[RFC bpf-next v3 2/3] bpf: Add PPPoE encap/decap kfuncs

[ThisSeanZhang <thisseanzhang@gmail.com>]

Add bpf_skb_pppoe_encap() and bpf_skb_pppoe_decap() kfuncs so that a
TC BPF program can encapsulate an IPv4 or IPv6 packet into a PPPoE
session frame, and decapsulate one again:

	bpf_skb_pppoe_encap(skb, sid, flags);
	bpf_skb_pppoe_decap(skb, flags);

The kfuncs insert or remove the 8 byte PPPoE session header between
the MAC header and the network header, and update the skb metadata to
match: skb->protocol is set to ETH_P_PPP_SES on encapsulation, or
restored from the PPP protocol field on decapsulation, mac_len is
reset, and the GSO metadata is adjusted like bpf_skb_adjust_room()
does (gso_size, gso_segs, SKB_GSO_DODGY).

Both kfuncs accept BPF_F_ADJ_ROOM_FIXED_GSO to leave gso_size
unchanged and only recompute gso_segs, reusing the existing flag
instead of adding a new one; UDP GSO packets require it, as their
gso_size is the datagram size. Unknown flags are rejected.

Previously, a TC program could add or remove the header bytes
manually, but the skb would keep a stale skb->protocol: forwarded GSO
packets larger than the PPPoE MTU could not reach the PPPoE
segmentation path registered for ETH_P_PPP_SES and could be dropped.
bpf_skb_adjust_room() cannot be used for the decapsulation direction
either, because it only accepts ETH_P_IP or ETH_P_IPV6 in
skb->protocol.

The encap kfunc fills in the PPPoE header itself from the session id:
version 1, type 1, code 0, and the PPP protocol derived from
skb->protocol, mirroring what pppoe_xmit() writes. The ethertype of
the MAC header remains for the BPF program, like with the existing
BPF_F_ADJ_ROOM_ENCAP_* flags. skb->encapsulation is deliberately left
unset, like pppoe_xmit() does: PPPoE is not an IP tunnel, and setting
it would narrow the device features to hw_enc_features in
netif_skb_features(). The decap kfunc accepts only PPP_IP and PPP_IPV6
payloads and requires a full inner L3 header to remain.

The kfuncs are registered for SCHED_CLS and SCHED_ACT with the new
KF_CHANGES_PKT flag, so the verifier invalidates packet pointers after
a call, like it does for bpf_skb_adjust_room().

PPPoE GRO/GSO support must be built in or loaded before this path is
used; loading pppoe.ko is left to user space.

Signed-off-by: ThisSeanZhang <thisseanzhang@gmail.com>
---
 net/core/filter.c | 192 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 192 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 9245009d9..3d9143552 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -47,6 +47,8 @@
 #include <linux/ratelimit.h>
 #include <linux/seccomp.h>
 #include <linux/if_vlan.h>
+#include <linux/if_pppox.h>
+#include <linux/ppp_defs.h>
 #include <linux/bpf.h>
 #include <linux/btf.h>
 #include <net/sch_generic.h>
@@ -12919,6 +12921,184 @@ __bpf_kfunc int bpf_icmp_send(struct __sk_buff *skb_ctx, int type, int code)
 	return 0;
 }
 
