[SSC-395] XDP filter for bypassed traffic

ebpf/Makefile.am

@@ -12,6 +12,8 @@ BPF_TARGETS += bypass_filter.bpf
 BPF_TARGETS += xdp_filter.bpf
 BPF_TARGETS += xdp_lb.bpf
 BPF_TARGETS += xdp_lb_ew.bpf
+BPF_TARGETS += xdp_lb_ew_stream.bpf
+BPF_TARGETS += xdp_lb_stream.bpf
 BPF_TARGETS += xdp_ew.bpf
 BPF_TARGETS += vlan_filter.bpf
 

ebpf/build-xdp.sh

@@ -0,0 +1,40 @@
+#! /bin/bash
+
+# A simple script to speed up build/test/debug iterations for XDP stuff.
+
+if [ "$#" -ne 1 ]; then
+  echo "USAGE: build-xdp.sh <name-of-source-file>"
+  exit 1
+fi
+
+docker exec suricata-dev \
+  bash -c "cd /workspaces/suricata-awn/ebpf && clang-10 -Wall -Iinclude -O2 \
+      -I/usr/include/x86_64-linux-gnu/ \
+      -D__KERNEL__ -D__ASM_SYSREG_H \
+      -target bpf -S -emit-llvm $1.c -o $1.ll \
+    && llc-10 -march=bpf -filetype=obj $1.ll -o $1.bpf \
+    && rm -f $1.ll"
+
+if [ $? -ne 0 ]; then
+  echo "Build failed. Make sure your BoB container is running. Start it using:"
+  echo "  pack docker run --name suricata-dev --container-user vagrant  cell.rtkbox.bob-debian16"
+  exit 1
+fi
+
+set -e
+
+if [ -z ${RTK_SENSOR_HOSTNAME} ]; then
+  echo "RTK_SENSOR_HOSTNAME is not set. Skipping scp."
+  exit 0
+fi
+
+echo "Copying $1.bpf to $RTK_SENSOR_HOSTNAME..."
+scp -F $RTK_BUILD_ROOT/etc/ssh_config ./$1.bpf $RTK_SENSOR_HOSTNAME:~/ebpf
+
+echo "Restarting Suricata on $RTK_SENSOR_HOSTNAME..."
+ssh -F $RTK_BUILD_ROOT/etc/ssh_config vagrant@$RTK_SENSOR_HOSTNAME -t \
+  "sudo cp /home/vagrant/ebpf/$1.bpf /opt/suricata6/ebpf && \
+  sudo systemctl restart suricata6.service"
+
+echo "Suricata restarted. Tail /var/log/suricata.log to seen when XDP has initialized."
+echo "Example: \"Successfully loaded eBPF file '/opt/suricata6/ebpf/xdp_stream_filter.bpf' on 'lan0'\""

ebpf/test/test_framework.h

@@ -1,6 +1,13 @@
 #ifndef __EBPF_TEST_FRAMEWORK__
 #define __EBPF_TEST_FRAMEWORK__
 
+#include <stdio.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <string.h>
+#include <stdint.h>
+#include <stdarg.h>
+
 /**
  * This file defines a fairly light unit testing framework and some tests, meant to allow
  * some degree of sanity checking to be done on an XDP program.

ebpf/test/test_mocks.h

@@ -1,6 +1,8 @@
 #ifndef __EBPF_TEST_MOCKS__
 #define __EBPF_TEST_MOCKS__
 
+#include "../xdp_stream_filter_common.h" // for struct flowv4_keys
+
 /**
  * Includes a set of mocks to assist in testing XDP programs.
  */
@@ -26,7 +28,8 @@ int bpf_xdp_adjust_head_mock(void* privData, int offset) {
 // This value is arbitrary...
 uint32_t g_cpuCount = 10;
 
-void* bpf_map_lookup_elem_mock(void* map, void* key) {
+// This version of bpf_map_lookup_elem_mock is used by xdp_lb.test.c
+void* bpf_map_lookup_elem_lb_mock(void* map, void* key) {
 	if(map == &cpus_count) {
 		// This "map" is just a single value (index 0)
 		return (void*)&g_cpuCount;
@@ -38,6 +41,24 @@ void* bpf_map_lookup_elem_mock(void* map, void* key) {
 	return 0;
 }
 
