Tc ungso dev

Author: msune

docker/entrypoint.sh

@@ -34,13 +34,15 @@ _IFACES=$(ls /sys/class/net | tr "\n" " " | sed 's/\s*$//g')
 IFACES=${IFACES:-$_IFACES}
 NETNS=${NETNS:-}
 
+UNSEG_DEV_NAME=${UNSEG_DEV_NAME:-_unseg}
+
 PROG=/opt/sfunnel/src/tc_sfunnel.o
 
 #Compile eBPF program only if rulesset are defined at load time
 #either via file or ENV
 compile(){
 	cd /opt/sfunnel/src
-	DEBUG=${DEBUG} FILE=/etc/sfunnel/ruleset make
+	UNSEG_DEV_IFINDEX=${UNSEG_DEV_IFINDEX} DEBUG=${DEBUG} FILE=/etc/sfunnel/ruleset make
 }
 
 #$1: PROG
@@ -94,6 +96,7 @@ echo "  \$DEBUG='${DEBUG}'"
 echo "  \$NETNS='${NETNS}'"
 echo "  \$N_ATTEMPTS='${N_ATTEMPTS}'"
 echo "  \$RETRY_DELAY='${RETRY_DELAY}'"
+echo "  \$UNSEG_DEV_NAME='${UNSEG_DEV_NAME}'"
 echo "[INFO] Container info:"
 echo "  Kernel: $(uname -a)"
 echo "  Debian: $(cat /etc/debian_version)"
@@ -106,6 +109,14 @@ if [[ "${DEBUG}" == "1" ]]; then
 	set -x
 fi
 
+# Create GSO/TSO/UFO unsegmenting device (work-around
+if [[ "${UNSEG_DEV_NAME}" != ""]]; then
+	ip link add ${UNSEG_DEV_NAME} type dummy
+	ip link set up dev ${UNSEG_DEV_NAME}
+	ethtool -K ${UNSEG_DEV_NAME} gso off tso off ufo off
+	UNSEG_DEV_IFINDEX=$(ip link show ${UNSEG_DEV_NAME} | head -n 1 | awk '{print $1}' | tr -d ':')
+fi
+
 #Make sure /etc/sfunnel exists, even if no volume is mounted
 mkdir -p /etc/sfunnel
 
@@ -155,3 +166,4 @@ for IFACE in ${IFACES}; do
 done
 
 echo "[INFO] Successfully ${OP_STR}ed BPF program(s) on interfaces {${IFACES}} DIRECTION=${DIRECTION}"
+

src/Makefile

@@ -1,5 +1,6 @@
 all: compile
 
+UNSEG_DEV_IFINDEX ?=
 FILE ?= ruleset.default
 CFLAGS = -O2 -Wall -Werror -g
 ifeq ($(DEBUG), 1)
@@ -8,7 +9,7 @@ endif
 
 compile:
 	python3 ../tools/gen.py $(FILE) > ruleset.h
-	clang $(CFLAGS) -target bpf -c sfunnel.c -o tc_sfunnel.o
+	clang $(CFLAGS) -DUNSEG_DEV_IFINDEX=$(UNSEG_DEV_IFINDEX) -target bpf -c sfunnel.c -o tc_sfunnel.o
 
 clean:
 	rm -rf *.o || true

src/sfunnel.c

@@ -14,6 +14,8 @@
 #include "common.h"
 #include "lookup.h"
 
+#define REDIRECT_PKT_BIT 0x1
+
 static __always_inline
 int ip4_funnel(struct __sk_buff* skb, __u8* eth, struct iphdr* ip, void* l4,
 							const __u8 funn_proto,
@@ -317,6 +319,20 @@ static inline int proc_ip4(struct __sk_buff* skb, __u8* eth, struct iphdr* ip){
 	}
 	PRINTK("[%p] Matched rule#%u", skb, rule->id);
 
+#ifndef UNSEG_DEV_IFINDEX
+	//Check that packet is not GSO/TSO/UFO
+	if(skb->gso_size > 0){
+		if(skb->mark&REDIRECT_PKT_BIT){
+			//The packet has been redirected before, but is looped
+			//back GSOed => drop
+			return TC_ACT_SHOT;
+		}
+		skb->mark |= REDIRECT_PKT_BIT;
+        	return bpf_redirect(UNSEG_DEV_IFINDEX, BPF_F_INGRESS);
+	}
+	skb->mark &= ~REDIRECT_PKT_BIT;
+#endif //UNSEG_DEV_IFINDEX
+
 	//Direct actions
 	if(rule->actions.drop.execute){
 		return TC_ACT_SHOT;