static inline int __ipt_do_table_out(struct pt_regs * ctx)

{

// Load arguments

u32 pid = bpf_get_current_pid_tgid();

struct ipt_do_table_args *args;

args = cur_ipt_do_table_args.lookup(&pid);

if (args == 0)

{

return 0; // missed entry

}

cur_ipt_do_table_args.delete(&pid);

// Prepare event for userland

struct route_evt_t evt = {

.flags = ROUTE_EVT_IPTABLE,

};

// Load packet information

struct sk_buff *skb = args->skb;

do_trace_skb(&evt, ctx, skb);

// Store the hook

const struct nf_hook_state *state = args->state;

member_read(&evt.hook, state, hook);

// Store the table name

struct xt_table *table = args->table;

member_read(&evt.tablename, table, name);

// Store the verdict

int ret = PT_REGS_RC(ctx);

evt.verdict = ret;

// Send event

route_evt.perf_submit(ctx, &evt, sizeof(evt));

return 0;

}

int kprobe__ipt_do_table(struct pt_regs *ctx, struct sk_buff *skb, const struct nf_hook_state *state, struct xt_table *table)

{

return __ipt_do_table_in(ctx, skb, state, table);

};

int kretprobe__ipt_do_table(struct pt_regs *ctx)

{

return __ipt_do_table_out(ctx);

}

int kprobe__ip6t_do_table(struct pt_regs *ctx, struct sk_buff *skb, const struct nf_hook_state *state, struct xt_table *table)

{

return __ipt_do_table_in(ctx, skb, state, table);

};

int kretprobe__ip6t_do_table(struct pt_regs *ctx)

{

return __ipt_do_table_out(ctx);

}