diff --git a/bpf/flows.c b/bpf/flows.c index 31e6b7cde79293672d8a3ac754a3eea2d46814f2..a0d2167fbbb50cb221155827cf8229af825317ec 100644 --- a/bpf/flows.c +++ b/bpf/flows.c @@ -80,7 +80,7 @@ static inline int flow_monitor(struct __sk_buff *skb, u8 direction) { id.direction = direction; // check if this packet need to be filtered if filtering feature is enabled - bool skip = check_and_do_flow_filtering(&id, pkt.flags); + bool skip = check_and_do_flow_filtering(&id, pkt.flags, 0); if (skip) { return TC_ACT_OK; } diff --git a/bpf/flows_filter.h b/bpf/flows_filter.h index 05520a9c253c95accc12ba5e4169cdde95b53bfc..3a541c6d5c1da3770b1a1742748b765ac68303da 100644 --- a/bpf/flows_filter.h +++ b/bpf/flows_filter.h @@ -37,7 +37,7 @@ static __always_inline int is_equal_ip(u8 *ip1, u8 *ip2, u8 len) { static __always_inline int do_flow_filter_lookup(flow_id *id, struct filter_key_t *key, filter_action *action, u8 len, u8 offset, - u16 flags) { + u16 flags, u32 drop_reason) { int result = 0; struct filter_value_t *rule = (struct filter_value_t *)bpf_map_lookup_elem(&filter_map, key); @@ -50,6 +50,7 @@ static __always_inline int do_flow_filter_lookup(flow_id *id, struct filter_key_ *action = rule->action; result++; } + // match specific rule protocol or use wildcard protocol if (rule->protocol == id->transport_protocol || rule->protocol == 0) { switch (id->transport_protocol) { @@ -188,6 +189,16 @@ static __always_inline int do_flow_filter_lookup(flow_id *id, struct filter_key_ goto end; } } + + if (rule->filter_drops) { + if (drop_reason != 0) { + BPF_PRINTK("drop filter matched\n"); + result++; + } else { + result = 0; + goto end; + } + } } end: BPF_PRINTK("result: %d action %d\n", result, *action); @@ -224,7 +235,8 @@ static __always_inline int flow_filter_setup_lookup_key(flow_id *id, struct filt /* * check if the flow match filter rule and return >= 1 if the flow is to be dropped */ -static __always_inline int is_flow_filtered(flow_id *id, filter_action *action, u16 flags) { +static __always_inline int is_flow_filtered(flow_id *id, filter_action *action, u16 flags, + u32 drop_reason) { struct filter_key_t key; u8 len, offset; int result = 0; @@ -238,7 +250,7 @@ static __always_inline int is_flow_filtered(flow_id *id, filter_action *action, return result; } - result = do_flow_filter_lookup(id, &key, action, len, offset, flags); + result = do_flow_filter_lookup(id, &key, action, len, offset, flags, drop_reason); // we have a match so return if (result > 0) { return result; @@ -250,7 +262,7 @@ static __always_inline int is_flow_filtered(flow_id *id, filter_action *action, return result; } - return do_flow_filter_lookup(id, &key, action, len, offset, flags); + return do_flow_filter_lookup(id, &key, action, len, offset, flags, drop_reason); } #endif //__FLOWS_FILTER_H__ diff --git a/bpf/headers/vmlinux_amd64.h b/bpf/headers/vmlinux_amd64.h index 8cac0d1787ebad16bfa960a50bcbd2640bd82a2a..529622317de8e50f405cdef4ccb54b0909acf80a 100644 --- a/bpf/headers/vmlinux_amd64.h +++ b/bpf/headers/vmlinux_amd64.h @@ -10776,76 +10776,334 @@ struct ip_conntrack_stat { }; enum skb_drop_reason { + /** + * @SKB_NOT_DROPPED_YET: skb is not dropped yet (used for no-drop case) + */ SKB_NOT_DROPPED_YET = 0, - SKB_CONSUMED = 1, - SKB_DROP_REASON_NOT_SPECIFIED = 2, - SKB_DROP_REASON_NO_SOCKET = 3, - SKB_DROP_REASON_PKT_TOO_SMALL = 4, - SKB_DROP_REASON_TCP_CSUM = 5, - SKB_DROP_REASON_SOCKET_FILTER = 6, - SKB_DROP_REASON_UDP_CSUM = 7, - SKB_DROP_REASON_NETFILTER_DROP = 8, - SKB_DROP_REASON_OTHERHOST = 9, - SKB_DROP_REASON_IP_CSUM = 10, - SKB_DROP_REASON_IP_INHDR = 11, - SKB_DROP_REASON_IP_RPFILTER = 12, - SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST = 13, - SKB_DROP_REASON_XFRM_POLICY = 14, - SKB_DROP_REASON_IP_NOPROTO = 15, - SKB_DROP_REASON_SOCKET_RCVBUFF = 16, - SKB_DROP_REASON_PROTO_MEM = 17, - SKB_DROP_REASON_TCP_MD5NOTFOUND = 18, - SKB_DROP_REASON_TCP_MD5UNEXPECTED = 19, - SKB_DROP_REASON_TCP_MD5FAILURE = 20, - SKB_DROP_REASON_SOCKET_BACKLOG = 21, - SKB_DROP_REASON_TCP_FLAGS = 22, - SKB_DROP_REASON_TCP_ZEROWINDOW = 23, - SKB_DROP_REASON_TCP_OLD_DATA = 24, - SKB_DROP_REASON_TCP_OVERWINDOW = 25, - SKB_DROP_REASON_TCP_OFOMERGE = 26, - SKB_DROP_REASON_TCP_RFC7323_PAWS = 27, - SKB_DROP_REASON_TCP_INVALID_SEQUENCE = 28, - SKB_DROP_REASON_TCP_RESET = 29, - SKB_DROP_REASON_TCP_INVALID_SYN = 30, - SKB_DROP_REASON_TCP_CLOSE = 31, - SKB_DROP_REASON_TCP_FASTOPEN = 32, - SKB_DROP_REASON_TCP_OLD_ACK = 33, - SKB_DROP_REASON_TCP_TOO_OLD_ACK = 34, - SKB_DROP_REASON_TCP_ACK_UNSENT_DATA = 35, - SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE = 36, - SKB_DROP_REASON_TCP_OFO_DROP = 37, - SKB_DROP_REASON_IP_OUTNOROUTES = 38, - SKB_DROP_REASON_BPF_CGROUP_EGRESS = 39, - SKB_DROP_REASON_IPV6DISABLED = 40, - SKB_DROP_REASON_NEIGH_CREATEFAIL = 41, - SKB_DROP_REASON_NEIGH_FAILED = 42, - SKB_DROP_REASON_NEIGH_QUEUEFULL = 43, - SKB_DROP_REASON_NEIGH_DEAD = 44, - SKB_DROP_REASON_TC_EGRESS = 45, - SKB_DROP_REASON_QDISC_DROP = 46, - SKB_DROP_REASON_CPU_BACKLOG = 47, - SKB_DROP_REASON_XDP = 48, - SKB_DROP_REASON_TC_INGRESS = 49, - SKB_DROP_REASON_UNHANDLED_PROTO = 50, - SKB_DROP_REASON_SKB_CSUM = 51, - SKB_DROP_REASON_SKB_GSO_SEG = 52, - SKB_DROP_REASON_SKB_UCOPY_FAULT = 53, - SKB_DROP_REASON_DEV_HDR = 54, - SKB_DROP_REASON_DEV_READY = 55, - SKB_DROP_REASON_FULL_RING = 56, - SKB_DROP_REASON_NOMEM = 57, - SKB_DROP_REASON_HDR_TRUNC = 58, - SKB_DROP_REASON_TAP_FILTER = 59, - SKB_DROP_REASON_TAP_TXFILTER = 60, - SKB_DROP_REASON_ICMP_CSUM = 61, - SKB_DROP_REASON_INVALID_PROTO = 62, - SKB_DROP_REASON_IP_INADDRERRORS = 63, - SKB_DROP_REASON_IP_INNOROUTES = 64, - SKB_DROP_REASON_PKT_TOO_BIG = 65, - SKB_DROP_REASON_DUP_FRAG = 66, - SKB_DROP_REASON_FRAG_REASM_TIMEOUT = 67, - SKB_DROP_REASON_FRAG_TOO_FAR = 68, - SKB_DROP_REASON_MAX = 69, + /** @SKB_CONSUMED: packet has been consumed */ + SKB_CONSUMED, + /** @SKB_DROP_REASON_NOT_SPECIFIED: drop reason is not specified */ + SKB_DROP_REASON_NOT_SPECIFIED, + /** + * @SKB_DROP_REASON_NO_SOCKET: no valid socket that can be used. + * Reason could be one of three cases: + * 1) no established/listening socket found during lookup process + * 2) no valid request socket during 3WHS process + * 3) no valid child socket during 3WHS process + */ + SKB_DROP_REASON_NO_SOCKET, + /** @SKB_DROP_REASON_PKT_TOO_SMALL: packet size is too small */ + SKB_DROP_REASON_PKT_TOO_SMALL, + /** @SKB_DROP_REASON_TCP_CSUM: TCP checksum error */ + SKB_DROP_REASON_TCP_CSUM, + /** @SKB_DROP_REASON_SOCKET_FILTER: dropped by socket filter */ + SKB_DROP_REASON_SOCKET_FILTER, + /** @SKB_DROP_REASON_UDP_CSUM: UDP checksum error */ + SKB_DROP_REASON_UDP_CSUM, + /** @SKB_DROP_REASON_NETFILTER_DROP: dropped by netfilter */ + SKB_DROP_REASON_NETFILTER_DROP, + /** + * @SKB_DROP_REASON_OTHERHOST: packet don't belong to current host + * (interface is in promisc mode) + */ + SKB_DROP_REASON_OTHERHOST, + /** @SKB_DROP_REASON_IP_CSUM: IP checksum error */ + SKB_DROP_REASON_IP_CSUM, + /** + * @SKB_DROP_REASON_IP_INHDR: there is something wrong with IP header (see + * IPSTATS_MIB_INHDRERRORS) + */ + SKB_DROP_REASON_IP_INHDR, + /** + * @SKB_DROP_REASON_IP_RPFILTER: IP rpfilter validate failed. see the + * document for rp_filter in ip-sysctl.rst for more information + */ + SKB_DROP_REASON_IP_RPFILTER, + /** + * @SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST: destination address of L2 is + * multicast, but L3 is unicast. + */ + SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST, + /** @SKB_DROP_REASON_XFRM_POLICY: xfrm policy check failed */ + SKB_DROP_REASON_XFRM_POLICY, + /** @SKB_DROP_REASON_IP_NOPROTO: no support for IP protocol */ + SKB_DROP_REASON_IP_NOPROTO, + /** @SKB_DROP_REASON_SOCKET_RCVBUFF: socket receive buff is full */ + SKB_DROP_REASON_SOCKET_RCVBUFF, + /** + * @SKB_DROP_REASON_PROTO_MEM: proto memory limition, such as udp packet + * drop out of udp_memory_allocated. + */ + SKB_DROP_REASON_PROTO_MEM, + /** + * @SKB_DROP_REASON_TCP_AUTH_HDR: TCP-MD5 or TCP-AO hashes are met + * twice or set incorrectly. + */ + SKB_DROP_REASON_TCP_AUTH_HDR, + /** + * @SKB_DROP_REASON_TCP_MD5NOTFOUND: no MD5 hash and one expected, + * corresponding to LINUX_MIB_TCPMD5NOTFOUND + */ + SKB_DROP_REASON_TCP_MD5NOTFOUND, + /** + * @SKB_DROP_REASON_TCP_MD5UNEXPECTED: MD5 hash and we're not expecting + * one, corresponding to LINUX_MIB_TCPMD5UNEXPECTED + */ + SKB_DROP_REASON_TCP_MD5UNEXPECTED, + /** + * @SKB_DROP_REASON_TCP_MD5FAILURE: MD5 hash and its wrong, corresponding + * to LINUX_MIB_TCPMD5FAILURE + */ + SKB_DROP_REASON_TCP_MD5FAILURE, + /** + * @SKB_DROP_REASON_TCP_AONOTFOUND: no TCP-AO hash and one was expected, + * corresponding to LINUX_MIB_TCPAOREQUIRED + */ + SKB_DROP_REASON_TCP_AONOTFOUND, + /** + * @SKB_DROP_REASON_TCP_AOUNEXPECTED: TCP-AO hash is present and it + * was not expected, corresponding to LINUX_MIB_TCPAOKEYNOTFOUND + */ + SKB_DROP_REASON_TCP_AOUNEXPECTED, + /** + * @SKB_DROP_REASON_TCP_AOKEYNOTFOUND: TCP-AO key is unknown, + * corresponding to LINUX_MIB_TCPAOKEYNOTFOUND + */ + SKB_DROP_REASON_TCP_AOKEYNOTFOUND, + /** + * @SKB_DROP_REASON_TCP_AOFAILURE: TCP-AO hash is wrong, + * corresponding to LINUX_MIB_TCPAOBAD + */ + SKB_DROP_REASON_TCP_AOFAILURE, + /** + * @SKB_DROP_REASON_SOCKET_BACKLOG: failed to add skb to socket backlog ( + * see LINUX_MIB_TCPBACKLOGDROP) + */ + SKB_DROP_REASON_SOCKET_BACKLOG, + /** @SKB_DROP_REASON_TCP_FLAGS: TCP flags invalid */ + SKB_DROP_REASON_TCP_FLAGS, + /** + * @SKB_DROP_REASON_TCP_ABORT_ON_DATA: abort on data, corresponding to + * LINUX_MIB_TCPABORTONDATA + */ + SKB_DROP_REASON_TCP_ABORT_ON_DATA, + /** + * @SKB_DROP_REASON_TCP_ZEROWINDOW: TCP receive window size is zero, + * see LINUX_MIB_TCPZEROWINDOWDROP + */ + SKB_DROP_REASON_TCP_ZEROWINDOW, + /** + * @SKB_DROP_REASON_TCP_OLD_DATA: the TCP data reveived is already + * received before (spurious retrans may happened), see + * LINUX_MIB_DELAYEDACKLOST + */ + SKB_DROP_REASON_TCP_OLD_DATA, + /** + * @SKB_DROP_REASON_TCP_OVERWINDOW: the TCP data is out of window, + * the seq of the first byte exceed the right edges of receive + * window + */ + SKB_DROP_REASON_TCP_OVERWINDOW, + /** + * @SKB_DROP_REASON_TCP_OFOMERGE: the data of skb is already in the ofo + * queue, corresponding to LINUX_MIB_TCPOFOMERGE + */ + SKB_DROP_REASON_TCP_OFOMERGE, + /** + * @SKB_DROP_REASON_TCP_RFC7323_PAWS: PAWS check, corresponding to + * LINUX_MIB_PAWSESTABREJECTED, LINUX_MIB_PAWSACTIVEREJECTED + */ + SKB_DROP_REASON_TCP_RFC7323_PAWS, + /** @SKB_DROP_REASON_TCP_OLD_SEQUENCE: Old SEQ field (duplicate packet) */ + SKB_DROP_REASON_TCP_OLD_SEQUENCE, + /** @SKB_DROP_REASON_TCP_INVALID_SEQUENCE: Not acceptable SEQ field */ + SKB_DROP_REASON_TCP_INVALID_SEQUENCE, + /** + * @SKB_DROP_REASON_TCP_INVALID_ACK_SEQUENCE: Not acceptable ACK SEQ + * field because ack sequence is not in the window between snd_una + * and snd_nxt + */ + SKB_DROP_REASON_TCP_INVALID_ACK_SEQUENCE, + /** @SKB_DROP_REASON_TCP_RESET: Invalid RST packet */ + SKB_DROP_REASON_TCP_RESET, + /** + * @SKB_DROP_REASON_TCP_INVALID_SYN: Incoming packet has unexpected + * SYN flag + */ + SKB_DROP_REASON_TCP_INVALID_SYN, + /** @SKB_DROP_REASON_TCP_CLOSE: TCP socket in CLOSE state */ + SKB_DROP_REASON_TCP_CLOSE, + /** @SKB_DROP_REASON_TCP_FASTOPEN: dropped by FASTOPEN request socket */ + SKB_DROP_REASON_TCP_FASTOPEN, + /** @SKB_DROP_REASON_TCP_OLD_ACK: TCP ACK is old, but in window */ + SKB_DROP_REASON_TCP_OLD_ACK, + /** @SKB_DROP_REASON_TCP_TOO_OLD_ACK: TCP ACK is too old */ + SKB_DROP_REASON_TCP_TOO_OLD_ACK, + /** + * @SKB_DROP_REASON_TCP_ACK_UNSENT_DATA: TCP ACK for data we haven't + * sent yet + */ + SKB_DROP_REASON_TCP_ACK_UNSENT_DATA, + /** @SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE: pruned from TCP OFO queue */ + SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE, + /** @SKB_DROP_REASON_TCP_OFO_DROP: data already in receive queue */ + SKB_DROP_REASON_TCP_OFO_DROP, + /** @SKB_DROP_REASON_IP_OUTNOROUTES: route lookup failed */ + SKB_DROP_REASON_IP_OUTNOROUTES, + /** + * @SKB_DROP_REASON_BPF_CGROUP_EGRESS: dropped by BPF_PROG_TYPE_CGROUP_SKB + * eBPF program + */ + SKB_DROP_REASON_BPF_CGROUP_EGRESS, + /** @SKB_DROP_REASON_IPV6DISABLED: IPv6 is disabled on the device */ + SKB_DROP_REASON_IPV6DISABLED, + /** @SKB_DROP_REASON_NEIGH_CREATEFAIL: failed to create neigh entry */ + SKB_DROP_REASON_NEIGH_CREATEFAIL, + /** @SKB_DROP_REASON_NEIGH_FAILED: neigh entry in failed state */ + SKB_DROP_REASON_NEIGH_FAILED, + /** @SKB_DROP_REASON_NEIGH_QUEUEFULL: arp_queue for neigh entry is full */ + SKB_DROP_REASON_NEIGH_QUEUEFULL, + /** @SKB_DROP_REASON_NEIGH_DEAD: neigh entry is dead */ + SKB_DROP_REASON_NEIGH_DEAD, + /** @SKB_DROP_REASON_TC_EGRESS: dropped in TC egress HOOK */ + SKB_DROP_REASON_TC_EGRESS, + /** @SKB_DROP_REASON_SECURITY_HOOK: dropped due to security HOOK */ + SKB_DROP_REASON_SECURITY_HOOK, + /** + * @SKB_DROP_REASON_QDISC_DROP: dropped by qdisc when packet outputting ( + * failed to enqueue to current qdisc) + */ + SKB_DROP_REASON_QDISC_DROP, + /** + * @SKB_DROP_REASON_CPU_BACKLOG: failed to enqueue the skb to the per CPU + * backlog queue. This can be caused by backlog queue full (see + * netdev_max_backlog in net.rst) or RPS flow limit + */ + SKB_DROP_REASON_CPU_BACKLOG, + /** @SKB_DROP_REASON_XDP: dropped by XDP in input path */ + SKB_DROP_REASON_XDP, + /** @SKB_DROP_REASON_TC_INGRESS: dropped in TC ingress HOOK */ + SKB_DROP_REASON_TC_INGRESS, + /** @SKB_DROP_REASON_UNHANDLED_PROTO: protocol not implemented or not supported */ + SKB_DROP_REASON_UNHANDLED_PROTO, + /** @SKB_DROP_REASON_SKB_CSUM: sk_buff checksum computation error */ + SKB_DROP_REASON_SKB_CSUM, + /** @SKB_DROP_REASON_SKB_GSO_SEG: gso segmentation error */ + SKB_DROP_REASON_SKB_GSO_SEG, + /** + * @SKB_DROP_REASON_SKB_UCOPY_FAULT: failed to copy data from user space, + * e.g., via zerocopy_sg_from_iter() or skb_orphan_frags_rx() + */ + SKB_DROP_REASON_SKB_UCOPY_FAULT, + /** @SKB_DROP_REASON_DEV_HDR: device driver specific header/metadata is invalid */ + SKB_DROP_REASON_DEV_HDR, + /** + * @SKB_DROP_REASON_DEV_READY: the device is not ready to xmit/recv due to + * any of its data structure that is not up/ready/initialized, + * e.g., the IFF_UP is not set, or driver specific tun->tfiles[txq] + * is not initialized + */ + SKB_DROP_REASON_DEV_READY, + /** @SKB_DROP_REASON_FULL_RING: ring buffer is full */ + SKB_DROP_REASON_FULL_RING, + /** @SKB_DROP_REASON_NOMEM: error due to OOM */ + SKB_DROP_REASON_NOMEM, + /** + * @SKB_DROP_REASON_HDR_TRUNC: failed to trunc/extract the header from + * networking data, e.g., failed to pull the protocol header from + * frags via pskb_may_pull() + */ + SKB_DROP_REASON_HDR_TRUNC, + /** + * @SKB_DROP_REASON_TAP_FILTER: dropped by (ebpf) filter directly attached + * to tun/tap, e.g., via TUNSETFILTEREBPF + */ + SKB_DROP_REASON_TAP_FILTER, + /** + * @SKB_DROP_REASON_TAP_TXFILTER: dropped by tx filter implemented at + * tun/tap, e.g., check_filter() + */ + SKB_DROP_REASON_TAP_TXFILTER, + /** @SKB_DROP_REASON_ICMP_CSUM: ICMP checksum error */ + SKB_DROP_REASON_ICMP_CSUM, + /** + * @SKB_DROP_REASON_INVALID_PROTO: the packet doesn't follow RFC 2211, + * such as a broadcasts ICMP_TIMESTAMP + */ + SKB_DROP_REASON_INVALID_PROTO, + /** + * @SKB_DROP_REASON_IP_INADDRERRORS: host unreachable, corresponding to + * IPSTATS_MIB_INADDRERRORS + */ + SKB_DROP_REASON_IP_INADDRERRORS, + /** + * @SKB_DROP_REASON_IP_INNOROUTES: network unreachable, corresponding to + * IPSTATS_MIB_INADDRERRORS + */ + SKB_DROP_REASON_IP_INNOROUTES, + /** + * @SKB_DROP_REASON_PKT_TOO_BIG: packet size is too big (maybe exceed the + * MTU) + */ + SKB_DROP_REASON_PKT_TOO_BIG, + /** @SKB_DROP_REASON_DUP_FRAG: duplicate fragment */ + SKB_DROP_REASON_DUP_FRAG, + /** @SKB_DROP_REASON_FRAG_REASM_TIMEOUT: fragment reassembly timeout */ + SKB_DROP_REASON_FRAG_REASM_TIMEOUT, + /** + * @SKB_DROP_REASON_FRAG_TOO_FAR: ipv4 fragment too far. + * (/proc/sys/net/ipv4/ipfrag_max_dist) + */ + SKB_DROP_REASON_FRAG_TOO_FAR, + /** + * @SKB_DROP_REASON_TCP_MINTTL: ipv4 ttl or ipv6 hoplimit below + * the threshold (IP_MINTTL or IPV6_MINHOPCOUNT). + */ + SKB_DROP_REASON_TCP_MINTTL, + /** @SKB_DROP_REASON_IPV6_BAD_EXTHDR: Bad IPv6 extension header. */ + SKB_DROP_REASON_IPV6_BAD_EXTHDR, + /** @SKB_DROP_REASON_IPV6_NDISC_FRAG: invalid frag (suppress_frag_ndisc). */ + SKB_DROP_REASON_IPV6_NDISC_FRAG, + /** @SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT: invalid hop limit. */ + SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT, + /** @SKB_DROP_REASON_IPV6_NDISC_BAD_CODE: invalid NDISC icmp6 code. */ + SKB_DROP_REASON_IPV6_NDISC_BAD_CODE, + /** @SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS: invalid NDISC options. */ + SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS, + /** + * @SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST: NEIGHBOUR SOLICITATION + * for another host. + */ + SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST, + /** @SKB_DROP_REASON_QUEUE_PURGE: bulk free. */ + SKB_DROP_REASON_QUEUE_PURGE, + /** + * @SKB_DROP_REASON_TC_COOKIE_ERROR: An error occurred whilst + * processing a tc ext cookie. + */ + SKB_DROP_REASON_TC_COOKIE_ERROR, + /** + * @SKB_DROP_REASON_PACKET_SOCK_ERROR: generic packet socket errors + * after its filter matches an incoming packet. + */ + SKB_DROP_REASON_PACKET_SOCK_ERROR, + /** @SKB_DROP_REASON_TC_CHAIN_NOTFOUND: tc chain lookup failed. */ + SKB_DROP_REASON_TC_CHAIN_NOTFOUND, + /** + * @SKB_DROP_REASON_TC_RECLASSIFY_LOOP: tc exceeded max reclassify loop + * iterations. + */ + SKB_DROP_REASON_TC_RECLASSIFY_LOOP, + /** + * @SKB_DROP_REASON_MAX: the maximum of core drop reasons, which + * shouldn't be used as a real 'reason' - only for tracing code gen + */ + SKB_DROP_REASON_MAX, + /** + * @SKB_DROP_REASON_SUBSYS_MASK: subsystem mask in drop reasons, + * see &enum skb_drop_reason_subsys + */ + SKB_DROP_REASON_SUBSYS_MASK = 0xffff0000, }; struct skb_ext { diff --git a/bpf/headers/vmlinux_arm64.h b/bpf/headers/vmlinux_arm64.h index 6ea58d6b772b1b1587bcb7b8157feb572d7f53da..f6826170d4b14c197839e1868407f1188225378c 100644 --- a/bpf/headers/vmlinux_arm64.h +++ b/bpf/headers/vmlinux_arm64.h @@ -20666,76 +20666,334 @@ struct sock_hash_seq_info { }; enum skb_drop_reason { + /** + * @SKB_NOT_DROPPED_YET: skb is not dropped yet (used for no-drop case) + */ SKB_NOT_DROPPED_YET = 0, - SKB_CONSUMED = 1, - SKB_DROP_REASON_NOT_SPECIFIED = 2, - SKB_DROP_REASON_NO_SOCKET = 3, - SKB_DROP_REASON_PKT_TOO_SMALL = 4, - SKB_DROP_REASON_TCP_CSUM = 5, - SKB_DROP_REASON_SOCKET_FILTER = 6, - SKB_DROP_REASON_UDP_CSUM = 7, - SKB_DROP_REASON_NETFILTER_DROP = 8, - SKB_DROP_REASON_OTHERHOST = 9, - SKB_DROP_REASON_IP_CSUM = 