IPv6 prefix filtering

doc/developers/tests.rst

@@ -54,6 +54,8 @@ End-to-end tests are designed to validate the bytecode generated by ``bpfilter``
 
 Run end-to-end tests with ``make e2e``. ``root`` privileges are required to start the daemon and call ``bpf(BPF_PROG_TEST_RUN)``.
 
+The test packets are generated using a Python script and Scapy: the scripts creates ``packets.h`` which is included in the end-to-end tests sources. See ``tests/e2e/genpkts.py``.
+
 **Adding a new end-to-end test**
 
 End-to-end tests are defined in ``tests/e2e`` and use ``cmocka`` as the testing library. To add a new end-to-end test:
@@ -92,15 +94,10 @@ The example below will create an empty chain with a default ``ACCEPT`` policy. W
             bf_test_fail("failed to send the chain to the daemon");
 
         assert_non_null(prog = bf_test_prog_get("bf_e2e_testprog"));
-
-        assert_success(bf_test_prog_run(
-            prog,
-            2,
-            pkt_local_ip6_tcp,
-            ARRAY_SIZE(pkt_local_ip6_tcp)
-        ));
+        assert_success(bf_test_prog_run(prog, 2, &pkt_local_ip6_tcp));
     }
 
+
 Benchmarking
 ------------
 

doc/usage/bfcli.rst

@@ -232,8 +232,8 @@ With:
     * - :rspan:`1` Source address
       - :rspan:`1` ``ip6.saddr``
       - ``eq``
-      - :rspan:`3` ``$IP/$MASK``
-      - :rspan:`3` ``/$MASK`` is optional, `/128` is used by default.
+      - :rspan:`3` ``$IP/$PREFIX``
+      - :rspan:`3` ``/$PREFIX`` is optional, ``/128`` is used by default.
     * - ``not``
     * - :rspan:`1` Destination address
       - :rspan:`1` ``ip6.daddr``

src/bfcli/parser.y

@@ -441,32 +441,26 @@ matcher         : matcher_type matcher_op MATCHER_META_IFINDEX
                 | matcher_type matcher_op MATCHER_IP6_ADDR
                 {
                     _cleanup_bf_matcher_ struct bf_matcher *matcher = NULL;
-                    struct bf_matcher_ip6_addr addr;
-                    int shift, lsb_shift, msb_shift;
-                    char *mask;
+                    struct bf_matcher_ip6_addr addr = {};
+                    char *mask_str;
+                    int mask = 128;
                     int r;
 
                     // If '/' is found, parse the mask, otherwise use /128.
-                    mask = strchr($3, '/');
-                    if (mask) {
-                        *mask = '\0';
-                        ++mask;
-
-                        int m = atoi(mask);
-                        if (m == 0)
-                            bf_parse_err("failed to parse IPv6 mask: %s\n", mask);
-
-                        shift = 128 - m;
-                        lsb_shift = min(64, shift);
-                        msb_shift = shift - lsb_shift;
-
-                        addr.mask[0] = msb_shift == 64 ? 0 : ~0ULL << msb_shift;
-                        addr.mask[1] = lsb_shift == 64 ? 0 : ~0ULL << lsb_shift;
-                    } else {
-                        addr.mask[0] = ~0ULL;
-                        addr.mask[1] = ~0ULL;
+                    mask_str = strchr($3, '/');
+                    if (mask_str) {
+                        *mask_str = '\0';
+                        ++mask_str;
+
+                        mask = atoi(mask_str);
+                        if (mask == 0)
+                            bf_parse_err("failed to parse IPv6 mask: %s", mask_str);
                     }
 
+                    for (int i = 0; i < mask / 8; ++i)
+                        addr.mask[i] = (uint8_t)0xff;
+                    addr.mask[mask / 8] = (uint8_t)0xff << (8 - mask % 8);
+
                     // Convert the IPv6 from string to uint64_t[2].
                     r = inet_pton(AF_INET6, $3, addr.addr);
                     if (r != 1)

src/bpfilter/cgen/matcher/ip6.c

@@ -13,6 +13,7 @@
 #include <endian.h>
 #include <errno.h>
 #include <stddef.h>
+#include <stdint.h>
 
