kaffa/XDP-Firewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update XDP filter layout with port range support.

Browse Source
This commit is contained in:
Christian Deacon
2025-03-21 18:21:31 -04:00
parent e4605c81a3
commit 783fcef19a
3 changed files with 84 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
src/common/types.h
View File

@@ -33,11 +33,17 @@ struct filter_tcp
{
unsigned int enabled : 1;
unsigned int do_sport : 1;
u16 sport;
unsigned int do_sport_min : 1;
u16 sport_min;
unsigned int do_dport : 1;
u16 dport;
unsigned int do_sport_max : 1;
u16 sport_max;
unsigned int do_dport_min : 1;
u16 dport_min;
unsigned int do_dport_max : 1;
u16 dport_max;
// TCP flags.
unsigned int do_urg : 1;
@@ -69,11 +75,17 @@ struct filter_udp
{
unsigned int enabled : 1;
unsigned int do_sport : 1;
u16 sport;
unsigned int do_sport_min : 1;
u16 sport_min;
unsigned int do_dport : 1;
u16 dport;
unsigned int do_sport_max : 1;
u16 sport_max;
unsigned int do_dport_min : 1;
u16 dport_min;
unsigned int do_dport_max : 1;
u16 dport_max;
} typedef filter_udp_t;
struct filter_icmp

53
src/loader/utils/xdp.c
View File

@@ -231,6 +231,11 @@ int update_filter(int map_filters, filter_rule_cfg_t* filter_cfg, int idx)
filter_t filter = {0};
filter.set = filter_cfg->set;
if (!filter_cfg->enabled)
{
return 0;
}
if (filter_cfg->enabled > -1)
{
@@ -340,18 +345,26 @@ int update_filter(int map_filters, filter_rule_cfg_t* filter_cfg, int idx)
filter.tcp.enabled = filter_cfg->tcp.enabled;
}
if (filter_cfg->tcp.sport > -1)
{
filter.tcp.do_sport = 1;
port_range_t tcp_src_port_range = parse_port_range(filter_cfg->tcp.sport);
filter.tcp.sport = htons((u16)filter_cfg->tcp.sport);
if (tcp_src_port_range.success)
{
filter.tcp.do_sport_min = 1;
filter.tcp.do_sport_max = 1;
filter.tcp.sport_min = htons(tcp_src_port_range.min);
filter.tcp.sport_max = htons(tcp_src_port_range.max);
}
if (filter_cfg->tcp.dport > -1)
{
filter.tcp.do_dport = 1;
port_range_t tcp_dst_port_range = parse_port_range(filter_cfg->tcp.dport);
filter.tcp.dport = htons((u16)filter_cfg->tcp.dport);
if (tcp_dst_port_range.success)
{
filter.tcp.do_dport_min = 1;
filter.tcp.do_dport_max = 1;
filter.tcp.dport_min = htons(tcp_dst_port_range.min);
filter.tcp.dport_max = htons(tcp_dst_port_range.max);
}
if (filter_cfg->tcp.urg > -1)
@@ -415,18 +428,26 @@ int update_filter(int map_filters, filter_rule_cfg_t* filter_cfg, int idx)
filter.udp.enabled = filter_cfg->udp.enabled;
}
if (filter_cfg->udp.sport > -1)
{
filter.udp.do_sport = 1;
port_range_t udp_src_port_range = parse_port_range(filter_cfg->udp.sport);
filter.udp.sport = htons((u16)filter_cfg->udp.sport);
if (udp_src_port_range.success)
{
filter.udp.do_sport_min = 1;
filter.udp.do_sport_max = 1;
filter.udp.sport_min = htons(udp_src_port_range.min);
filter.udp.sport_max = htons(udp_src_port_range.max);
}
if (filter_cfg->udp.dport > -1)
{
filter.udp.do_dport = 1;
port_range_t udp_dst_port_range = parse_port_range(filter_cfg->udp.dport);
filter.udp.dport = htons((u16)filter_cfg->udp.dport);
if (udp_dst_port_range.success)
{
filter.udp.do_dport_min = 1;
filter.udp.do_dport_max = 1;
filter.udp.dport_min = htons(udp_dst_port_range.min);
filter.udp.dport_max = htons(udp_dst_port_range.max);
}
if (filter_cfg->icmp.enabled > -1)

35
src/xdp/prog.c
View File

@@ -446,14 +446,24 @@ int xdp_prog_main(struct xdp_md *ctx)
continue;
}
// Source port.
if (filter->tcp.do_sport && filter->tcp.sport != tcph->source)
// Source port checks.
if (filter->tcp.do_sport_min && tcph->source < filter->tcp.sport_min)
{
continue;
}
// Destination port.
if (filter->tcp.do_dport && filter->tcp.dport != tcph->dest)
if (filter->tcp.do_sport_max && tcph->source > filter->tcp.sport_max)
{
continue;
}
// Destination port checks.
if (filter->tcp.do_dport_min && tcph->dest < filter->tcp.dport_min)
{
continue;
}
if (filter->tcp.do_dport_max && tcph->dest > filter->tcp.dport_max)
{
continue;
}
@@ -513,16 +523,25 @@ int xdp_prog_main(struct xdp_md *ctx)
continue;
}
// Source port.
if (filter->udp.do_sport && filter->udp.sport != udph->source)
// Source port checks.
if (filter->udp.do_sport_min && udph->source < filter->udp.sport_min)
{
continue;
}
// Destination port.
if (filter->udp.do_dport && filter->udp.dport != udph->dest)
if (filter->udp.do_sport_max && udph->source > filter->udp.sport_max)
{
continue;
}
// Destination port checks.
if (filter->udp.do_dport_min && udph->source < filter->udp.dport_min)
{
continue;
}
if (filter->udp.do_dport_max && udph->source > filter->udp.dport_max)
{
continue;
}
}