10, - SKB_DROP_REASON_IP_INHDR = 11, - SKB_DROP_REASON_IP_RPFILTER = 12, - SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST = 13, - SKB_DROP_REASON_XFRM_POLICY = 14, - SKB_DROP_REASON_IP_NOPROTO = 15, - SKB_DROP_REASON_SOCKET_RCVBUFF = 16, - SKB_DROP_REASON_PROTO_MEM = 17, - SKB_DROP_REASON_TCP_MD5NOTFOUND = 18, - SKB_DROP_REASON_TCP_MD5UNEXPECTED = 19, - SKB_DROP_REASON_TCP_MD5FAILURE = 20, - SKB_DROP_REASON_SOCKET_BACKLOG = 21, - SKB_DROP_REASON_TCP_FLAGS = 22, - SKB_DROP_REASON_TCP_ZEROWINDOW = 23, - SKB_DROP_REASON_TCP_OLD_DATA = 24, - SKB_DROP_REASON_TCP_OVERWINDOW = 25, - SKB_DROP_REASON_TCP_OFOMERGE = 26, - SKB_DROP_REASON_TCP_RFC7323_PAWS = 27, - SKB_DROP_REASON_TCP_INVALID_SEQUENCE = 28, - SKB_DROP_REASON_TCP_RESET = 29, - SKB_DROP_REASON_TCP_INVALID_SYN = 30, - SKB_DROP_REASON_TCP_CLOSE = 31, - SKB_DROP_REASON_TCP_FASTOPEN = 32, - SKB_DROP_REASON_TCP_OLD_ACK = 33, - SKB_DROP_REASON_TCP_TOO_OLD_ACK = 34, - SKB_DROP_REASON_TCP_ACK_UNSENT_DATA = 35, - SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE = 36, - SKB_DROP_REASON_TCP_OFO_DROP = 37, - SKB_DROP_REASON_IP_OUTNOROUTES = 38, - SKB_DROP_REASON_BPF_CGROUP_EGRESS = 39, - SKB_DROP_REASON_IPV6DISABLED = 40, - SKB_DROP_REASON_NEIGH_CREATEFAIL = 41, - SKB_DROP_REASON_NEIGH_FAILED = 42, - SKB_DROP_REASON_NEIGH_QUEUEFULL = 43, - SKB_DROP_REASON_NEIGH_DEAD = 44, - SKB_DROP_REASON_TC_EGRESS = 45, - SKB_DROP_REASON_QDISC_DROP = 46, - SKB_DROP_REASON_CPU_BACKLOG = 47, - SKB_DROP_REASON_XDP = 48, - SKB_DROP_REASON_TC_INGRESS = 49, - SKB_DROP_REASON_UNHANDLED_PROTO = 50, - SKB_DROP_REASON_SKB_CSUM = 51, - SKB_DROP_REASON_SKB_GSO_SEG = 52, - SKB_DROP_REASON_SKB_UCOPY_FAULT = 53, - SKB_DROP_REASON_DEV_HDR = 54, - SKB_DROP_REASON_DEV_READY = 55, - SKB_DROP_REASON_FULL_RING = 56, - SKB_DROP_REASON_NOMEM = 57, - SKB_DROP_REASON_HDR_TRUNC = 58, - SKB_DROP_REASON_TAP_FILTER = 59, - SKB_DROP_REASON_TAP_TXFILTER = 60, - SKB_DROP_REASON_ICMP_CSUM = 61, - SKB_DROP_REASON_INVALID_PROTO = 62, - SKB_DROP_REASON_IP_INADDRERRORS = 63, - SKB_DROP_REASON_IP_INNOROUTES = 64, - SKB_DROP_REASON_PKT_TOO_BIG = 65, - SKB_DROP_REASON_DUP_FRAG = 66, - SKB_DROP_REASON_FRAG_REASM_TIMEOUT = 67, - SKB_DROP_REASON_FRAG_TOO_FAR = 68, - SKB_DROP_REASON_MAX = 69, + /** @SKB_CONSUMED: packet has been consumed */ + SKB_CONSUMED, + /** @SKB_DROP_REASON_NOT_SPECIFIED: drop reason is not specified */ + SKB_DROP_REASON_NOT_SPECIFIED, + /** + * @SKB_DROP_REASON_NO_SOCKET: no valid socket that can be used. + * Reason could be one of three cases: + * 1) no established/listening socket found during lookup process + * 2) no valid request socket during 3WHS process + * 3) no valid child socket during 3WHS process + */ + SKB_DROP_REASON_NO_SOCKET, + /** @SKB_DROP_REASON_PKT_TOO_SMALL: packet size is too small */ + SKB_DROP_REASON_PKT_TOO_SMALL, + /** @SKB_DROP_REASON_TCP_CSUM: TCP checksum error */ + SKB_DROP_REASON_TCP_CSUM, + /** @SKB_DROP_REASON_SOCKET_FILTER: dropped by socket filter */ + SKB_DROP_REASON_SOCKET_FILTER, + /** @SKB_DROP_REASON_UDP_CSUM: UDP checksum error */ + SKB_DROP_REASON_UDP_CSUM, + /** @SKB_DROP_REASON_NETFILTER_DROP: dropped by netfilter */ + SKB_DROP_REASON_NETFILTER_DROP, + /** + * @SKB_DROP_REASON_OTHERHOST: packet don't belong to current host + * (interface is in promisc mode) + */ + SKB_DROP_REASON_OTHERHOST, + /** @SKB_DROP_REASON_IP_CSUM: IP checksum error */ + SKB_DROP_REASON_IP_CSUM, + /** + * @SKB_DROP_REASON_IP_INHDR: there is something wrong with IP header (see + * IPSTATS_MIB_INHDRERRORS) + */ + SKB_DROP_REASON_IP_INHDR, + /** + * @SKB_DROP_REASON_IP_RPFILTER: IP rpfilter validate failed. see the + * document for rp_filter in ip-sysctl.rst for more information + */ + SKB_DROP_REASON_IP_RPFILTER, + /** + * @SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST: destination address of L2 is + * multicast, but L3 is unicast. + */ + SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST, + /** @SKB_DROP_REASON_XFRM_POLICY: xfrm policy check failed */ + SKB_DROP_REASON_XFRM_POLICY, + /** @SKB_DROP_REASON_IP_NOPROTO: no support for IP protocol */ + SKB_DROP_REASON_IP_NOPROTO, + /** @SKB_DROP_REASON_SOCKET_RCVBUFF: socket receive buff is full */ + SKB_DROP_REASON_SOCKET_RCVBUFF, + /** + * @SKB_DROP_REASON_PROTO_MEM: proto memory limition, such as udp packet + * drop out of udp_memory_allocated. + */ + SKB_DROP_REASON_PROTO_MEM, + /** + * @SKB_DROP_REASON_TCP_AUTH_HDR: TCP-MD5 or TCP-AO hashes are met + * twice or set incorrectly. + */ + SKB_DROP_REASON_TCP_AUTH_HDR, + /** + * @SKB_DROP_REASON_TCP_MD5NOTFOUND: no MD5 hash and one expected, + * corresponding to LINUX_MIB_TCPMD5NOTFOUND + */ + SKB_DROP_REASON_TCP_MD5NOTFOUND, + /** + * @SKB_DROP_REASON_TCP_MD5UNEXPECTED: MD5 hash and we're not expecting + * one, corresponding to LINUX_MIB_TCPMD5UNEXPECTED + */ + SKB_DROP_REASON_TCP_MD5UNEXPECTED, + /** + * @SKB_DROP_REASON_TCP_MD5FAILURE: MD5 hash and its wrong, corresponding + * to LINUX_MIB_TCPMD5FAILURE + */ + SKB_DROP_REASON_TCP_MD5FAILURE, + /** + * @SKB_DROP_REASON_TCP_AONOTFOUND: no TCP-AO hash and one was expected, + * corresponding to LINUX_MIB_TCPAOREQUIRED + */ + SKB_DROP_REASON_TCP_AONOTFOUND, + /** + * @SKB_DROP_REASON_TCP_AOUNEXPECTED: TCP-AO hash is present and it + * was not expected, corresponding to LINUX_MIB_TCPAOKEYNOTFOUND + */ + SKB_DROP_REASON_TCP_AOUNEXPECTED, + /** + * @SKB_DROP_REASON_TCP_AOKEYNOTFOUND: TCP-AO key is unknown, + * corresponding to LINUX_MIB_TCPAOKEYNOTFOUND + */ + SKB_DROP_REASON_TCP_AOKEYNOTFOUND, + /** + * @SKB_DROP_REASON_TCP_AOFAILURE: TCP-AO hash is wrong, + * corresponding to LINUX_MIB_TCPAOBAD + */ + SKB_DROP_REASON_TCP_AOFAILURE, + /** + * @SKB_DROP_REASON_SOCKET_BACKLOG: failed to add skb to socket backlog ( + * see LINUX_MIB_TCPBACKLOGDROP) + */ + SKB_DROP_REASON_SOCKET_BACKLOG, + /** @SKB_DROP_REASON_TCP_FLAGS: TCP flags invalid */ + SKB_DROP_REASON_TCP_FLAGS, + /** + * @SKB_DROP_REASON_TCP_ABORT_ON_DATA: abort on data, corresponding to + * LINUX_MIB_TCPABORTONDATA + */ + SKB_DROP_REASON_TCP_ABORT_ON_DATA, + /** + * @SKB_DROP_REASON_TCP_ZEROWINDOW: TCP receive window size is zero, + * see LINUX_MIB_TCPZEROWINDOWDROP + */ + SKB_DROP_REASON_TCP_ZEROWINDOW, + /** + * @SKB_DROP_REASON_TCP_OLD_DATA: the TCP data reveived is already + * received before (spurious retrans may happened), see + * LINUX_MIB_DELAYEDACKLOST + */ + SKB_DROP_REASON_TCP_OLD_DATA, + /** + * @SKB_DROP_REASON_TCP_OVERWINDOW: the TCP data is out of window, + * the seq of the first byte exceed the right edges of receive + * window + */ + SKB_DROP_REASON_TCP_OVERWINDOW, + /** + * @SKB_DROP_REASON_TCP_OFOMERGE: the data of skb is already in the ofo + * queue, corresponding to LINUX_MIB_TCPOFOMERGE + */ + SKB_DROP_REASON_TCP_OFOMERGE, + /** + * @SKB_DROP_REASON_TCP_RFC7323_PAWS: PAWS check, corresponding to + * LINUX_MIB_PAWSESTABREJECTED, LINUX_MIB_PAWSACTIVEREJECTED + */ + SKB_DROP_REASON_TCP_RFC7323_PAWS, + /** @SKB_DROP_REASON_TCP_OLD_SEQUENCE: Old SEQ field (duplicate packet) */ + SKB_DROP_REASON_TCP_OLD_SEQUENCE, + /** @SKB_DROP_REASON_TCP_INVALID_SEQUENCE: Not acceptable SEQ field */ + SKB_DROP_REASON_TCP_INVALID_SEQUENCE, + /** + * @SKB_DROP_REASON_TCP_INVALID_ACK_SEQUENCE: Not acceptable ACK SEQ + * field because ack sequence is not in the window between snd_una + * and snd_nxt + */ + SKB_DROP_REASON_TCP_INVALID_ACK_SEQUENCE, + /** @SKB_DROP_REASON_TCP_RESET: Invalid RST packet */ + SKB_DROP_REASON_TCP_RESET, + /** + * @SKB_DROP_REASON_TCP_INVALID_SYN: Incoming packet has unexpected + * SYN flag + */ + SKB_DROP_REASON_TCP_INVALID_SYN, + /** @SKB_DROP_REASON_TCP_CLOSE: TCP socket in CLOSE state */ + SKB_DROP_REASON_TCP_CLOSE, + /** @SKB_DROP_REASON_TCP_FASTOPEN: dropped by FASTOPEN request socket */ + SKB_DROP_REASON_TCP_FASTOPEN, + /** @SKB_DROP_REASON_TCP_OLD_ACK: TCP ACK is old, but in window */ + SKB_DROP_REASON_TCP_OLD_ACK, + /** @SKB_DROP_REASON_TCP_TOO_OLD_ACK: TCP ACK is too old */ + SKB_DROP_REASON_TCP_TOO_OLD_ACK, + /** + * @SKB_DROP_REASON_TCP_ACK_UNSENT_DATA: TCP ACK for data we haven't + * sent yet + */ + SKB_DROP_REASON_TCP_ACK_UNSENT_DATA, + /** @SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE: pruned from TCP OFO queue */ + SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE, + /** @SKB_DROP_REASON_TCP_OFO_DROP: data already in receive queue */ + SKB_DROP_REASON_TCP_OFO_DROP, + /** @SKB_DROP_REASON_IP_OUTNOROUTES: route lookup failed */ + SKB_DROP_REASON_IP_OUTNOROUTES, + /** + * @SKB_DROP_REASON_BPF_CGROUP_EGRESS: dropped by BPF_PROG_TYPE_CGROUP_SKB + * eBPF program + */ + SKB_DROP_REASON_BPF_CGROUP_EGRESS, + /** @SKB_DROP_REASON_IPV6DISABLED: IPv6 is disabled on the device */ + SKB_DROP_REASON_IPV6DISABLED, + /** @SKB_DROP_REASON_NEIGH_CREATEFAIL: failed to create neigh entry */ + SKB_DROP_REASON_NEIGH_CREATEFAIL, + /** @SKB_DROP_REASON_NEIGH_FAILED: neigh entry in failed state */ + SKB_DROP_REASON_NEIGH_FAILED, + /** @SKB_DROP_REASON_NEIGH_QUEUEFULL: arp_queue for neigh entry is full */ + SKB_DROP_REASON_NEIGH_QUEUEFULL, + /** @SKB_DROP_REASON_NEIGH_DEAD: neigh entry is dead */ + SKB_DROP_REASON_NEIGH_DEAD, + /** @SKB_DROP_REASON_TC_EGRESS: dropped in TC egress HOOK */ + SKB_DROP_REASON_TC_EGRESS, + /** @SKB_DROP_REASON_SECURITY_HOOK: dropped due to security HOOK */ + SKB_DROP_REASON_SECURITY_HOOK, + /** + * @SKB_DROP_REASON_QDISC_DROP: dropped by qdisc when