+// Used by bpf_map_lookup_elem_stream_mock below to store the supplied keys
+// for later assertions, and to allow the test to set the return value.
+struct flowv4_keys g_stream_map_v4_lookup_keys;
+void* g_stream_map_lookup_value = NULL; // This is set by the test.
+
+// This version is used by xdp_stream.test.c
+void* bpf_map_lookup_elem_stream_mock_v4(void* map, void* key) {
+	// Make a copy of the key so the test can check it after the call finishes.
+	memcpy(&g_stream_map_v4_lookup_keys, key, sizeof(struct flowv4_keys));
+	return g_stream_map_lookup_value;
+}
+
+struct flowv6_keys g_stream_map_v6_lookup_keys;
+void* bpf_map_lookup_elem_stream_mock_v6(void* map, void* key) {
+	memcpy(&g_stream_map_v6_lookup_keys, key, sizeof(struct flowv6_keys));
+	return g_stream_map_lookup_value;
+}
+
 int bpf_redirect_map_mock(void* map, int key, int flags) {
 	// I assume the kernel does something similar... but it really doesn't matter; we
 	// just need a way to encode the unique CPU and the fact that it's a redirect (not a
@@ -48,7 +69,6 @@ int bpf_redirect_map_mock(void* map, int key, int flags) {
 void setup_mocks() {
   // setup our mocks...
   bpf_xdp_adjust_head = bpf_xdp_adjust_head_mock;
-  bpf_map_lookup_elem = bpf_map_lookup_elem_mock;
   bpf_redirect_map = bpf_redirect_map_mock;
   bpf_trace_printk = test_trace_hook;
 }

ebpf/test/xdp_lb.test.c

@@ -227,6 +227,7 @@ void test_non_ip_packet(struct xdp_md* ctx) {
 
 int main() {
 	setup_mocks();
+	bpf_map_lookup_elem = bpf_map_lookup_elem_lb_mock;
 
 	// And our fake 32-bit addressable environment...
 	struct xdp_md ctx;