+/**
+ * bpf_skb_pppoe_encap() - Encapsulate an IPv4 or IPv6 packet in a
+ * PPPoE session header.
+ *
+ * Insert an 8 byte PPPoE session header, made of the 6 byte session
+ * header plus the 2 byte PPP protocol field, between the MAC header
+ * and the network header, and fill it in for the given session id.
+ * skb->protocol is set to ETH_P_PPP_SES so the skb reaches the PPPoE
+ * GRO/GSO support; the ethertype of the MAC header is left to the BPF
+ * program.
+ *
+ * A packet whose VLAN tag is still present in the packet data is
+ * rejected, as skb->protocol is then the VLAN ethertype.
+ *
+ * On GSO skbs, gso_size is reduced by the size of the inserted header
+ * and gso_segs is recomputed, like bpf_skb_adjust_room() does. With
+ * BPF_F_ADJ_ROOM_FIXED_GSO, gso_size is left unchanged and only
+ * gso_segs is recomputed; UDP GSO packets require this, as their
+ * gso_size is the datagram size.
+ *
+ * A call to this kfunc changes packet data. Therefore, at load time,
+ * all checks on pointers previously done by the verifier are
+ * invalidated and must be performed again, if the kfunc is used in
+ * combination with direct packet access.
+ *
+ * Parameters:
+ * @skb_ctx: Pointer to ctx (__sk_buff) in TC program. Cannot be NULL
+ * @sid: PPPoE session id, in network byte order
+ * @flags: BPF_F_ADJ_ROOM_FIXED_GSO to leave gso_size unchanged
+ *
+ * Return:
+ * * %0          - success
+ * * %-EINVAL    - unknown flags
+ * * %-ENOTSUPP  - skb->protocol is neither ETH_P_IP nor ETH_P_IPV6, the
+ *                 new length would exceed the maximum skb length, or the
+ *                 GSO metadata cannot be adjusted
+ * * %-ENOMEM    - the skb head could not be expanded
+ */
+__bpf_kfunc int bpf_skb_pppoe_encap(struct __sk_buff *skb_ctx, __be16 sid,
+				    u64 flags)
+{
+	struct sk_buff *skb = (struct sk_buff *)skb_ctx;
+	struct pppoe_hdr *ph;
+	u16 ppp_proto;
+	u32 off;
+	int ret;
+
+	if (flags & ~BPF_F_ADJ_ROOM_FIXED_GSO)
+		return -EINVAL;
+
+	if (skb->protocol != htons(ETH_P_IP) &&
+	    skb->protocol != htons(ETH_P_IPV6))
+		return -ENOTSUPP;
+
+	if (skb->len + PPPOE_SES_HLEN > BPF_SKB_MAX_LEN && !skb_is_gso(skb))
+		return -ENOTSUPP;
+
+	off = skb_mac_header_len(skb);
+
+	ret = bpf_skb_net_grow(skb, off, PPPOE_SES_HLEN, flags);
+	if (ret < 0)
+		return ret;
+
+	if (skb->protocol == htons(ETH_P_IP))
+		ppp_proto = PPP_IP;
+	else
+		ppp_proto = PPP_IPV6;
+
+	ph = (struct pppoe_hdr *)(skb->data + off);
+	ph->ver = 1;
+	ph->type = 1;
+	ph->code = 0;
+	ph->sid = sid;
+	ph->length = htons(skb->len - off - sizeof(*ph));
+	put_unaligned_be16(ppp_proto, (u8 *)ph + sizeof(*ph));
+
+	skb->protocol = htons(ETH_P_PPP_SES);
+	skb_reset_mac_len(skb);
+	if (skb_valid_dst(skb))
+		skb_dst_drop(skb);
+
+	__skb_reset_checksum_unnecessary(skb);
+	bpf_compute_data_pointers(skb);
+
+	return 0;
+}
+
+/**
+ * bpf_skb_pppoe_decap() - Remove the PPPoE session header from a
+ * packet.
+ *
+ * Remove the 8 byte PPPoE session header between the MAC header and
+ * the network header. skb->protocol is restored from the PPP protocol
+ * field; a payload with any other PPP protocol is rejected. The
+ * ethertype of the MAC header is left to the BPF program.
+ *
+ * A packet whose VLAN tag is still present in the packet data is
+ * rejected, as skb->protocol is then the VLAN ethertype.
+ *
+ * On GSO skbs, gso_size is increased by the size of the removed
+ * header and gso_segs is recomputed, like bpf_skb_adjust_room() does.
+ * With BPF_F_ADJ_ROOM_FIXED_GSO, gso_size is left unchanged and only
+ * gso_segs is recomputed.
+ *
+ * A call to this kfunc changes packet data. Therefore, at load time,
+ * all checks on pointers previously done by the verifier are
+ * invalidated and must be performed again, if the kfunc is used in
+ * combination with direct packet access.
+ *
+ * Parameters:
+ * @skb_ctx: Pointer to ctx (__sk_buff) in TC program. Cannot be NULL
+ * @flags: BPF_F_ADJ_ROOM_FIXED_GSO to leave gso_size unchanged
+ *
+ * Return:
+ * * %0          - success
+ * * %-ENOTSUPP  - skb->protocol is not ETH_P_PPP_SES, or the PPP
+ *                 protocol is neither PPP_IP nor PPP_IPV6
+ * * %-EINVAL    - unknown flags, the packet is shorter than the PPPoE
+ *                 session header, or no full L3 header would remain
+ *                 after decapsulation
+ * * %-ENOMEM    - the header is not linearly accessible
+ */
+__bpf_kfunc int bpf_skb_pppoe_decap(struct __sk_buff *skb_ctx, u64 flags)
+{
+	struct sk_buff *skb = (struct sk_buff *)skb_ctx;
+	__be16 inner_proto;
+	u32 inner_len, off;
+	u16 ppp_proto;
+	int ret;
+
+	if (flags & ~BPF_F_ADJ_ROOM_FIXED_GSO)
+		return -EINVAL;
+
+	if (skb->protocol != htons(ETH_P_PPP_SES))
+		return -ENOTSUPP;
+
+	off = skb_mac_header_len(skb);
+
+	if (skb->len < off + PPPOE_SES_HLEN)
+		return -EINVAL;
+
+	if (!pskb_may_pull(skb, off + PPPOE_SES_HLEN))
+		return -ENOMEM;
+
+	ppp_proto = get_unaligned_be16(skb->data + off +
+				       sizeof(struct pppoe_hdr));
+	switch (ppp_proto) {
+	case PPP_IP:
+		inner_proto = htons(ETH_P_IP);
+		inner_len = sizeof(struct iphdr);
+		break;
+	case PPP_IPV6:
+		inner_proto = htons(ETH_P_IPV6);
+		inner_len = sizeof(struct ipv6hdr);
+		break;
+	default:
+		return -ENOTSUPP;
+	}
+
+	/* A full inner L3 header must remain after decapsulation. */
+	if (skb->len - off - PPPOE_SES_HLEN < inner_len)
+		return -EINVAL;
+
+	ret = bpf_skb_net_shrink(skb, off, PPPOE_SES_HLEN, flags);
+	if (ret < 0)
+		return ret;
+
+	skb->protocol = inner_proto;
+	skb_reset_mac_len(skb);
+	if (skb_valid_dst(skb))
+		skb_dst_drop(skb);
+
+	__skb_reset_checksum_unnecessary(skb);
+	bpf_compute_data_pointers(skb);
+
+	return 0;
+}
+
 __bpf_kfunc_end_defs();
 