 #include "bpfilter/cgen/jmp.h"
 #include "bpfilter/cgen/program.h"
@@ -22,6 +23,9 @@
 
 #include "external/filter.h"
 
+#define _bf_make32(a, b, c, d) (((a) << 24) | ((b) << 16) | ((c) << 8) | (d))
+#define _BF_MASK_LAST_BYTE 15
+
 static int _bf_matcher_generate_ip6_addr(struct bf_program *program,
                                          const struct bf_matcher *matcher)
 {
@@ -34,43 +38,77 @@ static int _bf_matcher_generate_ip6_addr(struct bf_program *program,
     EMIT(program, BPF_LDX_MEM(BPF_DW, BF_REG_1, BF_REG_L3, offset));
     EMIT(program, BPF_LDX_MEM(BPF_DW, BF_REG_2, BF_REG_L3, offset + 8));
 
-    if (addr->mask[0] != ~0ULL || addr->mask[1] != ~0ULL) {
-        EMIT(program, BPF_MOV32_IMM(BF_REG_3, addr->mask[0] >> 32));
+    if (addr->mask[_BF_MASK_LAST_BYTE] != (uint8_t)~0) {
+        EMIT(program,
+             BPF_MOV32_IMM(BF_REG_3, _bf_make32(addr->mask[7], addr->mask[6],
+                                                addr->mask[5], addr->mask[4])));
         EMIT(program, BPF_ALU64_IMM(BPF_LSH, BF_REG_3, 32));
-        EMIT(program, BPF_MOV32_IMM(BF_REG_4, addr->mask[0] & 0xffffffff));
+        EMIT(program,
+             BPF_MOV32_IMM(BF_REG_4, _bf_make32(addr->mask[3], addr->mask[2],
+                                                addr->mask[1], addr->mask[0])));
         EMIT(program, BPF_ALU64_REG(BPF_OR, BF_REG_3, BF_REG_4));
         EMIT(program, BPF_ALU64_REG(BPF_AND, BF_REG_1, BF_REG_3));
 
-        EMIT(program, BPF_MOV32_IMM(BF_REG_3, addr->mask[1] >> 32));
+        EMIT(program,
+             BPF_MOV32_IMM(BF_REG_3,
+                           _bf_make32(addr->mask[15], addr->mask[14],
+                                      addr->mask[13], addr->mask[12])));
         EMIT(program, BPF_ALU64_IMM(BPF_LSH, BF_REG_3, 32));
-        EMIT(program, BPF_MOV32_IMM(BF_REG_4, addr->mask[1] & 0xffffffff));
+        EMIT(program,
+             BPF_MOV32_IMM(BF_REG_4, _bf_make32(addr->mask[11], addr->mask[10],
+                                                addr->mask[9], addr->mask[8])));
         EMIT(program, BPF_ALU64_REG(BPF_OR, BF_REG_3, BF_REG_4));
         EMIT(program, BPF_ALU64_REG(BPF_AND, BF_REG_2, BF_REG_3));
     }
 
     if (matcher->op == BF_MATCHER_EQ) {
         /* If we want to match an IP, both addr->addr[0] and addr->addr[1]
          * must match the packet, otherwise we jump to the next rule. */
-        EMIT(program, BPF_MOV32_IMM(BF_REG_3, addr->addr[0] >> 32));
+        EMIT(program, BPF_MOV32_IMM(BF_REG_3,
+                                    _bf_make32(addr->addr[7] & addr->mask[7],
+                                               addr->addr[6] & addr->mask[6],
+                                               addr->addr[5] & addr->mask[5],
+                                               addr->addr[4] & addr->mask[4])));
         EMIT(program, BPF_ALU64_IMM(BPF_LSH, BF_REG_3, 32));
-        EMIT(program, BPF_MOV32_IMM(BF_REG_4, addr->addr[0] & 0xffffffff));
+        EMIT(program, BPF_MOV32_IMM(BF_REG_4,
+                                    _bf_make32(addr->addr[3] & addr->mask[3],
+                                               addr->addr[2] & addr->mask[2],
+                                               addr->addr[1] & addr->mask[1],
+                                               addr->addr[0] & addr->mask[0])));
         EMIT(program, BPF_ALU64_REG(BPF_OR, BF_REG_3, BF_REG_4));
         EMIT_FIXUP_JMP_NEXT_RULE(program,
                                  BPF_JMP_REG(BPF_JNE, BF_REG_1, BF_REG_3, 0));
 