ebpf/test/xdp_stream.test.c

@@ -0,0 +1,237 @@
+#include "test_framework.h"
+//#define DEBUG 1
+#include "../xdp_lb_stream.c"
+#include "test_mocks.h"
+
+
+void test_ipv4_match(struct xdp_md* ctx) {
+  char packet[] = 
+    "\x0\x50\x56\x80\x83\xd8\x0\x50\x56\x80\xdf\x93\x8\x0\x45\x0\x0\x84\xf7\x78"
+    "\x40\x0\x40\x6\x1f\xd4\xa\x8\x7\xb5\xa\x8\x7\x63\xb4\xa9\x0\x50\x29\x8b\xe3"
+    "\x91\x28\xe9\x5e\x9b\x80\x18\x1\xf6\x4d\x3b\x0\x0\x1\x1\x8\xa\x10\x9d\xe4"
+    "\x9a\x99\x4e\x3f\x1d\x47\x45\x54\x20\x2f\x50\x44\x46\x31\x30\x4d\x42\x20\x48"
+    "\x54\x54\x50\x2f\x31\x2e\x31\xd\xa\x48\x6f\x73\x74\x3a\x20\x31\x30\x2e\x38"
+    "\x2e\x37\x2e\x39\x39\xd\xa\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74\x3a\x20"
+    "\x63\x75\x72\x6c\x2f\x37\x2e\x36\x38\x2e\x30\xd\xa\x41\x63\x63\x65\x70\x74"
+    "\x3a\x20\x2a\x2f\x2a\xd\xa\xd\xa";
+
+  CTX_SET(ctx, packet);
+
+  // Pointer value doesn't matter - just has to be non-NULL for a match
+  struct pair bpf_ret_value = {0, 0}; 
+  g_stream_map_lookup_value = &bpf_ret_value;
+
+  // This will contain the key that the filter tried to look up
+  struct flowv4_keys *key = &g_stream_map_v4_lookup_keys;
+
+  int result = xdp_loadfilter(ctx);
+  assert(result == XDP_DROP);
+
+  // Value from the pcap above. They'll be in little-endian in the key.
+  assert(key->ip_proto == 1);
+  assert(key->src == 0xb507080a);
+  assert(key->dst == 0x6307080a);
+  assert(key->port16[0] == 0xa9b4);
+  assert(key->port16[1] == 0x5000); // dest port: 80
+  assert(key->vlan0 == 0);
+  assert(key->vlan1 == 0);
+}
+
+void test_gre_match(struct xdp_md* ctx) {
+  // Packet borrowed from xdp_lb.test.c
+  // GRE packet from a capture, loaded into wireshark, and then "copy as escaped string"
+	char packet[] =
+		// Outer eth header
+		"\x00\x90\x0b\xa9\x49\x55\x00\x50\x56\x63\xf2\x58\x08\x00"
+		// Outer IP header
+		// src 192.29.36.175
+		// dest 172.29.35.160
+		"\x45\x00\x00\x98\xd1\x3d\x00\x00\x40\x2f\x07\x7a\xac\x1d\x24\xaf\xac\x1d\x24\x96"
+		// GRE
+		"\x10\x00\x88\xbe\x39\x8b\xdf\x97"
+		// ERSPAN
+		"\x10\x00\x00\x00\x00\x00\x00\x01"
+		// Inner eth header
+		"\x00\x50\x56\x94\x2d\x12\x00\x50\x56\x0b\x07\xf0\x08\x00"
+		// Inner IP header
+    // src0.0.1.16
+    // dest 165.225.33.253
+		"\x45\x00\x00\x66\x89\xf3\x40\x00\x40\x06\xdd\xb0\x0a\x00\x01\x10\xa5\xe1\x21\xfd"
+		// TCP header
+		"\xc4\x46\x01\xbb\xb6\x93\xef\x9f\x47\x24\xb2\x97"
+		"\x80\x18\x07\xfd\x74\xa5\x00\x00\x01\x01\x08\x0a\x65\xda\x08\x7e"
+		"\x4a\x02\xda\x1b"
+		// Layer 5...
+		"\x17\x03\x03\x00\x2d\x05\x74\xce\xee\x5f\xd7\xf9"
+		"\x0e\x52\xad\xd4\xf6\x5d\x51\x44\x7b\x41\x76\x4e\x61\x0b\x31\xaa"
+		"\x6b\x35\x01\x67\xae\x2c\x52\xf8\x42\x51\x25\xe4\x13\x95\x3a\x25"
+		"\x68\x25\xfe\x47\x9a\x2d";
+
+  CTX_SET(ctx, packet);
+
+  struct pair bpf_ret_value = {0, 0}; 
+  g_stream_map_lookup_value = &bpf_ret_value;
+
+  struct flowv4_keys *key = &g_stream_map_v4_lookup_keys;
+
+  int result = xdp_loadfilter(ctx);
+  assert(result == XDP_DROP);
+
+  //DPRINTF("key->ip_proto: %d, key->src: %x, key->dst: %x, key->port16[0]: %x, key->port16[1]: %x, key->vlan0: %d, key->vlan1: %d\n",