 int bpf_dynptr_from_skb_rdonly(struct __sk_buff *skb, u64 flags,
@@ -12965,6 +13145,11 @@ BTF_KFUNCS_START(bpf_kfunc_check_set_icmp_send)
 BTF_ID_FLAGS(func, bpf_icmp_send)
 BTF_KFUNCS_END(bpf_kfunc_check_set_icmp_send)
 
+BTF_KFUNCS_START(bpf_kfunc_check_set_skb_pppoe)
+BTF_ID_FLAGS(func, bpf_skb_pppoe_encap, KF_CHANGES_PKT)
+BTF_ID_FLAGS(func, bpf_skb_pppoe_decap, KF_CHANGES_PKT)
+BTF_KFUNCS_END(bpf_kfunc_check_set_skb_pppoe)
+
 static const struct btf_kfunc_id_set bpf_kfunc_set_skb = {
 	.owner = THIS_MODULE,
 	.set = &bpf_kfunc_check_set_skb,
@@ -13000,6 +13185,11 @@ static const struct btf_kfunc_id_set bpf_kfunc_set_icmp_send = {
 	.set = &bpf_kfunc_check_set_icmp_send,
 };
 
+static const struct btf_kfunc_id_set bpf_kfunc_set_skb_pppoe = {
+	.owner = THIS_MODULE,
+	.set = &bpf_kfunc_check_set_skb_pppoe,
+};
+
 static int __init bpf_kfunc_init(void)
 {
 	int ret;
@@ -13023,6 +13213,8 @@ static int __init bpf_kfunc_init(void)
 					       &bpf_kfunc_set_sock_addr);
 	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS, &bpf_kfunc_set_tcp_reqsk);
 	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SKB, &bpf_kfunc_set_icmp_send);
+	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS, &bpf_kfunc_set_skb_pppoe);
+	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_ACT, &bpf_kfunc_set_skb_pppoe);
 	return ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SOCK_OPS, &bpf_kfunc_set_sock_ops);
 }
 late_initcall(bpf_kfunc_init);
-- 
2.47.3