packet outputting ( + * failed to enqueue to current qdisc) + */ + SKB_DROP_REASON_QDISC_DROP, + /** + * @SKB_DROP_REASON_CPU_BACKLOG: failed to enqueue the skb to the per CPU + * backlog queue. This can be caused by backlog queue full (see + * netdev_max_backlog in net.rst) or RPS flow limit + */ + SKB_DROP_REASON_CPU_BACKLOG, + /** @SKB_DROP_REASON_XDP: dropped by XDP in input path */ + SKB_DROP_REASON_XDP, + /** @SKB_DROP_REASON_TC_INGRESS: dropped in TC ingress HOOK */ + SKB_DROP_REASON_TC_INGRESS, + /** @SKB_DROP_REASON_UNHANDLED_PROTO: protocol not implemented or not supported */ + SKB_DROP_REASON_UNHANDLED_PROTO, + /** @SKB_DROP_REASON_SKB_CSUM: sk_buff checksum computation error */ + SKB_DROP_REASON_SKB_CSUM, + /** @SKB_DROP_REASON_SKB_GSO_SEG: gso segmentation error */ + SKB_DROP_REASON_SKB_GSO_SEG, + /** + * @SKB_DROP_REASON_SKB_UCOPY_FAULT: failed to copy data from user space, + * e.g., via zerocopy_sg_from_iter() or skb_orphan_frags_rx() + */ + SKB_DROP_REASON_SKB_UCOPY_FAULT, + /** @SKB_DROP_REASON_DEV_HDR: device driver specific header/metadata is invalid */ + SKB_DROP_REASON_DEV_HDR, + /** + * @SKB_DROP_REASON_DEV_READY: the device is not ready to xmit/recv due to + * any of its data structure that is not up/ready/initialized, + * e.g., the IFF_UP is not set, or driver specific tun->tfiles[txq] + * is not initialized + */ + SKB_DROP_REASON_DEV_READY, + /** @SKB_DROP_REASON_FULL_RING: ring buffer is full */ + SKB_DROP_REASON_FULL_RING, + /** @SKB_DROP_REASON_NOMEM: error due to OOM */ + SKB_DROP_REASON_NOMEM, + /** + * @SKB_DROP_REASON_HDR_TRUNC: failed to trunc/extract the header from + * networking data, e.g., failed to pull the protocol header from + * frags via pskb_may_pull() + */ + SKB_DROP_REASON_HDR_TRUNC, + /** + * @SKB_DROP_REASON_TAP_FILTER: dropped by (ebpf) filter directly attached + * to tun/tap, e.g., via TUNSETFILTEREBPF + */ + SKB_DROP_REASON_TAP_FILTER, + /** + * @SKB_DROP_REASON_TAP_TXFILTER: dropped by tx filter implemented at + * tun/tap, e.g., check_filter() + */ + SKB_DROP_REASON_TAP_TXFILTER, + /** @SKB_DROP_REASON_ICMP_CSUM: ICMP checksum error */ + SKB_DROP_REASON_ICMP_CSUM, + /** + * @SKB_DROP_REASON_INVALID_PROTO: the packet doesn't follow RFC 2211, + * such as a broadcasts ICMP_TIMESTAMP + */ + SKB_DROP_REASON_INVALID_PROTO, + /** + * @SKB_DROP_REASON_IP_INADDRERRORS: host unreachable, corresponding to + * IPSTATS_MIB_INADDRERRORS + */ + SKB_DROP_REASON_IP_INADDRERRORS, + /** + * @SKB_DROP_REASON_IP_INNOROUTES: network unreachable, corresponding to + * IPSTATS_MIB_INADDRERRORS + */ + SKB_DROP_REASON_IP_INNOROUTES, + /** + * @SKB_DROP_REASON_PKT_TOO_BIG: packet size is too big (maybe exceed the + * MTU) + */ + SKB_DROP_REASON_PKT_TOO_BIG, + /** @SKB_DROP_REASON_DUP_FRAG: duplicate fragment */ + SKB_DROP_REASON_DUP_FRAG, + /** @SKB_DROP_REASON_FRAG_REASM_TIMEOUT: fragment reassembly timeout */ + SKB_DROP_REASON_FRAG_REASM_TIMEOUT, + /** + * @SKB_DROP_REASON_FRAG_TOO_FAR: ipv4 fragment too far. + * (/proc/sys/net/ipv4/ipfrag_max_dist) + */ + SKB_DROP_REASON_FRAG_TOO_FAR, + /** + * @SKB_DROP_REASON_TCP_MINTTL: ipv4 ttl or ipv6 hoplimit below + * the threshold (IP_MINTTL or IPV6_MINHOPCOUNT). + */ + SKB_DROP_REASON_TCP_MINTTL, + /** @SKB_DROP_REASON_IPV6_BAD_EXTHDR: Bad IPv6 extension header. */ + SKB_DROP_REASON_IPV6_BAD_EXTHDR, + /** @SKB_DROP_REASON_IPV6_NDISC_FRAG: invalid frag (suppress_frag_ndisc). */ + SKB_DROP_REASON_IPV6_NDISC_FRAG, + /** @SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT: invalid hop limit. */ + SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT, + /** @SKB_DROP_REASON_IPV6_NDISC_BAD_CODE: invalid NDISC icmp6 code. */ + SKB_DROP_REASON_IPV6_NDISC_BAD_CODE, + /** @SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS: invalid NDISC options. */ + SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS, + /** + * @SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST: NEIGHBOUR SOLICITATION + * for another host. + */ + SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST, + /** @SKB_DROP_REASON_QUEUE_PURGE: bulk free. */ + SKB_DROP_REASON_QUEUE_PURGE, + /** + * @SKB_DROP_REASON_TC_COOKIE_ERROR: An error occurred whilst + * processing a tc ext cookie. + */ + SKB_DROP_REASON_TC_COOKIE_ERROR, + /** + * @SKB_DROP_REASON_PACKET_SOCK_ERROR: generic packet socket errors + * after its filter matches an incoming packet. + */ + SKB_DROP_REASON_PACKET_SOCK_ERROR, + /** @SKB_DROP_REASON_TC_CHAIN_NOTFOUND: tc chain lookup failed. */ + SKB_DROP_REASON_TC_CHAIN_NOTFOUND, + /** + * @SKB_DROP_REASON_TC_RECLASSIFY_LOOP: tc exceeded max reclassify loop + * iterations. + */ + SKB_DROP_REASON_TC_RECLASSIFY_LOOP, + /** + * @SKB_DROP_REASON_MAX: the maximum of core drop reasons, which + * shouldn't be used as a real 'reason' - only for tracing code gen + */ + SKB_DROP_REASON_MAX, + /** + * @SKB_DROP_REASON_SUBSYS_MASK: subsystem mask in drop reasons, + * see &enum skb_drop_reason_subsys + */ + SKB_DROP_REASON_SUBSYS_MASK = 0xffff0000, }; struct dcbmsg { diff --git a/bpf/headers/vmlinux_ppc64le.h b/bpf/headers/vmlinux_ppc64le.h index 86dc700edb04882b894fb556a6a04e65f7f59127..b854f7559e38c2b15a96fa2f5498af4aea395c6f 100644 --- a/bpf/headers/vmlinux_ppc64le.h +++ b/bpf/headers/vmlinux_ppc64le.h @@ -22237,86 +22237,334 @@ enum net_device_flags { }; enum skb_drop_reason { + /** + * @SKB_NOT_DROPPED_YET: skb is not dropped yet (used for no-drop case) + */ SKB_NOT_DROPPED_YET = 0, - SKB_CONSUMED = 1, - SKB_DROP_REASON_NOT_SPECIFIED = 2, - SKB_DROP_REASON_NO_SOCKET = 3, - SKB_DROP_REASON_PKT_TOO_SMALL = 4, - SKB_DROP_REASON_TCP_CSUM = 5, - SKB_DROP_REASON_SOCKET_FILTER = 6, - SKB_DROP_REASON_UDP_CSUM = 7, - SKB_DROP_REASON_NETFILTER_DROP = 8, - SKB_DROP_REASON_OTHERHOST = 9, - SKB_DROP_REASON_IP_CSUM = 10, - SKB_DROP_REASON_IP_INHDR = 11, - SKB_DROP_REASON_IP_RPFILTER = 12, - SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST = 13, - SKB_DROP_REASON_XFRM_POLICY = 14, - SKB_DROP_REASON_IP_NOPROTO = 15, - SKB_DROP_REASON_SOCKET_RCVBUFF = 16, - SKB_DROP_REASON_PROTO_MEM = 17, - SKB_DROP_REASON_TCP_MD5NOTFOUND = 18, - SKB_DROP_REASON_TCP_MD5UNEXPECTED = 19, - SKB_DROP_REASON_TCP_MD5FAILURE = 20, - SKB_DROP_REASON_SOCKET_BACKLOG = 21, - SKB_DROP_REASON_TCP_FLAGS = 22, - SKB_DROP_REASON_TCP_ZEROWINDOW = 23, - SKB_DROP_REASON_TCP_OLD_DATA = 24, - SKB_DROP_REASON_TCP_OVERWINDOW = 25, - SKB_DROP_REASON_TCP_OFOMERGE = 26, - SKB_DROP_REASON_TCP_RFC7323_PAWS = 27, - SKB_DROP_REASON_TCP_OLD_SEQUENCE = 28, - SKB_DROP_REASON_TCP_INVALID_SEQUENCE = 29, - SKB_DROP_REASON_TCP_RESET = 30, - SKB_DROP_REASON_TCP_INVALID_SYN = 31, - SKB_DROP_REASON_TCP_CLOSE = 32, - SKB_DROP_REASON_TCP_FASTOPEN = 33, - SKB_DROP_REASON_TCP_OLD_ACK = 34, - SKB_DROP_REASON_TCP_TOO_OLD_ACK = 35, - SKB_DROP_REASON_TCP_ACK_UNSENT_DATA = 36, - SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE = 37, - SKB_DROP_REASON_TCP_OFO_DROP = 38, - SKB_DROP_REASON_IP_OUTNOROUTES = 39, - SKB_DROP_REASON_BPF_CGROUP_EGRESS = 40, - SKB_DROP_REASON_IPV6DISABLED = 41, - SKB_DROP_REASON_NEIGH_CREATEFAIL = 42, - SKB_DROP_REASON_NEIGH_FAILED = 43, - SKB_DROP_REASON_NEIGH_QUEUEFULL = 44, - SKB_DROP_REASON_NEIGH_DEAD = 45, - SKB_DROP_REASON_TC_EGRESS = 46, - SKB_DROP_REASON_QDISC_DROP = 47, - SKB_DROP_REASON_CPU_BACKLOG = 48, - SKB_DROP_REASON_XDP = 49, - SKB_DROP_REASON_TC_INGRESS = 50, - SKB_DROP_REASON_UNHANDLED_PROTO = 51, - SKB_DROP_REASON_SKB_CSUM = 52, - SKB_DROP_REASON_SKB_GSO_SEG = 53, - SKB_DROP_REASON_SKB_UCOPY_FAULT = 54, - SKB_DROP_REASON_DEV_HDR = 55, - SKB_DROP_REASON_DEV_READY = 56, - SKB_DROP_REASON_FULL_RING = 57, - SKB_DROP_REASON_NOMEM = 58, - SKB_DROP_REASON_HDR_TRUNC = 59, - SKB_DROP_REASON_TAP_FILTER = 60, - SKB_DROP_REASON_TAP_TXFILTER = 61, - SKB_DROP_REASON_ICMP_CSUM = 62, - SKB_DROP_REASON_INVALID_PROTO = 63, - SKB_DROP_REASON_IP_INADDRERRORS = 64, - SKB_DROP_REASON_IP_INNOROUTES = 65, - SKB_DROP_REASON_PKT_TOO_BIG = 66, - SKB_DROP_REASON_DUP_FRAG = 67, - SKB_DROP_REASON_FRAG_REASM_TIMEOUT = 68, - SKB_DROP_REASON_FRAG_TOO_FAR = 69, - SKB_DROP_REASON_TCP_MINTTL = 70, - SKB_DROP_REASON_IPV6_BAD_EXTHDR = 71, - SKB_DROP_REASON_IPV6_NDISC_FRAG = 72, - SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT = 73, - SKB_DROP_REASON_IPV6_NDISC_BAD_CODE = 74, - SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS = 75, - SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST = 76, - SKB_DROP_REASON_QUEUE_PURGE = 77, - SKB_DROP_REASON_MAX = 78, - SKB_DROP_REASON_SUBSYS_MASK = 4294901760, + /** @SKB_CONSUMED: packet has been consumed */ + SKB_CONSUMED, + /** @SKB_DROP_REASON_NOT_SPECIFIED: drop reason is not specified */ + SKB_DROP_REASON_NOT_SPECIFIED, + /** + * @SKB_DROP_REASON_NO_SOCKET: no valid socket that can be used. + * Reason could be one of three cases: + * 1) no established/listening socket found during lookup process + * 2) no valid request socket during 3WHS process + * 3) no valid child socket during 3WHS process + */ + SKB_DROP_REASON_NO_SOCKET, + /** @SKB_DROP_REASON_PKT_TOO_SMALL: packet size is too small */ + SKB_DROP_REASON_PKT_TOO_SMALL, + /** @SKB_DROP_REASON_TCP_CSUM: TCP checksum error */ + SKB_DROP_REASON_TCP_CSUM, + /** @SKB_DROP_REASON_SOCKET_FILTER: dropped by socket filter */ + SKB_DROP_REASON_SOCKET_FILTER, + /** @SKB_DROP_REASON_UDP_CSUM: UDP checksum error */ + SKB_DROP_REASON_UDP_CSUM, + /** @SKB_DROP_REASON_NETFILTER_DROP: dropped by netfilter */ + SKB_DROP_REASON_NETFILTER_DROP, + /** + * @SKB_DROP_REASON_OTHERHOST: packet don't belong to current host + * (interface is in promisc mode) + */ + SKB_DROP_REASON_OTHERHOST, + /** @SKB_DROP_REASON_IP_CSUM: IP checksum error */ + SKB_DROP_REASON_IP_CSUM, + /** + * @SKB_DROP_REASON_IP_INHDR: there is something wrong with IP header (see + * IPSTATS_MIB_INHDRERRORS) + */ + SKB_DROP_REASON_IP_INHDR, + /** + * @SKB_DROP_REASON_IP_RPFILTER: IP rpfilter validate failed. see the + * document for rp_filter in ip-sysctl.rst for more information + */ + SKB_DROP_REASON_IP_RPFILTER, + /** + * @SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST: destination address of L2 is + * multicast, but L3 is unicast. + */ + SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST, + /** @SKB_DROP_REASON_XFRM_POLICY: xfrm policy check failed */ + SKB_DROP_REASON_XFRM_POLICY, + /** @SKB_DROP_REASON_IP_NOPROTO: no support for IP protocol */ + SKB_DROP_REASON_IP_NOPROTO, + /** @SKB_DROP_REASON_SOCKET_RCVBUFF: socket receive buff is full */ + SKB_DROP_REASON_SOCKET_RCVBUFF, + /** + * @SKB_DROP_REASON_PROTO_MEM: proto memory limition, such as udp packet + * drop out of udp_memory_allocated. + */ + SKB_DROP_REASON_PROTO_MEM, + /** + * @SKB_DROP_REASON_TCP_AUTH_HDR: TCP-MD5 or TCP-AO hashes are met + * twice or set incorrectly. + */ + SKB_DROP_REASON_TCP_AUTH_HDR, + /** + * @SKB_DROP_REASON_TCP_MD5NOTFOUND: no MD5 hash and one expected, + * corresponding to LINUX_MIB_TCPMD5NOTFOUND + */ + SKB_DROP_REASON_TCP_MD5NOTFOUND, + /** + * @SKB_DROP_REASON_TCP_MD5UNEXPECTED: MD5 hash and we're not expecting + * one, corresponding to LINUX_MIB_TCPMD5UNEXPECTED + */ + SKB_DROP_REASON_TCP_MD5UNEXPECTED, + /** + * @SKB_DROP_REASON_TCP_MD5FAILURE: MD5 hash and its wrong, corresponding + * to LINUX_MIB_TCPMD5FAILURE + */ + SKB_DROP_REASON_TCP_MD5FAILURE, + /** + * @SKB_DROP_REASON_TCP_AONOTFOUND: no TCP-AO hash and one was expected, + * corresponding to LINUX_MIB_TCPAOREQUIRED + */ + SKB_DROP_REASON_TCP_AONOTFOUND, + /** + * @SKB_DROP_REASON_TCP_AOUNEXPECTED: TCP-AO hash is present and it + * was not expected, corresponding to LINUX_MIB_TCPAOKEYNOTFOUND + */ + SKB_DROP_REASON_TCP_AOUNEXPECTED, + /** + * @SKB_DROP_REASON_TCP_AOKEYNOTFOUND: TCP-AO key is unknown, + * corresponding to LINUX_MIB_TCPAOKEYNOTFOUND + */ + SKB_DROP_REASON_TCP_AOKEYNOTFOUND, + /** + * @SKB_DROP_REASON_TCP_AOFAILURE: TCP-AO hash is wrong, + * corresponding to LINUX_MIB_TCPAOBAD + */ + SKB_DROP_REASON_TCP_AOFAILURE, + /** + * @SKB_DROP_REASON_SOCKET_BACKLOG: failed to add skb to socket backlog ( + * see LINUX_MIB_TCPBACKLOGDROP) + */ + SKB_DROP_REASON_SOCKET_BACKLOG, + /** @SKB_DROP_REASON_TCP_FLAGS: TCP flags invalid */ + SKB_DROP_REASON_TCP_FLAGS, + /** + * @SKB_DROP_REASON_TCP_ABORT_ON_DATA: abort on data, corresponding to + * LINUX_MIB_TCPABORTONDATA + */ + SKB_DROP_REASON_TCP_ABORT_ON_DATA, + /** + * @SKB_DROP_REASON_TCP_ZEROWINDOW: TCP receive window size is zero, + * see LINUX_MIB_TCPZEROWINDOWDROP + */ + SKB_DROP_REASON_TCP_ZEROWINDOW, + /** + * @SKB_DROP_REASON_TCP_OLD_DATA: the TCP data reveived is already + * received before (spurious retrans may happened), see + * LINUX_MIB_DELAYEDACKLOST + */ + SKB_DROP_REASON_TCP_OLD_DATA, + /** + * @SKB_DROP_REASON_TCP_OVERWINDOW: the TCP data is out of window, + * the seq of the first byte exceed the right edges of receive + * window + */ + SKB_DROP_REASON_TCP_OVERWINDOW, + /** + * @SKB_DROP_REASON_TCP_OFOMERGE: the data of skb is already in the ofo + * queue, corresponding to LINUX_MIB_TCPOFOMERGE + */ + SKB_DROP_REASON_TCP_OFOMERGE, + /** + * @SKB_DROP_REASON_TCP_RFC7323_PAWS: PAWS check, corresponding to + * LINUX_MIB_PAWSESTABREJECTED, LINUX_MIB_PAWSACTIVEREJECTED + */ + SKB_DROP_REASON_TCP_RFC7323_PAWS, + /** @SKB_DROP_REASON_TCP_OLD_SEQUENCE: Old SEQ field (duplicate packet) */ + SKB_DROP_REASON_TCP_OLD_SEQUENCE, + /** @SKB_DROP_REASON_TCP_INVALID_SEQUENCE: Not acceptable SEQ field */ + SKB_DROP_REASON_TCP_INVALID_SEQUENCE, + /** + * @SKB_DROP_REASON_TCP_INVALID_ACK_SEQUENCE: Not acceptable ACK SEQ + * field because ack sequence is not in the window between snd_una + * and snd_nxt + */ + SKB_DROP_REASON_TCP_INVALID_ACK_SEQUENCE, + /** @SKB_DROP_REASON_TCP_RESET: Invalid RST packet */ + SKB_DROP_REASON_TCP_RESET, + /** + * @SKB_DROP_REASON_TCP_INVALID_SYN: Incoming packet has unexpected + * SYN flag + */ + SKB_DROP_REASON_TCP_INVALID_SYN, + /** @SKB_DROP_REASON_TCP_CLOSE: TCP socket in CLOSE state */ + SKB_DROP_REASON_TCP_CLOSE, + /** @SKB_DROP_REASON_TCP_FASTOPEN: dropped by FASTOPEN request socket */ + SKB_DROP_REASON_TCP_FASTOPEN, + /** @SKB_DROP_REASON_TCP_OLD_ACK: TCP ACK is old, but in window */ + SKB_DROP_REASON_TCP_OLD_ACK, + /** @SKB_DROP_REASON_TCP_TOO_OLD_ACK: TCP ACK is too old */ + SKB_DROP_REASON_TCP_TOO_OLD_ACK, + /** + * @SKB_DROP_REASON_TCP_ACK_UNSENT_DATA: TCP ACK for data we haven't + * sent yet + */ + SKB_DROP_REASON_TCP_ACK_UNSENT_DATA, + /** @SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE: pruned from TCP OFO queue */ + SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE, + /** @SKB_DROP_REASON_TCP_OFO_DROP: data already in receive queue */ + SKB_DROP_REASON_TCP_OFO_DROP, + /** @SKB_DROP_REASON_IP_OUTNOROUTES: route lookup failed */ + SKB_DROP_REASON_IP_OUTNOROUTES, + /** + * @SKB_DROP_REASON_BPF_CGROUP_EGRESS: dropped by BPF_PROG_TYPE_CGROUP_SKB + * eBPF program + */ + SKB_DROP_REASON_BPF_CGROUP_EGRESS, + /** @SKB_DROP_REASON_IPV6DISABLED: IPv6 is disabled on the device */ + SKB_DROP_REASON_IPV6DISABLED, + /** @SKB_DROP_REASON_NEIGH_CREATEFAIL: failed to create neigh entry */ + SKB_DROP_REASON_NEIGH_CREATEFAIL, + /** @SKB_DROP_REASON_NEIGH_FAILED: neigh entry in failed state */ + SKB_DROP_REASON_NEIGH_FAILED, + /** @SKB_DROP_REASON_NEIGH_QUEUEFULL: arp_queue for neigh entry is full */ + SKB_DROP_REASON_NEIGH_QUEUEFULL, + /** @SKB_DROP_REASON_NEIGH_DEAD: neigh entry is dead */ + SKB_DROP_REASON_NEIGH_DEAD, + /** @SKB_DROP_REASON_TC_EGRESS: dropped in TC egress HOOK */ + SKB_DROP_REASON_TC_EGRESS, + /** @SKB_DROP_REASON_SECURITY_HOOK: dropped due to security HOOK */ + SKB_DROP_REASON_SECURITY_HOOK, + /** + * @SKB_DROP_REASON_QDISC_DROP: dropped by qdisc when packet outputting ( + * failed to enqueue to current qdisc) + */ + SKB_DROP_REASON_QDISC_DROP, + /** + * @SKB_DROP_REASON_CPU_BACKLOG: failed to enqueue the skb to the per CPU + * backlog queue. This can be caused by backlog queue full (see + * netdev_max_backlog in net.rst) or RPS flow limit + */ + SKB_DROP_REASON_CPU_BACKLOG, + /** @SKB_DROP_REASON_XDP: dropped by XDP in input path */ + SKB_DROP_REASON_XDP, + /** @SKB_DROP_REASON_TC_INGRESS: dropped in TC ingress HOOK */ + SKB_DROP_REASON_TC_INGRESS, + /** @SKB_DROP_REASON_UNHANDLED_PROTO: protocol not implemented or not supported */ + SKB_DROP_REASON_UNHANDLED_PROTO, + /** @SKB_DROP_REASON_SKB_CSUM: sk_buff checksum computation error */ + SKB_DROP_REASON_SKB_CSUM, + /** @SKB_DROP_REASON_SKB_GSO_SEG: gso segmentation error */ + SKB_DROP_REASON_SKB_GSO_SEG, + /** + * @SKB_DROP_REASON_SKB_UCOPY_FAULT: failed to copy data from user space, + * e.g., via zerocopy_sg_from_iter() or skb_orphan_frags_rx() + */ + SKB_DROP_REASON_SKB_UCOPY_FAULT, + /** @SKB_DROP_REASON_DEV_HDR: device driver specific header/metadata is invalid */ + SKB_DROP_REASON_DEV_HDR, + /** + * @SKB_DROP_REASON_DEV_READY: the device is not ready to xmit/recv due to + * any of its data structure that is not up/ready/initialized, + * e.g., the IFF_UP is not set, or driver specific tun->tfiles[txq] + * is not initialized + */ + SKB_DROP_REASON_DEV_READY, + /** @SKB_DROP_REASON_FULL_RING: ring buffer is full */ + SKB_DROP_REASON_FULL_RING, + /** @SKB_DROP_REASON_NOMEM: error due to OOM */ + SKB_DROP_REASON_NOMEM, + /** + * @SKB_DROP_REASON_HDR_TRUNC: failed to trunc/extract the header from + * networking data, e.g., failed to pull the protocol header from + * frags via pskb_may_pull() + */ + SKB_DROP_REASON_HDR_TRUNC, + /** + * @SKB_DROP_REASON_TAP_FILTER: dropped by (ebpf) filter directly attached + * to tun/tap, e.g., via TUNSETFILTEREBPF + */ + SKB_DROP_REASON_TAP_FILTER, + /** + * @SKB_DROP_REASON_TAP_TXFILTER: dropped by tx filter implemented at + * tun/tap, e.g., check_filter() + */ + SKB_DROP_REASON_TAP_TXFILTER, + /** @SKB_DROP_REASON_ICMP_CSUM: ICMP checksum error */ + SKB_DROP_REASON_ICMP_CSUM, + /** + * @SKB_DROP_REASON_INVALID_PROTO: the packet doesn't follow RFC 2211, + * such as a broadcasts ICMP_TIMESTAMP + */ + SKB_DROP_REASON_INVALID_PROTO, + /** + * @SKB_DROP_REASON_IP_INADDRERRORS: host unreachable, corresponding to + * IPSTATS_MIB_INADDRERRORS + */ + SKB_DROP_REASON_IP_INADDRERRORS, + /** + * @SKB_DROP_REASON_IP_INNOROUTES: network unreachable, corresponding to + * IPSTATS_MIB_INADDRERRORS + */ + SKB_DROP_REASON_IP_INNOROUTES, + /** + * @SKB_DROP_REASON_PKT_TOO_BIG: packet size is too big (maybe exceed the + * MTU) + */ + SKB_DROP_REASON_PKT_TOO_BIG, + /** @SKB_DROP_REASON_DUP_FRAG: duplicate fragment */ + SKB_DROP_REASON_DUP_FRAG, + /** @SKB_DROP_REASON_FRAG_REASM_TIMEOUT: fragment reassembly timeout */ + SKB_DROP_REASON_FRAG_REASM_TIMEOUT, + /** + * @SKB_DROP_REASON_FRAG_TOO_FAR: ipv4 fragment too far. + * (/proc/sys/net/ipv4/ipfrag_max_dist) + */ + SKB_DROP_REASON_FRAG_TOO_FAR, + /** + * @SKB_DROP_REASON_TCP_MINTTL: ipv4 ttl or ipv6 hoplimit below + * the threshold (IP_MINTTL or IPV6_MINHOPCOUNT). + */ + SKB_DROP_REASON_TCP_MINTTL, + /** @SKB_DROP_REASON_IPV6_BAD_EXTHDR: Bad IPv6 extension header. */ + SKB_DROP_REASON_IPV6_BAD_EXTHDR, + /** @SKB_DROP_REASON_IPV6_NDISC_FRAG: invalid frag (suppress_frag_ndisc). */ + SKB_DROP_REASON_IPV6_NDISC_FRAG, + /** @SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT: invalid hop limit. */ + SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT, + /** @SKB_DROP_REASON_IPV6_NDISC_BAD_CODE: invalid NDISC icmp6 code. */ + SKB_DROP_REASON_IPV6_NDISC_BAD_CODE, + /** @SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS: invalid NDISC options. */ + SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS, + /** + * @SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST: NEIGHBOUR SOLICITATION + * for another host. + */ + SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST, + /** @SKB_DROP_REASON_QUEUE_PURGE: bulk free. */ + SKB_DROP_REASON_QUEUE_PURGE, + /** + * @SKB_DROP_REASON_TC_COOKIE_ERROR: An error occurred whilst + * processing a tc ext cookie. + */ + SKB_DROP_REASON_TC_COOKIE_ERROR, + /** + * @SKB_DROP_REASON_PACKET_SOCK_ERROR: generic packet socket errors + * after its filter matches an incoming packet. + */ + SKB_DROP_REASON_PACKET_SOCK_ERROR, + /** @SKB_DROP_REASON_TC_CHAIN_NOTFOUND: tc chain lookup failed. */ + SKB_DROP_REASON_TC_CHAIN_NOTFOUND, + /** + * @SKB_DROP_REASON_TC_RECLASSIFY_LOOP: tc exceeded max reclassify loop + * iterations. + */ + SKB_DROP_REASON_TC_RECLASSIFY_LOOP, + /** + * @SKB_DROP_REASON_MAX: the maximum of core drop reasons, which + * shouldn't be used as a real 'reason' - only for tracing code gen + */ + SKB_DROP_REASON_MAX, + /** + * @SKB_DROP_REASON_SUBSYS_MASK: subsystem mask in drop reasons, + * see &enum skb_drop_reason_subsys + */ + SKB_DROP_REASON_SUBSYS_MASK = 0xffff0000, }; typedef struct bio_vec skb_frag_t; diff --git a/bpf/headers/vmlinux_s390.h b/bpf/headers/vmlinux_s390.h index a2c8b42aa35bb129af48639e36353935187fa935..66a188586874c6f085a6a79986b077c0e81dbcaf 100644 --- a/bpf/headers/vmlinux_s390.h +++ b/bpf/headers/vmlinux_s390.h @@ -23620,84 +23620,335 @@ struct fd { }; enum skb_drop_reason { + /** + * @SKB_NOT_DROPPED_YET: skb is not dropped yet (used for no-drop case) + */ SKB_NOT_DROPPED_YET = 0, - SKB_CONSUMED = 1, - SKB_DROP_REASON_NOT_SPECIFIED = 2, - SKB_DROP_REASON_NO_SOCKET = 3, - SKB_DROP_REASON_PKT_TOO_SMALL = 4, - SKB_DROP_REASON_TCP_CSUM = 5, - SKB_DROP_REASON_SOCKET_FILTER = 6, - SKB_DROP_REASON_UDP_CSUM = 7, - SKB_DROP_REASON_NETFILTER_DROP = 8, - SKB_DROP_REASON_OTHERHOST = 9, - SKB_DROP_REASON_IP_CSUM = 10, - SKB_DROP_REASON_IP_INHDR = 11, - SKB_DROP_REASON_IP_RPFILTER = 12, - SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST = 13, - SKB_DROP_REASON_XFRM_POLICY = 14, - SKB_DROP_REASON_IP_NOPROTO = 15, - SKB_DROP_REASON_SOCKET_RCVBUFF = 16, - SKB_DROP_REASON_PROTO_MEM = 17, - SKB_DROP_REASON_TCP_MD5NOTFOUND = 18, - SKB_DROP_REASON_TCP_MD5UNEXPECTED = 19, - SKB_DROP_REASON_TCP_MD5FAILURE = 20, - SKB_DROP_REASON_SOCKET_BACKLOG = 21, - SKB_DROP_REASON_TCP_FLAGS = 22, - SKB_DROP_REASON_TCP_ZEROWINDOW = 23, - SKB_DROP_REASON_TCP_OLD_DATA = 24, - SKB_DROP_REASON_TCP_OVERWINDOW = 25, - SKB_DROP_REASON_TCP_OFOMERGE = 26, - SKB_DROP_REASON_TCP_RFC7323_PAWS = 27, - SKB_DROP_REASON_TCP_INVALID_SEQUENCE = 28, - SKB_DROP_REASON_TCP_RESET = 29, - SKB_DROP_REASON_TCP_INVALID_SYN = 30, - SKB_DROP_REASON_TCP_CLOSE = 31, - SKB_DROP_REASON_TCP_FASTOPEN = 32, - SKB_DROP_REASON_TCP_OLD_ACK = 33, - SKB_DROP_REASON_TCP_TOO_OLD_ACK = 34, - SKB_DROP_REASON_TCP_ACK_UNSENT_DATA = 35, - SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE = 36, - SKB_DROP_REASON_TCP_OFO_DROP = 37, - SKB_DROP_REASON_IP_OUTNOROUTES = 38, - SKB_DROP_REASON_BPF_CGROUP_EGRESS = 39, - SKB_DROP_REASON_IPV6DISABLED = 40, - SKB_DROP_REASON_NEIGH_CREATEFAIL = 41, - SKB_DROP_REASON_NEIGH_FAILED = 42, - SKB_DROP_REASON_NEIGH_QUEUEFULL = 43, - SKB_DROP_REASON_NEIGH_DEAD = 44, - SKB_DROP_REASON_TC_EGRESS = 45, - SKB_DROP_REASON_QDISC_DROP = 46, - SKB_DROP_REASON_CPU_BACKLOG = 47, - SKB_DROP_REASON_XDP = 48, - SKB_DROP_REASON_TC_INGRESS = 49, - SKB_DROP_REASON_UNHANDLED_PROTO = 50, - SKB_DROP_REASON_SKB_CSUM = 51, - SKB_DROP_REASON_SKB_GSO_SEG = 52, - SKB_DROP_REASON_SKB_UCOPY_FAULT = 53, - SKB_DROP_REASON_DEV_HDR = 54, - SKB_DROP_REASON_DEV_READY = 55, - SKB_DROP_REASON_FULL_RING = 56, - SKB_DROP_REASON_NOMEM = 57, - SKB_DROP_REASON_HDR_TRUNC = 58, - SKB_DROP_REASON_TAP_FILTER = 59, - SKB_DROP_REASON_TAP_TXFILTER = 60, - SKB_DROP_REASON_ICMP_CSUM = 61, - SKB_DROP_REASON_INVALID_PROTO = 62, - SKB_DROP_REASON_IP_INADDRERRORS = 63, - SKB_DROP_REASON_IP_INNOROUTES = 64, - SKB_DROP_REASON_PKT_TOO_BIG = 65, - SKB_DROP_REASON_DUP_FRAG = 66, - SKB_DROP_REASON_FRAG_REASM_TIMEOUT = 67, - SKB_DROP_REASON_FRAG_TOO_FAR = 68, - SKB_DROP_REASON_TCP_MINTTL = 69, - SKB_DROP_REASON_IPV6_BAD_EXTHDR = 70, - SKB_DROP_REASON_IPV6_NDISC_FRAG = 71, - SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT = 72, - SKB_DROP_REASON_IPV6_NDISC_BAD_CODE = 73, - SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS = 74, - SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST = 75, - SKB_DROP_REASON_MAX = 76, - SKB_DROP_REASON_SUBSYS_MASK = 4294901760, + /** @SKB_CONSUMED: packet has been consumed */ + SKB_CONSUMED, + /** @SKB_DROP_REASON_NOT_SPECIFIED: drop reason is not specified */ + SKB_DROP_REASON_NOT_SPECIFIED, + /** + * @SKB_DROP_REASON_NO_SOCKET: no valid socket that can be used. + * Reason could be one of three cases: + * 1) no established/listening socket found during lookup process + * 2) no valid request socket during 3WHS process + * 3) no valid child socket during 3WHS process + */ + SKB_DROP_REASON_NO_SOCKET, + /** @SKB_DROP_REASON_PKT_TOO_SMALL: packet size is too small */ + SKB_DROP_REASON_PKT_TOO_SMALL, + /** @SKB_DROP_REASON_TCP_CSUM: TCP checksum error */ + SKB_DROP_REASON_TCP_CSUM, + /** @SKB_DROP_REASON_SOCKET_FILTER: dropped by socket filter */ + SKB_DROP_REASON_SOCKET_FILTER, + /** @SKB_DROP_REASON_UDP_CSUM: UDP checksum error */ + SKB_DROP_REASON_UDP_CSUM, + /** @SKB_DROP_REASON_NETFILTER_DROP: dropped by netfilter */ + SKB_DROP_REASON_NETFILTER_DROP, + /** + * @SKB_DROP_REASON_OTHERHOST: packet don't belong to current host + * (interface is in promisc mode) + */ + SKB_DROP_REASON_OTHERHOST, + /** @SKB_DROP_REASON_IP_CSUM: IP checksum error */ + SKB_DROP_REASON_IP_CSUM, + /** + * @SKB_DROP_REASON_IP_INHDR: there is something wrong with IP header (see + * IPSTATS_MIB_INHDRERRORS) + */ + SKB_DROP_REASON_IP_INHDR, + /** + * @SKB_DROP_REASON_IP_RPFILTER: IP rpfilter validate failed. see the + * document for rp_filter in ip-sysctl.rst for more information + */ + SKB_DROP_REASON_IP_RPFILTER, + /** + * @SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST: destination address of L2 is + * multicast, but L3 is unicast. + */ + SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST, + /** @SKB_DROP_REASON_XFRM_POLICY: xfrm policy check failed */ + SKB_DROP_REASON_XFRM_POLICY, + /** @SKB_DROP_REASON_IP_NOPROTO: no support for IP protocol */ + SKB_DROP_REASON_IP_NOPROTO, + /** @SKB_DROP_REASON_SOCKET_RCVBUFF: socket receive buff is full */ + SKB_DROP_REASON_SOCKET_RCVBUFF, + /** + * @SKB_DROP_REASON_PROTO_MEM: proto memory limition, such as udp packet + * drop out of udp_memory_allocated. + */ + SKB_DROP_REASON_PROTO_MEM, + /** + * @SKB_DROP_REASON_TCP_AUTH_HDR: TCP-MD5 or TCP-AO hashes are met + * twice or set incorrectly. + */ + SKB_DROP_REASON_TCP_AUTH_HDR, + /** + * @SKB_DROP_REASON_TCP_MD5NOTFOUND: no MD5 hash and one expected, + * corresponding to LINUX_MIB_TCPMD5NOTFOUND + */ + SKB_DROP_REASON_TCP_MD5NOTFOUND, + /** + * @SKB_DROP_REASON_TCP_MD5UNEXPECTED: MD5 hash and we're not expecting + * one, corresponding to LINUX_MIB_TCPMD5UNEXPECTED + */ + SKB_DROP_REASON_TCP_MD5UNEXPECTED, + /** + * @SKB_DROP_REASON_TCP_MD5FAILURE: MD5 hash and its wrong, corresponding + * to LINUX_MIB_TCPMD5FAILURE + */ + SKB_DROP_REASON_TCP_MD5FAILURE, + /** + * @SKB_DROP_REASON_TCP_AONOTFOUND: no TCP-AO hash and one was expected, + * corresponding to LINUX_MIB_TCPAOREQUIRED + */ + SKB_DROP_REASON_TCP_AONOTFOUND, + /** + * @SKB_DROP_REASON_TCP_AOUNEXPECTED: TCP-AO hash is present and it + * was not expected, corresponding to LINUX_MIB_TCPAOKEYNOTFOUND + */ + SKB_DROP_REASON_TCP_AOUNEXPECTED, + /** + * @SKB_DROP_REASON_TCP_AOKEYNOTFOUND: TCP-AO key is unknown, + * corresponding to LINUX_MIB_TCPAOKEYNOTFOUND + */ + SKB_DROP_REASON_TCP_AOKEYNOTFOUND, + /** + * @SKB_DROP_REASON_TCP_AOFAILURE: TCP-AO hash is wrong, + * corresponding to LINUX_MIB_TCPAOBAD + */ + SKB_DROP_REASON_TCP_AOFAILURE, + /** + * @SKB_DROP_REASON_SOCKET_BACKLOG: failed to add skb to socket backlog ( + * see LINUX_MIB_TCPBACKLOGDROP) + */ + SKB_DROP_REASON_SOCKET_BACKLOG, + /** @SKB_DROP_REASON_TCP_FLAGS: TCP flags invalid */ + SKB_DROP_REASON_TCP_FLAGS, + /** + * @SKB_DROP_REASON_TCP_ABORT_ON_DATA: abort on data, corresponding to + * LINUX_MIB_TCPABORTONDATA + */ + SKB_DROP_REASON_TCP_ABORT_ON_DATA, + /** + * @SKB_DROP_REASON_TCP_ZEROWINDOW: TCP receive window size is zero, + * see LINUX_MIB_TCPZEROWINDOWDROP + */ + SKB_DROP_REASON_TCP_ZEROWINDOW, + /** + * @SKB_DROP_REASON_TCP_OLD_DATA: the TCP data reveived is already + * received