-        EMIT(program, BPF_MOV32_IMM(BF_REG_3, addr->addr[1] >> 32));
+        EMIT(program,
+             BPF_MOV32_IMM(BF_REG_3,
+                           _bf_make32(addr->addr[15] & addr->mask[15],
+                                      addr->addr[14] & addr->mask[14],
+                                      addr->addr[13] & addr->mask[13],
+                                      addr->addr[12] & addr->mask[12])));
         EMIT(program, BPF_ALU64_IMM(BPF_LSH, BF_REG_3, 32));
-        EMIT(program, BPF_MOV32_IMM(BF_REG_4, addr->addr[1] & 0xffffffff));
+        EMIT(program, BPF_MOV32_IMM(BF_REG_4,
+                                    _bf_make32(addr->addr[11] & addr->mask[11],
+                                               addr->addr[10] & addr->mask[10],
+                                               addr->addr[9] & addr->mask[9],
+                                               addr->addr[8] & addr->mask[8])));
         EMIT(program, BPF_ALU64_REG(BPF_OR, BF_REG_3, BF_REG_4));
         EMIT_FIXUP_JMP_NEXT_RULE(program,
                                  BPF_JMP_REG(BPF_JNE, BF_REG_2, BF_REG_3, 0));
     } else {
         /* If we want to *not* match an IP, none of addr->addr[0] and
          * addr->addr[1] should match the packet, otherwise we jump to the
          * next rule. */
-        EMIT(program, BPF_MOV32_IMM(BF_REG_3, addr->addr[0] >> 32));
+        EMIT(program, BPF_MOV32_IMM(BF_REG_3,
+                                    _bf_make32(addr->addr[7] & addr->mask[7],
+                                               addr->addr[6] & addr->mask[6],
+                                               addr->addr[5] & addr->mask[5],
+                                               addr->addr[4] & addr->mask[4])));
         EMIT(program, BPF_ALU64_IMM(BPF_LSH, BF_REG_3, 32));
-        EMIT(program, BPF_MOV32_IMM(BF_REG_4, addr->addr[0] & 0xffffffff));
+        EMIT(program, BPF_MOV32_IMM(BF_REG_4,
+                                    _bf_make32(addr->addr[3] & addr->mask[3],
+                                               addr->addr[2] & addr->mask[2],
+                                               addr->addr[1] & addr->mask[1],
+                                               addr->addr[0] & addr->mask[0])));
         EMIT(program, BPF_ALU64_REG(BPF_OR, BF_REG_3, BF_REG_4));
 
         /* Branching:
@@ -82,9 +120,18 @@ static int _bf_matcher_generate_ip6_addr(struct bf_program *program,
         j0 =
             bf_jmpctx_get(program, BPF_JMP_REG(BPF_JNE, BF_REG_1, BF_REG_3, 0));
 
-        EMIT(program, BPF_MOV32_IMM(BF_REG_3, addr->addr[1] >> 32));
+        EMIT(program,
+             BPF_MOV32_IMM(BF_REG_3,
+                           _bf_make32(addr->addr[15] & addr->mask[15],
+                                      addr->addr[14] & addr->mask[14],
+                                      addr->addr[13] & addr->mask[13],
+                                      addr->addr[12] & addr->mask[12])));
         EMIT(program, BPF_ALU64_IMM(BPF_LSH, BF_REG_3, 32));
-        EMIT(program, BPF_MOV32_IMM(BF_REG_4, addr->addr[1] & 0xffffffff));
+        EMIT(program, BPF_MOV32_IMM(BF_REG_4,
+                                    _bf_make32(addr->addr[11] & addr->mask[11],
+                                               addr->addr[10] & addr->mask[10],
+                                               addr->addr[9] & addr->mask[9],
+                                               addr->addr[8] & addr->mask[8])));
         EMIT(program, BPF_ALU64_REG(BPF_OR, BF_REG_3, BF_REG_4));
 
