kaffa/XDP-Firewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix issue with updating IPv6 client stats and rename map names.

Browse Source
This commit is contained in:
Christian Deacon
2025-02-27 07:09:30 -05:00
parent 47753af3d5
commit 5f817f466b
10 changed files with 51 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/xdp/prog.c
View File

@@ -82,7 +82,7 @@ int xdp_prog_main(struct xdp_md *ctx)
// Get stats map.
u32 key = 0;
stats_t*stats = bpf_map_lookup_elem(&stats_map, &key);
stats_t*stats = bpf_map_lookup_elem(&map_stats, &key);
u64 now = bpf_ktime_get_ns();
@@ -91,11 +91,11 @@ int xdp_prog_main(struct xdp_md *ctx)
if (iph6)
{
blocked = bpf_map_lookup_elem(&ip6_blacklist_map, &src_ip6);
blocked = bpf_map_lookup_elem(&map_ip6_blacklist, &src_ip6);
}
else if (iph)
{
blocked = bpf_map_lookup_elem(&ip_blacklist_map, &iph->saddr);
blocked = bpf_map_lookup_elem(&map_ip_blacklist, &iph->saddr);
}
if (blocked != NULL && *blocked > 0)
@@ -105,11 +105,11 @@ int xdp_prog_main(struct xdp_md *ctx)
// Remove element from map.
if (iph6)
{
bpf_map_delete_elem(&ip6_blacklist_map, &src_ip6);
bpf_map_delete_elem(&map_ip6_blacklist, &src_ip6);
}
else if (iph)
{
bpf_map_delete_elem(&ip_blacklist_map, &iph->saddr);
bpf_map_delete_elem(&map_ip_blacklist, &iph->saddr);
}
}
else
@@ -272,7 +272,7 @@ int xdp_prog_main(struct xdp_md *ctx)
{
u32 key = i;
filter_t *filter = bpf_map_lookup_elem(&filters_map, &key);
filter_t *filter = bpf_map_lookup_elem(&map_filters, &key);
// Check if ID is above 0 (if 0, it's an invalid rule).
if (!filter || !filter->set)
@@ -561,11 +561,11 @@ int xdp_prog_main(struct xdp_md *ctx)
if (iph6)
{
bpf_map_update_elem(&ip6_blacklist_map, &src_ip6, &new_time, BPF_ANY);
bpf_map_update_elem(&map_ip6_blacklist, &src_ip6, &new_time, BPF_ANY);
}
else if (iph)
{
bpf_map_update_elem(&ip_blacklist_map, &iph->saddr, &new_time, BPF_ANY);
bpf_map_update_elem(&map_ip_blacklist, &iph->saddr, &new_time, BPF_ANY);
}
}

2
src/xdp/utils/logging.c
View File

@@ -21,7 +21,7 @@
*/
static __always_inline int LogFilterMsg(struct iphdr* iph, struct ipv6hdr* iph6, u16 src_port, u16 dst_port, u8 protocol, u64 now, u64 pps, u64 bps, int filter_id)
{
filter_log_event_t* e = bpf_ringbuf_reserve(&filter_log_map, sizeof(*e), 0);
filter_log_event_t* e = bpf_ringbuf_reserve(&map_filter_log, sizeof(*e), 0);
if (e)
{

14
src/xdp/utils/maps.h
View File

@@ -11,7 +11,7 @@ struct
__uint(max_entries, MAX_FILTERS);
__type(key, u32);
__type(value, filter_t);
} filters_map SEC(".maps");
} map_filters SEC(".maps");
struct
{
@@ -19,7 +19,7 @@ struct
__uint(max_entries, 1);
__type(key, u32);
__type(value, stats_t);
} stats_map SEC(".maps");
} map_stats SEC(".maps");
struct
{
@@ -31,7 +31,7 @@ struct
__type(key, u32);
#endif
__type(value, ip_stats_t);
} ip_stats_map SEC(".maps");
} map_ip_stats SEC(".maps");
struct
{
@@ -39,7 +39,7 @@ struct
__uint(max_entries, MAX_TRACK_IPS);
__type(key, u32);
__type(value, u64);
} ip_blacklist_map SEC(".maps");
} map_ip_blacklist SEC(".maps");
struct
{
@@ -51,7 +51,7 @@ struct
__type(key, u128);
#endif
__type(value, ip_stats_t);
} ip6_stats_map SEC(".maps");
} map_ip6_stats SEC(".maps");
struct
{
@@ -59,12 +59,12 @@ struct
__uint(max_entries, MAX_TRACK_IPS);
__type(key, u128);
__type(value, u64);
} ip6_blacklist_map SEC(".maps");
} map_ip6_blacklist SEC(".maps");
#ifdef ENABLE_FILTER_LOGGING
struct
{
__uint(type, BPF_MAP_TYPE_RINGBUF);
__uint(max_entries, 1 << 16);
} filter_log_map SEC(".maps");
} map_filter_log SEC(".maps");
#endif

16
src/xdp/utils/rl.c
View File

@@ -21,9 +21,9 @@ static __always_inline void UpdateIpStats(u64 *pps, u64 *bps, u32 ip, u16 port,
key.port = port;
key.protocol = protocol;
ip_stats_t *ip_stats = bpf_map_lookup_elem(&ip_stats_map, &key);
ip_stats_t *ip_stats = bpf_map_lookup_elem(&map_ip_stats, &key);
#else
ip_stats_t *ip_stats = bpf_map_lookup_elem(&ip_stats_map, &ip);
ip_stats_t *ip_stats = bpf_map_lookup_elem(&map_ip_stats, &ip);
#endif
if (ip_stats)
@@ -58,9 +58,9 @@ static __always_inline void UpdateIpStats(u64 *pps, u64 *bps, u32 ip, u16 port,
*bps = new.bps;
#ifdef USE_FLOW_RL
bpf_map_update_elem(&ip_stats_map, &key, &new, BPF_ANY);
bpf_map_update_elem(&map_ip_stats, &key, &new, BPF_ANY);
#else
bpf_map_update_elem(&ip_stats_map, &ip, &new, BPF_ANY);
bpf_map_update_elem(&map_ip_stats, &ip, &new, BPF_ANY);
#endif
}
}
@@ -86,9 +86,9 @@ static __always_inline void UpdateIp6Stats(u64 *pps, u64 *bps, u128 *ip, u16 por
key.port = port;
key.protocol = protocol;
ip_stats_t *ip_stats = bpf_map_lookup_elem(&ip_stats_map, &key);
ip_stats_t *ip_stats = bpf_map_lookup_elem(&map_ip6_stats, &key);
#else
ip_stats_t *ip_stats = bpf_map_lookup_elem(&ip_stats_map, ip);
ip_stats_t *ip_stats = bpf_map_lookup_elem(&map_ip6_stats, ip);
#endif
if (ip_stats)
@@ -123,9 +123,9 @@ static __always_inline void UpdateIp6Stats(u64 *pps, u64 *bps, u128 *ip, u16 por
*bps = new.bps;
#ifdef USE_FLOW_RL
bpf_map_update_elem(&ip_stats_map, &key, &new, BPF_ANY);
bpf_map_update_elem(&map_ip6_stats, &key, &new, BPF_ANY);
#else
bpf_map_update_elem(&ip_stats_map, ip, &new, BPF_ANY);
bpf_map_update_elem(&map_ip6_stats, ip, &new, BPF_ANY);
#endif
}
}