+  //        key->ip_proto, key->src, key->dst, key->port16[0], key->port16[1], key->vlan0, key->vlan1);
+
+  // little-endian
+  assert(key->ip_proto == 1);
+  assert(key->src == 0x1001000a);
+  assert(key->dst == 0xfd21e1a5);
+  assert(key->port16[0] == 0x46c4);
+  assert(key->port16[1] == 0xbb01); // dest port: 443
+  assert(key->vlan0 == 0);
+  assert(key->vlan1 == 0);
+}
+
+void test_IEEE8021ah_packet_vlan(struct xdp_md* ctx) {
+  // Example packet data in hex format (borrowed from xdp_lb.test.c)
+  char packet[] =
+  // ether header, next header == 8100
+  "\x02\x10\x00\xff\xff\xf0\x00\x17\x20\x05\x90\x87\x81\x00"
+  // vlan header, next header == 0x88e7
+  "\x0f\xd3\x88\xe7" // vlan == d30f & 0x0fff == 30f
+  // Provider backbone bridge (802.1ah), next header == 0x8100
+  "\x00\x00\x2d\x50\xb4\x0c\x25\xe0\x40\x10\xac\x1f\x6b\xb3\x4e\x91\x81\x00"
+  // vlan header, next header == 0x0800
+  "\x06\x40\x08\x00" // vlan == 4006 & 0x0fff == 6
+  // IPV4 header
+  //  Src IP == 10.96.16.7 (internal)
+  //  Dst IP == 10.16.98.31 (internal)
+  "\x45\x00\x00\x28\xa9\x0f\x40\x00\xff\x06\x4c\x2a\x0a\x60\x10\x07\x0a\x10\x62\x1f"
+  // TCP header and payload
+  "\x61\x6e\x0a\x26\x6d\x56\xbb\xc5\x0d\xa3\x02\x5a\x50\x10\x02\x02\x82\x8f\x00\x00\x00\x00\x00\x00\x00\x00";
+
+  CTX_SET(ctx, packet);
+
+  struct pair bpf_ret_value = {0, 0}; 
+  g_stream_map_lookup_value = &bpf_ret_value;
+
+  struct flowv4_keys *key = &g_stream_map_v4_lookup_keys;
+
+  int result = xdp_loadfilter(ctx);
+  assert(result == XDP_DROP);
+
+  assert(key->ip_proto == 1);
+  assert(key->src == 0x0710600a);
+  assert(key->dst == 0x1f62100a);
+  assert(key->port16[0] == 0x6e61);
+  assert(key->port16[1] == 0x260a);
+  assert(key->vlan0 == 0x30f);
+  assert(key->vlan1 == 6);
+
+  //DPRINTF("key->ip_proto: %d, key->src: %x, key->dst: %x, key->port16[0]: %x, key->port16[1]: %x, key->vlan0: %x, key->vlan1: %x\n",
+  //  key->ip_proto, key->src, key->dst, key->port16[0], key->port16[1], key->vlan0, key->vlan1);
+}
+
+void test_no_match(struct xdp_md* ctx) {
+  char packet[] = 
+    "\x0\x50\x56\x80\x83\xd8\x0\x50\x56\x80\xdf\x93\x8\x0\x45\x0\x0\x84\xf7\x78"
+    "\x40\x0\x40\x6\x1f\xd4\xa\x8\x7\xb5\xa\x8\x7\x63\xb4\xa9\x0\x50\x29\x8b\xe3"
+    "\x91\x28\xe9\x5e\x9b\x80\x18\x1\xf6\x4d\x3b\x0\x0\x1\x1\x8\xa\x10\x9d\xe4"
+    "\x9a\x99\x4e\x3f\x1d\x47\x45\x54\x20\x2f\x50\x44\x46\x31\x30\x4d\x42\x20\x48"
+    "\x54\x54\x50\x2f\x31\x2e\x31\xd\xa\x48\x6f\x73\x74\x3a\x20\x31\x30\x2e\x38"
+    "\x2e\x37\x2e\x39\x39\xd\xa\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74\x3a\x20"
+    "\x63\x75\x72\x6c\x2f\x37\x2e\x36\x38\x2e\x30\xd\xa\x41\x63\x63\x65\x70\x74"
+    "\x3a\x20\x2a\x2f\x2a\xd\xa\xd\xa";
+
+  CTX_SET(ctx, packet);
+
+  // make bpf_map_lookup_elem return NULL
+  g_stream_map_lookup_value = NULL;
+
+  // This will contain the key that the filter tried to look up
+  struct flowv4_keys *key = &g_stream_map_v4_lookup_keys;
+
+  int result = xdp_loadfilter(ctx);
+  assert(result == XDP_PASS);
+
+  // Key has been verified in test_ipv4_match (packet is the same)
+}
+
+void test_ipv6(struct xdp_md* ctx) {
+  char packet[] =
+  // Ethernet header