         /* Branching:

src/core/matcher.h

@@ -92,9 +92,9 @@ struct bf_matcher_ip4_addr
 struct bf_matcher_ip6_addr
 {
     /// 128-bits IPv6 address.
-    uint64_t addr[2];
+    uint8_t addr[16];
     /// 128-bits IPv6 mask.
-    uint64_t mask[2];
+    uint8_t mask[16];
 };
 
 /**

tests/e2e/CMakeLists.txt

@@ -1,8 +1,29 @@
 # SPDX-License-Identifier: GPL-2.0-only
 # Copyright (c) 2023 Meta Platforms, Inc. and affiliates.
 
-add_executable(e2e_bin
+add_custom_command(
+    COMMAND
+        ${CMAKE_COMMAND}
+            -E make_directory
+            ${CMAKE_CURRENT_BINARY_DIR}/include
+	COMMAND
+		${CMAKE_CURRENT_SOURCE_DIR}/genpkts.py
+            --output ${CMAKE_CURRENT_BINARY_DIR}/include/packets.h
+    DEPENDS
+        ${CMAKE_CURRENT_SOURCE_DIR}/genpkts.py
+	OUTPUT
+        ${CMAKE_CURRENT_BINARY_DIR}/include/packets.h
+	COMMENT "Generating the end-to-end test packets"
+)
+
+add_executable(e2e_bin EXCLUDE_FROM_ALL
     ${CMAKE_CURRENT_SOURCE_DIR}/main.c
+    ${CMAKE_CURRENT_BINARY_DIR}/include/packets.h
+)
+
+target_include_directories(e2e_bin
+    PRIVATE
+        ${CMAKE_CURRENT_BINARY_DIR}/include
 )
 
 target_link_libraries(e2e_bin

tests/e2e/genpkts.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python
+
+import argparse
+import pathlib
+
+from scapy.layers.l2 import Ether
+from scapy.layers.inet6 import IPv6, TCP
+
+packets = [
+    {
+        "name": "pkt_local_ip6_tcp",
+        "packet": Ether(src=0x01, dst=0x02)
+        / IPv6(src="::1", dst="::2")
+        / TCP(sport=31337, dport=31415),
+    },
+    {
+        "name": "pkt_remote_ip6_tcp",
+        "packet": Ether(src=0x01, dst=0x02)
+        / IPv6(
+            src="542c:1a31:f964:946c:5a24:e71e:4d26:b87e",
+            dst="5232:185a:52f9:0ab4:8025:7974:2299:eb04",
+        )
+        / TCP(sport=31337, dport=31415),
+    },
+]
+
+template = """#pragma once
+
+#include "harness/prog.h"
+
+{}
+"""
+
+packet_template = """__attribute__((unused)) static const uint8_t _{}_data[] = {{ {} }};
+__attribute__((unused)) static const struct bf_test_packet _{} = {{
+    .len = {},
+    .data = &_{}_data,
+}};
+__attribute__((unused)) static const struct bf_test_packet *{} = &_{};
+"""
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--output",
+        "-o",
+        type=pathlib.Path,
+        help="Output file path",
+        default="packets.h",
+    )
+    args = parser.parse_args()
+
+    strs = []
+    for packet in packets:
+        raw = [f"0x{byte:02x}" for byte in bytes(packet["packet"])]
+        name = packet["name"]
+
+        strs.append(
+            packet_template.format(
+                name, ", ".join(raw), name, len(raw), name, name, name
+            )
+        )
+
+    with open(args.output, "w") as output:
+        output.write(template.format("\n\n".join(strs)))
+
+
+if __name__ == "__main__":
+    main()