before (spurious retrans may happened), see + * LINUX_MIB_DELAYEDACKLOST + */ + SKB_DROP_REASON_TCP_OLD_DATA, + /** + * @SKB_DROP_REASON_TCP_OVERWINDOW: the TCP data is out of window, + * the seq of the first byte exceed the right edges of receive + * window + */ + SKB_DROP_REASON_TCP_OVERWINDOW, + /** + * @SKB_DROP_REASON_TCP_OFOMERGE: the data of skb is already in the ofo + * queue, corresponding to LINUX_MIB_TCPOFOMERGE + */ + SKB_DROP_REASON_TCP_OFOMERGE, + /** + * @SKB_DROP_REASON_TCP_RFC7323_PAWS: PAWS check, corresponding to + * LINUX_MIB_PAWSESTABREJECTED, LINUX_MIB_PAWSACTIVEREJECTED + */ + SKB_DROP_REASON_TCP_RFC7323_PAWS, + /** @SKB_DROP_REASON_TCP_OLD_SEQUENCE: Old SEQ field (duplicate packet) */ + SKB_DROP_REASON_TCP_OLD_SEQUENCE, + /** @SKB_DROP_REASON_TCP_INVALID_SEQUENCE: Not acceptable SEQ field */ + SKB_DROP_REASON_TCP_INVALID_SEQUENCE, + /** + * @SKB_DROP_REASON_TCP_INVALID_ACK_SEQUENCE: Not acceptable ACK SEQ + * field because ack sequence is not in the window between snd_una + * and snd_nxt + */ + SKB_DROP_REASON_TCP_INVALID_ACK_SEQUENCE, + /** @SKB_DROP_REASON_TCP_RESET: Invalid RST packet */ + SKB_DROP_REASON_TCP_RESET, + /** + * @SKB_DROP_REASON_TCP_INVALID_SYN: Incoming packet has unexpected + * SYN flag + */ + SKB_DROP_REASON_TCP_INVALID_SYN, + /** @SKB_DROP_REASON_TCP_CLOSE: TCP socket in CLOSE state */ + SKB_DROP_REASON_TCP_CLOSE, + /** @SKB_DROP_REASON_TCP_FASTOPEN: dropped by FASTOPEN request socket */ + SKB_DROP_REASON_TCP_FASTOPEN, + /** @SKB_DROP_REASON_TCP_OLD_ACK: TCP ACK is old, but in window */ + SKB_DROP_REASON_TCP_OLD_ACK, + /** @SKB_DROP_REASON_TCP_TOO_OLD_ACK: TCP ACK is too old */ + SKB_DROP_REASON_TCP_TOO_OLD_ACK, + /** + * @SKB_DROP_REASON_TCP_ACK_UNSENT_DATA: TCP ACK for data we haven't + * sent yet + */ + SKB_DROP_REASON_TCP_ACK_UNSENT_DATA, + /** @SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE: pruned from TCP OFO queue */ + SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE, + /** @SKB_DROP_REASON_TCP_OFO_DROP: data already in receive queue */ + SKB_DROP_REASON_TCP_OFO_DROP, + /** @SKB_DROP_REASON_IP_OUTNOROUTES: route lookup failed */ + SKB_DROP_REASON_IP_OUTNOROUTES, + /** + * @SKB_DROP_REASON_BPF_CGROUP_EGRESS: dropped by BPF_PROG_TYPE_CGROUP_SKB + * eBPF program + */ + SKB_DROP_REASON_BPF_CGROUP_EGRESS, + /** @SKB_DROP_REASON_IPV6DISABLED: IPv6 is disabled on the device */ + SKB_DROP_REASON_IPV6DISABLED, + /** @SKB_DROP_REASON_NEIGH_CREATEFAIL: failed to create neigh entry */ + SKB_DROP_REASON_NEIGH_CREATEFAIL, + /** @SKB_DROP_REASON_NEIGH_FAILED: neigh entry in failed state */ + SKB_DROP_REASON_NEIGH_FAILED, + /** @SKB_DROP_REASON_NEIGH_QUEUEFULL: arp_queue for neigh entry is full */ + SKB_DROP_REASON_NEIGH_QUEUEFULL, + /** @SKB_DROP_REASON_NEIGH_DEAD: neigh entry is dead */ + SKB_DROP_REASON_NEIGH_DEAD, + /** @SKB_DROP_REASON_TC_EGRESS: dropped in TC egress HOOK */ + SKB_DROP_REASON_TC_EGRESS, + /** @SKB_DROP_REASON_SECURITY_HOOK: dropped due to security HOOK */ + SKB_DROP_REASON_SECURITY_HOOK, + /** + * @SKB_DROP_REASON_QDISC_DROP: dropped by qdisc when packet outputting ( + * failed to enqueue to current qdisc) + */ + SKB_DROP_REASON_QDISC_DROP, + /** + * @SKB_DROP_REASON_CPU_BACKLOG: failed to enqueue the skb to the per CPU + * backlog queue. This can be caused by backlog queue full (see + * netdev_max_backlog in net.rst) or RPS flow limit + */ + SKB_DROP_REASON_CPU_BACKLOG, + /** @SKB_DROP_REASON_XDP: dropped by XDP in input path */ + SKB_DROP_REASON_XDP, + /** @SKB_DROP_REASON_TC_INGRESS: dropped in TC ingress HOOK */ + SKB_DROP_REASON_TC_INGRESS, + /** @SKB_DROP_REASON_UNHANDLED_PROTO: protocol not implemented or not supported */ + SKB_DROP_REASON_UNHANDLED_PROTO, + /** @SKB_DROP_REASON_SKB_CSUM: sk_buff checksum computation error */ + SKB_DROP_REASON_SKB_CSUM, + /** @SKB_DROP_REASON_SKB_GSO_SEG: gso segmentation error */ + SKB_DROP_REASON_SKB_GSO_SEG, + /** + * @SKB_DROP_REASON_SKB_UCOPY_FAULT: failed to copy data from user space, + * e.g., via zerocopy_sg_from_iter() or skb_orphan_frags_rx() + */ + SKB_DROP_REASON_SKB_UCOPY_FAULT, + /** @SKB_DROP_REASON_DEV_HDR: device driver specific header/metadata is invalid */ + SKB_DROP_REASON_DEV_HDR, + /** + * @SKB_DROP_REASON_DEV_READY: the device is not ready to xmit/recv due to + * any of its data structure that is not up/ready/initialized, + * e.g., the IFF_UP is not set, or driver specific tun->tfiles[txq] + * is not initialized + */ + SKB_DROP_REASON_DEV_READY, + /** @SKB_DROP_REASON_FULL_RING: ring buffer is full */ + SKB_DROP_REASON_FULL_RING, + /** @SKB_DROP_REASON_NOMEM: error due to OOM */ + SKB_DROP_REASON_NOMEM, + /** + * @SKB_DROP_REASON_HDR_TRUNC: failed to trunc/extract the header from + * networking data, e.g., failed to pull the protocol header from + * frags via pskb_may_pull() + */ + SKB_DROP_REASON_HDR_TRUNC, + /** + * @SKB_DROP_REASON_TAP_FILTER: dropped by (ebpf) filter directly attached + * to tun/tap, e.g., via TUNSETFILTEREBPF + */ + SKB_DROP_REASON_TAP_FILTER, + /** + * @SKB_DROP_REASON_TAP_TXFILTER: dropped by tx filter implemented at + * tun/tap, e.g., check_filter() + */ + SKB_DROP_REASON_TAP_TXFILTER, + /** @SKB_DROP_REASON_ICMP_CSUM: ICMP checksum error */ + SKB_DROP_REASON_ICMP_CSUM, + /** + * @SKB_DROP_REASON_INVALID_PROTO: the packet doesn't follow RFC 2211, + * such as a broadcasts ICMP_TIMESTAMP + */ + SKB_DROP_REASON_INVALID_PROTO, + /** + * @SKB_DROP_REASON_IP_INADDRERRORS: host unreachable, corresponding to + * IPSTATS_MIB_INADDRERRORS + */ + SKB_DROP_REASON_IP_INADDRERRORS, + /** + * @SKB_DROP_REASON_IP_INNOROUTES: network unreachable, corresponding to + * IPSTATS_MIB_INADDRERRORS + */ + SKB_DROP_REASON_IP_INNOROUTES, + /** + * @SKB_DROP_REASON_PKT_TOO_BIG: packet size is too big (maybe exceed the + * MTU) + */ + SKB_DROP_REASON_PKT_TOO_BIG, + /** @SKB_DROP_REASON_DUP_FRAG: duplicate fragment */ + SKB_DROP_REASON_DUP_FRAG, + /** @SKB_DROP_REASON_FRAG_REASM_TIMEOUT: fragment reassembly timeout */ + SKB_DROP_REASON_FRAG_REASM_TIMEOUT, + /** + * @SKB_DROP_REASON_FRAG_TOO_FAR: ipv4 fragment too far. + * (/proc/sys/net/ipv4/ipfrag_max_dist) + */ + SKB_DROP_REASON_FRAG_TOO_FAR, + /** + * @SKB_DROP_REASON_TCP_MINTTL: ipv4 ttl or ipv6 hoplimit below + * the threshold (IP_MINTTL or IPV6_MINHOPCOUNT). + */ + SKB_DROP_REASON_TCP_MINTTL, + /** @SKB_DROP_REASON_IPV6_BAD_EXTHDR: Bad IPv6 extension header. */ + SKB_DROP_REASON_IPV6_BAD_EXTHDR, + /** @SKB_DROP_REASON_IPV6_NDISC_FRAG: invalid frag (suppress_frag_ndisc). */ + SKB_DROP_REASON_IPV6_NDISC_FRAG, + /** @SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT: invalid hop limit. */ + SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT, + /** @SKB_DROP_REASON_IPV6_NDISC_BAD_CODE: invalid NDISC icmp6 code. */ + SKB_DROP_REASON_IPV6_NDISC_BAD_CODE, + /** @SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS: invalid NDISC options. */ + SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS, + /** + * @SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST: NEIGHBOUR SOLICITATION + * for another host. + */ + SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST, + /** @SKB_DROP_REASON_QUEUE_PURGE: bulk free. */ + SKB_DROP_REASON_QUEUE_PURGE, + /** + * @SKB_DROP_REASON_TC_COOKIE_ERROR: An error occurred whilst + * processing a tc ext cookie. + */ + SKB_DROP_REASON_TC_COOKIE_ERROR, + /** + * @SKB_DROP_REASON_PACKET_SOCK_ERROR: generic packet socket errors + * after its filter matches an incoming packet. + */ + SKB_DROP_REASON_PACKET_SOCK_ERROR, + /** @SKB_DROP_REASON_TC_CHAIN_NOTFOUND: tc chain lookup failed. */ + SKB_DROP_REASON_TC_CHAIN_NOTFOUND, + /** + * @SKB_DROP_REASON_TC_RECLASSIFY_LOOP: tc exceeded max reclassify loop + * iterations. + */ + SKB_DROP_REASON_TC_RECLASSIFY_LOOP, + /** + * @SKB_DROP_REASON_MAX: the maximum of core drop reasons, which + * shouldn't be used as a real 'reason' - only for tracing code gen + */ + SKB_DROP_REASON_MAX, + + /** + * @SKB_DROP_REASON_SUBSYS_MASK: subsystem mask in drop reasons, + * see &enum skb_drop_reason_subsys + */ + SKB_DROP_REASON_SUBSYS_MASK = 0xffff0000, }; struct genlmsghdr { diff --git a/bpf/network_events_monitoring.h b/bpf/network_events_monitoring.h index 4349cd308fbeec401e1fc73e08c2944e8102c965..8ac43001c48a4a1a473e513e0adaf0e15e13c401 100644 --- a/bpf/network_events_monitoring.h +++ b/bpf/network_events_monitoring.h @@ -81,7 +81,7 @@ static inline int trace_network_events(struct sk_buff *skb, struct rh_psample_me } // check if this packet need to be filtered if filtering feature is enabled - bool skip = check_and_do_flow_filtering(&id, flags); + bool skip = check_and_do_flow_filtering(&id, flags, 0); if (skip) { return 0; } diff --git a/bpf/pca.h b/bpf/pca.h index 739982e978358f47714484dead235e99b878b4ec..9e35cb79840b1b5796f9f487b8a799955478a4ba 100644 --- a/bpf/pca.h +++ b/bpf/pca.h @@ -57,7 +57,7 @@ static inline bool validate_pca_filter(struct __sk_buff *skb, direction dir) { id.direction = dir; // check if this packet need to be filtered if filtering feature is enabled - bool skip = check_and_do_flow_filtering(&id, pkt.flags); + bool skip = check_and_do_flow_filtering(&id, pkt.flags, 0); if (skip) { return false; } diff --git a/bpf/pkt_drops.h b/bpf/pkt_drops.h index 1682321ed739018c019bb1a2f30a1c2c749b8f37..0a65215dfdf476b28945bc66dca8db67e24f4fd4 100644 --- a/bpf/pkt_drops.h +++ b/bpf/pkt_drops.h @@ -67,7 +67,7 @@ static inline int trace_pkt_drop(void *ctx, u8 state, struct sk_buff *skb, } // check if this packet need to be filtered if filtering feature is enabled - bool skip = check_and_do_flow_filtering(&id, flags); + bool skip = check_and_do_flow_filtering(&id, flags, reason); if (skip) { return 0; } diff --git a/bpf/rtt_tracker.h b/bpf/rtt_tracker.h index e07bf1687f4ebc3d7ae094a1f329a7541db99fca..0cef492cdf4896de0c9760b199c226aa8d203233 100644 --- a/bpf/rtt_tracker.h +++ b/bpf/rtt_tracker.h @@ -65,7 +65,7 @@ static inline int calculate_flow_rtt_tcp(struct sock *sk, struct sk_buff *skb) { rtt *= 1000u; // check if this packet need to be filtered if filtering feature is enabled - bool skip = check_and_do_flow_filtering(&id, flags); + bool skip = check_and_do_flow_filtering(&id, flags, 0); if (skip) { return 0; } diff --git a/bpf/types.h b/bpf/types.h index e13853a2f12e030ca7de9bdfd6f3ee4a928f1e2c..8e927ab541406e9bed6aa07079fcbd9a06e83865 100644 --- a/bpf/types.h +++ b/bpf/types.h @@ -235,6 +235,7 @@ struct filter_value_t { direction direction; filter_action action; tcp_flags tcpFlags; + u8 filter_drops; u8 ip[IP_MAX_LEN]; } __attribute__((packed)); // Force emitting struct filter_value_t into the ELF. diff --git a/bpf/utils.h b/bpf/utils.h index 5ad396d55077640f07ae48aa2f47fb59c641acc2..299e516484f6f37214c7a8563cc2786a796ec01b 100644 --- a/bpf/utils.h +++ b/bpf/utils.h @@ -166,13 +166,14 @@ static inline int fill_ethhdr(struct ethhdr *eth, void *data_end, pkt_info *pkt) /* * check if flow filter is enabled and if we need to continue processing the packet or not */ -static inline bool check_and_do_flow_filtering(flow_id *id, u16 flags) { +static inline bool check_and_do_flow_filtering(flow_id *id, u16 flags, u32 drop_reason) { // check if this packet need to be filtered if filtering feature is enabled if (enable_flows_filtering || enable_pca) { filter_action action = ACCEPT; u32 *filter_counter_p = NULL; u32 initVal = 1, key = 0; - if (is_flow_filtered(id, &action, flags) != 0 && action != MAX_FILTER_ACTIONS) { + if (is_flow_filtered(id, &action, flags, drop_reason) != 0 && + action != MAX_FILTER_ACTIONS) { // we have matching rules follow through the actions to decide if we should accept or reject the flow // and update global counter for both cases u32 reject_key = FILTER_REJECT_KEY, accept_key = FILTER_ACCEPT_KEY; diff --git a/docs/flow_filtering.md b/docs/flow_filtering.md index a3c6f328aae05767147007ca26421794b9753233..aceca7f95bd831461287799b70bb5b23e9c30492 100644 --- a/docs/flow_filtering.md +++ b/docs/flow_filtering.md @@ -35,6 +35,7 @@ Rule-base filtering is a method to control the flow of packets cached in the eBP - `FILTER_ICMP_CODE` - ICMP code of the flow filter rule. - `FILTER_PEER_IP` - Specific Peer IP address of the flow filter rule. - `FILTER_TCP_FLAGS` - Filter based on TCP flags Possible values are SYN, SYN-ACK, ACK, FIN, RST, PSH, URG, ECE, CWR, FIN-ACK, RST_ACK +- `FILTER_DROPS` - Filter flows when packets drop feature is enabled to filter only flows with drop cause not 0. Note: - for L4 ports configuration, you can use either single port config options or the range but not both. diff --git a/pkg/agent/agent.go b/pkg/agent/agent.go index 5d3c52b7c57fd8250184e3cdedab58183266f876..2c57627c82ba07bca61538e1412c4150a4cc7ce1 100644 --- a/pkg/agent/agent.go +++ b/pkg/agent/agent.go @@ -223,6 +223,7 @@ func FlowsAgent(cfg *Config) (*Flows, error) { FilterSourcePort: tracer.ConvertFilterPortsToInstr(cfg.FilterSourcePort, cfg.FilterSourcePortRange, cfg.FilterSourcePorts), FilterPort: tracer.ConvertFilterPortsToInstr(cfg.FilterPort, cfg.FilterPortRange, cfg.FilterPorts), FilterTCPFLags: cfg.FilterTCPFlags, + FilterDrops: cfg.FilterDrops, }, } diff --git a/pkg/agent/config.go b/pkg/agent/config.go index d915e0e41424bab872cd46b5233f4312a269a4ae..a5708d403eec9e1d7560c2e070603a542c28a052 100644 --- a/pkg/agent/config.go +++ b/pkg/agent/config.go @@ -229,6 +229,8 @@ type Config struct { // FilterTCPFlags is the TCP flags to filter flows. // possible values are: SYN, SYN-ACK, ACK, FIN, RST, PSH, URG, ECE, CWR, FIN-ACK, RST-ACK FilterTCPFlags string `env:"FILTER_TCP_FLAGS"` + // FilterDrops allow filtering flows with packet drops, default is false. + FilterDrops bool `env:"FILTER_DROPS" envDefault:"false"` // EnableNetworkEventsMonitoring enables monitoring network plugin events, default is false. EnableNetworkEventsMonitoring bool `env:"ENABLE_NETWORK_EVENTS_MONITORING" envDefault:"false"` // NetworkEventsMonitoringGroupID to allow ebpf hook to process samples for specific groupID and ignore the rest diff --git a/pkg/agent/packets_agent.go b/pkg/agent/packets_agent.go index 7eef9f8524980e85cbd4b5094dbc0a5a55189268..38c3f247a8e907733619f0dbddae8580b77cfac5 100644 --- a/pkg/agent/packets_agent.go +++ b/pkg/agent/packets_agent.go @@ -93,6 +93,7 @@ func PacketsAgent(cfg *Config) (*Packets, error) { FilterSourcePort: tracer.ConvertFilterPortsToInstr(cfg.FilterSourcePort, cfg.FilterSourcePortRange, cfg.FilterSourcePorts), FilterPort: tracer.ConvertFilterPortsToInstr(cfg.FilterPort, cfg.FilterPortRange, cfg.FilterPorts), FilterTCPFLags: cfg.FilterTCPFlags, + FilterDrops: cfg.FilterDrops, }, } diff --git a/pkg/decode/decode_protobuf.go b/pkg/decode/decode_protobuf.go index e72dd0b02c3a6949a40495c63034648ac2d15ae9..0449acb96fcce1c31fceeaddf4eae78e4c34bb71 100644 --- a/pkg/decode/decode_protobuf.go +++ b/pkg/decode/decode_protobuf.go @@ -329,6 +329,16 @@ func PktDropCauseToStr(dropCause uint32) string { return "SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS" case skbDropReasonSubSysCore + 75: return "SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST" + case skbDropReasonSubSysCore + 76: + return "SKB_DROP_REASON_QUEUE_PURGE" + case skbDropReasonSubSysCore + 77: + return "SKB_DROP_REASON_TC_COOKIE_ERROR" + case skbDropReasonSubSysCore + 78: + return "SKB_DROP_REASON_PACKET_SOCK_ERROR" + case skbDropReasonSubSysCore + 79: + return "SKB_DROP_REASON_TC_CHAIN_NOTFOUND" + case skbDropReasonSubSysCore + 80: + return "SKB_DROP_REASON_TC_RECLASSIFY_LOOP" // ovs drop causes // https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/tree/net/openvswitch/drop.h diff --git a/pkg/ebpf/bpf_arm64_bpfel.go b/pkg/ebpf/bpf_arm64_bpfel.go index 2a88c9b2e5ad80296a1d2228f5fd06e27585fc92..243f49dd8254500ffe605cea31d3e17863a0889b 100644 --- a/pkg/ebpf/bpf_arm64_bpfel.go +++ b/pkg/ebpf/bpf_arm64_bpfel.go @@ -68,6 +68,7 @@ type BpfFilterValueT struct { Direction BpfDirectionT Action BpfFilterActionT TcpFlags BpfTcpFlagsT + FilterDrops uint8 Ip [16]uint8 } diff --git a/pkg/ebpf/bpf_arm64_bpfel.o b/pkg/ebpf/bpf_arm64_bpfel.o index ac8ff7e525bde512b3580587a9506372b64f736f..426e1f762d686dac68abed2ccfbbd9afd9fc5f11 100644 Binary files a/pkg/ebpf/bpf_arm64_bpfel.o and b/pkg/ebpf/bpf_arm64_bpfel.o differ diff --git a/pkg/ebpf/bpf_powerpc_bpfel.go b/pkg/ebpf/bpf_powerpc_bpfel.go index 011dad9f7c02ef06b6f0b6efae0e14b33d179739..5be29d7b881a0d2fb722882bb179de6352c1fbe5 100644 --- a/pkg/ebpf/bpf_powerpc_bpfel.go +++ b/pkg/ebpf/bpf_powerpc_bpfel.go @@ -68,6 +68,7 @@ type BpfFilterValueT struct { Direction BpfDirectionT Action BpfFilterActionT TcpFlags BpfTcpFlagsT + FilterDrops uint8 Ip [16]uint8 } diff --git a/pkg/ebpf/bpf_powerpc_bpfel.o b/pkg/ebpf/bpf_powerpc_bpfel.o index 003c95c50613790cfebf173dbe92e1bd6a0c249f..3e9760cd7b5ace80c8d485a2a49c7839d029a225 100644 Binary files a/pkg/ebpf/bpf_powerpc_bpfel.o and b/pkg/ebpf/bpf_powerpc_bpfel.o differ diff --git a/pkg/ebpf/bpf_s390_bpfeb.go b/pkg/ebpf/bpf_s390_bpfeb.go index 9ab0788b7bdcfb9650b7750d759d2c787b8b98e3..47501856257e2d0e772ff9b33166fec8e2aa2356 100644 --- a/pkg/ebpf/bpf_s390_bpfeb.go +++ b/pkg/ebpf/bpf_s390_bpfeb.go @@ -68,6 +68,7 @@ type BpfFilterValueT struct { Direction BpfDirectionT Action BpfFilterActionT TcpFlags BpfTcpFlagsT + FilterDrops uint8 Ip [16]uint8 } diff --git a/pkg/ebpf/bpf_s390_bpfeb.o b/pkg/ebpf/bpf_s390_bpfeb.o index 018fb3ba4f7f339cea3ecf5e01a317c593bf74ee..875a2cccb7519cd579c2f2f71ebf17288c87b44f 100644 Binary files a/pkg/ebpf/bpf_s390_bpfeb.o and b/pkg/ebpf/bpf_s390_bpfeb.o differ diff --git a/pkg/ebpf/bpf_x86_bpfel.go b/pkg/ebpf/bpf_x86_bpfel.go index b94c9752f7d0ebe5edcb5801beabae13f7a2e1bf..02a04e871c0d6404fe5249b37cbd7a13332d7acf 100644 --- a/pkg/ebpf/bpf_x86_bpfel.go +++ b/pkg/ebpf/bpf_x86_bpfel.go @@ -68,6 +68,7 @@ type BpfFilterValueT struct { Direction BpfDirectionT Action BpfFilterActionT TcpFlags BpfTcpFlagsT + FilterDrops uint8 Ip [16]uint8 } diff --git a/pkg/ebpf/bpf_x86_bpfel.o b/pkg/ebpf/bpf_x86_bpfel.o index 94e9458927ddeb79e42e877e4e1ae55a58f49d70..ee2e4c29de257301708dc9269f6282e430363707 100644 Binary files a/pkg/ebpf/bpf_x86_bpfel.o and b/pkg/ebpf/bpf_x86_bpfel.o differ diff --git a/pkg/tracer/flow_filter.go b/pkg/tracer/flow_filter.go index b1e5441ec49a60da4685a0fd3e827efc915b9eeb..11fc4c72c513317fe310a04eb84402143488c2e9 100644 --- a/pkg/tracer/flow_filter.go +++ b/pkg/tracer/flow_filter.go @@ -24,6 +24,7 @@ type FilterConfig struct { FilterPeerIP string FilterAction string FilterTCPFLags string + FilterDrops bool } type Filter struct { @@ -157,6 +158,9 @@ func (f *Filter) getFilterValue(config *FilterConfig) (ebpf.BpfFilterValueT, err val.TcpFlags = ebpf.BpfTcpFlagsTRST_ACK_FLAG } + if config.FilterDrops { + val.FilterDrops = 1 + } return val, nil }