+	"\x33\x33\x00\x01\x00\x02\x00\x22\xfb\x12\xda\xe8\x86\xdd"
+  // Ipv6 header
+  "\x60\x00\x00\x00\x00\x61\x11\x01"
+  // Source IP: fe80::35d0:b39e:c3f7:e20f
+  "\xfe\x80\x00\x00\x00\x00\x00\x00\x35\xd0\xb3\x9e\xc3\xf7\xe2\x0f"
+  // Dest IP: ff02::1:2
+  "\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x02"
+  // Payload (UDP, DHCPv6)
+  "\x02\x22\x02\x23\x00\x61\x56\x62\x01\x00"
+	"\x57\x03\x00\x08\x00\x02\x18\x9c\x00\x01\x00\x0e\x00\x01\x00\x01"
+	"\x15\xb7\xc4\xfa\x00\x1c\x25\xbc\xea\x83\x00\x03\x00\x0c\x1d\x00"
+	"\x22\xfb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x27\x00\x0b\x00\x09"
+	"\x4c\x61\x70\x74\x6f\x70\x2d\x50\x43\x00\x10\x00\x0e\x00\x00\x01"
+	"\x37\x00\x08\x4d\x53\x46\x54\x20\x35\x2e\x30\x00\x06\x00\x08\x00"
+	"\x18\x00\x17\x00\x11\x00\x27";
+
+  CTX_SET(ctx, packet);
+
+  struct pair bpf_ret_value = {0, 0}; 
+  g_stream_map_lookup_value = &bpf_ret_value;
+
+  bpf_map_lookup_elem = bpf_map_lookup_elem_stream_mock_v6;
+  struct flowv6_keys *key = &g_stream_map_v6_lookup_keys;
+
+  int result = xdp_loadfilter(ctx);
+  assert(result == XDP_DROP);
+
+  assert(key->ip_proto == 0);
+  assert(memcmp(key->src, "\xfe\x80\x00\x00\x00\x00\x00\x00\x35\xd0\xb3\x9e\xc3\xf7\xe2\x0f", 16) == 0);
+  assert(memcmp(key->dst, "\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x02", 16) == 0);
+  assert(key->port16[0] == 0x2202);
+  assert(key->port16[1] == 0x2302);
+  assert(key->ip_proto == 0);
+  assert(key->vlan0 == 0);
+  assert(key->vlan1 == 0);
+
+#ifdef DEBUG
+  // Thanks, copilot! (Also, too many args for DPRINTF.)
+  printf("key->ip_proto: %d, key->src: %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x, key->dst: %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x, key->port16[0]: %x, key->port16[1]: %x, key->vlan0: %x, key->vlan1: %x\n",
+          key->ip_proto,
+          ntohs(key->src[0] & 0xffff), ntohs((key->src[0] >> 16) & 0xffff), ntohs(key->src[1] & 0xffff), ntohs((key->src[1] >> 16) & 0xffff),
+          ntohs(key->src[2] & 0xffff), ntohs((key->src[2] >> 16) & 0xffff), ntohs(key->src[3] & 0xffff), ntohs((key->src[3] >> 16) & 0xffff),
+          ntohs(key->dst[0] & 0xffff), ntohs((key->dst[0] >> 16) & 0xffff), ntohs(key->dst[1] & 0xffff), ntohs((key->dst[1] >> 16) & 0xffff),
+          ntohs(key->dst[2] & 0xffff), ntohs((key->dst[2] >> 16) & 0xffff), ntohs(key->dst[3] & 0xffff), ntohs((key->dst[3] >> 16) & 0xffff),
+          ntohs(key->port16[0]), ntohs(key->port16[1]), key->vlan0, key->vlan1);
+#endif
+
+  // Not necessary right now, but will probably save me a headache later.
+  bpf_map_lookup_elem = bpf_map_lookup_elem_stream_mock_v4;
+}
+
+void test_debug_not_defined(struct xdp_md* ctx) {
+	// Ensure that the DEBUG macro is not defined in production
+#ifdef DEBUG
+	#if DEBUG != 0
+		assert(0);
+	#endif
+#endif
+}
+
+int main() {
+  setup_mocks();
+  bpf_map_lookup_elem = bpf_map_lookup_elem_stream_mock_v4;
+
+  // And our fake 32-bit addressable environment...
+  struct xdp_md ctx;
+  g_TopOfStack = HIGH32(&ctx);
+
+  TEST(ipv4_match);
+  TEST(gre_match);
+  TEST(IEEE8021ah_packet_vlan);
+  TEST(no_match);
+  TEST(ipv6);
+  TEST(debug_not_defined);
+
+  return 0;
+}