/*
* Copyright (C) 2018 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/*
* This h file together with bpf_kern.c is used for compiling the eBPF kernel
* program. To generate the bpf_kern.o file manually, use the clang prebuilt in
* this android tree to compile the files with --target=bpf options. For
* example, in system/netd/ directory, execute the following command:
* $: ANDROID_BASE_DIRECTORY/prebuilts/clang/host/linux-x86/clang-4691093/bin/clang \
* -I ANDROID_BASE_DIRECTORY/bionic/libc/kernel/uapi/ \
* -I ANDROID_BASE_DIRECTORY/system/netd/bpfloader/ \
* -I ANDROID_BASE_DIRECTORY/bionic/libc/kernel/android/uapi/ \
* -I ANDROID_BASE_DIRECTORY/bionic/libc/include \
* -I ANDROID_BASE_DIRECTORY/system/netd/libbpf/include \
* --target=bpf -O2 -c bpfloader/bpf_kern.c -o bpfloader/bpf_kern.o
*/
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <stdint.h>
#include "bpf/bpf_shared.h"
#define ELF_SEC(NAME) __attribute__((section(NAME), used))
struct uid_tag {
uint32_t uid;
uint32_t tag;
};
struct stats_key {
uint32_t uid;
uint32_t tag;
uint32_t counterSet;
uint32_t ifaceIndex;
};
struct stats_value {
uint64_t rxPackets;
uint64_t rxBytes;
uint64_t txPackets;
uint64_t txBytes;
};
/* helper functions called from eBPF programs written in C */
static void* (*find_map_entry)(uint64_t map, void* key) = (void*)BPF_FUNC_map_lookup_elem;
static int (*write_to_map_entry)(uint64_t map, void* key, void* value,
uint64_t flags) = (void*)BPF_FUNC_map_update_elem;
static int (*delete_map_entry)(uint64_t map, void* key) = (void*)BPF_FUNC_map_delete_elem;
static uint64_t (*get_socket_cookie)(struct __sk_buff* skb) = (void*)BPF_FUNC_get_socket_cookie;
static uint32_t (*get_socket_uid)(struct __sk_buff* skb) = (void*)BPF_FUNC_get_socket_uid;
static int (*bpf_skb_load_bytes)(struct __sk_buff* skb, int off, void* to,
int len) = (void*)BPF_FUNC_skb_load_bytes;
#define BPF_PASS 1
#define BPF_DROP 0
#define BPF_EGRESS 0
#define BPF_INGRESS 1
#define IP_PROTO_OFF offsetof(struct iphdr, protocol)
#define IPV6_PROTO_OFF offsetof(struct ipv6hdr, nexthdr)
#define IPPROTO_IHL_OFF 0
#define TCP_FLAG_OFF 13
#define RST_OFFSET 2
static __always_inline inline void bpf_update_stats(struct __sk_buff* skb, uint64_t map,
int direction, void *key) {
struct stats_value* value;
value = find_map_entry(map, key);
if (!value) {
struct stats_value newValue = {};
write_to_map_entry(map, key, &newValue, BPF_NOEXIST);
value = find_map_entry(map, key);
}
if (value) {
if (direction == BPF_EGRESS) {
__sync_fetch_and_add(&value->txPackets, 1);
__sync_fetch_and_add(&value->txBytes, skb->len);
} else if (direction == BPF_INGRESS) {
__sync_fetch_and_add(&value->rxPackets, 1);
__sync_fetch_and_add(&value->rxBytes, skb->len);
}
}
}
static inline int bpf_owner_match(struct __sk_buff* skb, uint32_t uid) {
int offset = -1;
int ret = 0;
if (skb->protocol == ETH_P_IP) {
offset = IP_PROTO_OFF;
uint8_t proto, ihl;
uint16_t flag;
ret = bpf_skb_load_bytes(skb, offset, &proto, 1);
if (!ret) {
if (proto == IPPROTO_ESP) {
return 1;
} else if (proto == IPPROTO_TCP) {
ret = bpf_skb_load_bytes(skb, IPPROTO_IHL_OFF, &ihl, 1);
ihl = ihl & 0x0F;
ret = bpf_skb_load_bytes(skb, ihl * 4 + TCP_FLAG_OFF, &flag, 1);
if (ret == 0 && (flag >> RST_OFFSET & 1)) {
return BPF_PASS;
}
}
}
} else if (skb->protocol == ETH_P_IPV6) {
offset = IPV6_PROTO_OFF;
uint8_t proto;
ret = bpf_skb_load_bytes(skb, offset, &proto, 1);
if (!ret) {
if (proto == IPPROTO_ESP) {
return BPF_PASS;
} else if (proto == IPPROTO_TCP) {
uint16_t flag;
ret = bpf_skb_load_bytes(skb, sizeof(struct ipv6hdr) + TCP_FLAG_OFF, &flag, 1);
if (ret == 0 && (flag >> RST_OFFSET & 1)) {
return BPF_PASS;
}
}
}
}
if ((uid <= MAX_SYSTEM_UID) && (uid >= MIN_SYSTEM_UID)) return BPF_PASS;
// In each of these maps, the entry with key UID_MAP_ENABLED tells us whether that
// map is enabled or not.
// TODO: replace this with a map of size one that contains a config structure defined in
// bpf_shared.h that can be written by userspace and read here.
uint32_t mapSettingKey = UID_MAP_ENABLED;
uint8_t* ownerMatch;
uint8_t* mapEnabled = find_map_entry(DOZABLE_UID_MAP, &mapSettingKey);
if (mapEnabled && *mapEnabled) {
ownerMatch = find_map_entry(DOZABLE_UID_MAP, &uid);
if (ownerMatch) return *ownerMatch;
return BPF_DROP;
}
mapEnabled = find_map_entry(STANDBY_UID_MAP, &mapSettingKey);
if (mapEnabled && *mapEnabled) {
ownerMatch = find_map_entry(STANDBY_UID_MAP, &uid);
if (ownerMatch) return *ownerMatch;
}
mapEnabled = find_map_entry(POWERSAVE_UID_MAP, &mapSettingKey);
if (mapEnabled && *mapEnabled) {
ownerMatch = find_map_entry(POWERSAVE_UID_MAP, &uid);
if (ownerMatch) return *ownerMatch;
return BPF_DROP;
}
return BPF_PASS;
}
static __always_inline inline int bpf_traffic_account(struct __sk_buff* skb, int direction) {
uint32_t sock_uid = get_socket_uid(skb);
int match = bpf_owner_match(skb, sock_uid);
if ((direction == BPF_EGRESS) && (match == BPF_DROP)) {
// If an outbound packet is going to be dropped, we do not count that
// traffic.
return match;
}
uint64_t cookie = get_socket_cookie(skb);
struct uid_tag* utag = find_map_entry(COOKIE_TAG_MAP, &cookie);
uint32_t uid, tag;
if (utag) {
uid = utag->uid;
tag = utag->tag;
} else {
uid = sock_uid;
tag = 0;
}
struct stats_key key = {.uid = uid, .tag = tag, .counterSet = 0, .ifaceIndex = skb->ifindex};
uint8_t* counterSet = find_map_entry(UID_COUNTERSET_MAP, &uid);
if (counterSet) key.counterSet = (uint32_t)*counterSet;
if (tag) {
bpf_update_stats(skb, TAG_STATS_MAP, direction, &key);
}
key.tag = 0;
bpf_update_stats(skb, UID_STATS_MAP, direction, &key);
bpf_update_stats(skb, APP_UID_STATS_MAP, direction, &uid);
return match;
}