xdp_loader.cpp

Go to the documentation of this file.

/// \file xdp_loader.cpp
/// \brief Загрузка BPF-объекта, прикрепление/открепление XDP и управление
/// картами. \details Содержит реализацию XdpBlocker: загрузка из встроенного
/// байткода,
///          прикрепление/открепление XDP, очистка и обновление BPF-карт.
 
#include "xdp_loader.h"
 
#include <bpf/bpf.h>
#include <bpf/libbpf.h>
#include <cstdarg>
#include <cstring>
#include <iostream>
#include <net/if.h>
#include <stdexcept>
 
/// Встроенный BPF-байткод, сгенерированный xxd во время сборки.
extern "C" {
extern unsigned char blocker_bpf[];
extern unsigned int blocker_bpf_len;
}
 
/// Колбэк логирования libbpf: передаёт только предупреждения в stderr.
/// @param[in] lvl  Уровень логирования.
/// @param[in] msg  Сообщение.
/// @return 0.
static int PrintLibbpfLog(enum libbpf_print_level lvl, const char *msg,
                          va_list /*args*/) {
  if (lvl == LIBBPF_WARN)
    std::cerr << "libbpf: " << msg;
  return 0;
}
 
/**********************************************************************/
/*  Constructor / destructor                                          */
/**********************************************************************/
 
XdpBlocker::XdpBlocker()
    : obj_(nullptr), whitelist_map_(nullptr), blacklist_map_(nullptr),
      drop_counter_map_(nullptr) {
  libbpf_set_print(PrintLibbpfLog);
}
 
XdpBlocker::~XdpBlocker() { Unload(); }
 
/**********************************************************************/
/*  Load / Unload                                                      */
/**********************************************************************/
 
void XdpBlocker::Load(const std::string &iface) {
  iface_ = iface;
  LoadBPFProgram();
  AttachToInterface();
}
 
void XdpBlocker::Unload() {
  if (iface_.empty())
    return;
  DetachFromInterface();
  if (obj_) {
    bpf_object__close(obj_);
    obj_ = nullptr;
    whitelist_map_ = nullptr;
    blacklist_map_ = nullptr;
    drop_counter_map_ = nullptr;
  }
  iface_.clear();
}
 
/**********************************************************************/
/*  BPF program loading                                                */
/**********************************************************************/
 
/// @brief Открывает и загружает BPF-объект из встроенного массива байткода.
void XdpBlocker::LoadBPFProgram() {
  if (blocker_bpf_len == 0)
    throw std::runtime_error("BPF object is empty");
 
  struct bpf_object_open_opts opts = {};
  opts.sz = sizeof(opts);
  obj_ = bpf_object__open_mem(blocker_bpf, blocker_bpf_len, &opts);
  if (!obj_)
    throw std::runtime_error("failed to open BPF object from memory");
 
  if (bpf_object__load(obj_))
    throw std::runtime_error("failed to load BPF object into kernel");
 
  whitelist_map_ = bpf_object__find_map_by_name(obj_, "whitelist_map");
  if (!whitelist_map_)
    throw std::runtime_error("whitelist_map not found in BPF object");
 
  blacklist_map_ = bpf_object__find_map_by_name(obj_, "blacklist_map");
  if (!blacklist_map_)
    throw std::runtime_error("blacklist_map not found in BPF object");
 
  drop_counter_map_ = bpf_object__find_map_by_name(obj_, "drop_counter");
  if (!drop_counter_map_)
    throw std::runtime_error("drop_counter not found in BPF object");
}
 
/**********************************************************************/
/*  Interface attach / detach                                          */
/**********************************************************************/
 
/// @brief Прикрепляет XDP-программу к сетевому интерфейсу.
void XdpBlocker::AttachToInterface() {
  bpf_program *prog = bpf_object__next_program(obj_, nullptr);
  if (!prog)
    throw std::runtime_error("no BPF program found in object");
 
  bpf_program__set_type(prog, BPF_PROG_TYPE_XDP);
 
  int ifindex = if_nametoindex(iface_.c_str());
  if (ifindex == 0)
    throw std::runtime_error("interface not found: " + iface_);
 
  int fd = bpf_program__fd(prog);
  if (fd < 0)
    throw std::runtime_error("invalid program fd");
 
  struct bpf_xdp_attach_opts attach_opts = {};
  attach_opts.sz = sizeof(attach_opts);
 
  if (bpf_xdp_attach(ifindex, fd, 0, &attach_opts))
    throw std::runtime_error("failed to attach XDP program to " + iface_);
}
 
/// @brief Открепляет XDP-программу от сетевого интерфейса.
void XdpBlocker::DetachFromInterface() {
  int ifindex = if_nametoindex(iface_.c_str());
  if (ifindex == 0)
    return;
 
  struct bpf_xdp_attach_opts detach_opts = {};
  detach_opts.sz = sizeof(detach_opts);
 
  bpf_xdp_detach(ifindex, 0, &detach_opts);
}
 
/**********************************************************************/
/*  Map management                                                     */
/**********************************************************************/
 
/// @brief Перебирает и удаляет все ключи из BPF-карты (итерация LPM trie).
void XdpBlocker::ClearMap(bpf_map *map) {
  int fd = bpf_map__fd(map);
  if (fd < 0)
    return;
 
  struct lpm_key {
    __u32 prefixlen;
    __u32 ip;
  } next_key = {};
  struct lpm_key *cur_key = nullptr;
 
  while (bpf_map_get_next_key(fd, cur_key, &next_key) == 0) {
    bpf_map_delete_elem(fd, &next_key);
    cur_key = &next_key;
  }
}
 
/// @brief Заменяет все записи в указанной BPF-карте.
///
/// Сначала очищает карту, затем вставляет каждую корректную запись BlockEntry.
void XdpBlocker::UpdateMap(const std::string &map_name,
                           const std::vector<BlockEntry> &entries) {
  bpf_map *map = nullptr;
  if (map_name == "whitelist_map")
    map = whitelist_map_;
  else if (map_name == "blacklist_map")
    map = blacklist_map_;
  else
    throw std::invalid_argument("unknown map: " + map_name);
 
  ClearMap(map);
 
  int fd = bpf_map__fd(map);
  if (fd < 0)
    throw std::runtime_error("invalid fd for " + map_name);
 
  __u32 value = (map_name == "whitelist_map") ? 0 : 1;
 
  for (const auto &entry : entries) {
    try {
      CIDR cidr = ParseCIDR(entry.ip);
      struct {
        __u32 prefixlen;
        __u32 ip;
      } key = {cidr.prefixlen, cidr.ip};
 
      if (bpf_map_update_elem(fd, &key, &value, BPF_ANY))
        std::cerr << "warning: failed to add " << entry.ip << " to " << map_name
                  << std::endl;
    } catch (const std::exception &e) {
      std::cerr << "warning: skipping invalid entry '" << entry.ip
                << "': " << e.what() << std::endl;
    }
  }
}
 
void XdpBlocker::UpdateWhitelist(const std::vector<BlockEntry> &entries) {
  UpdateMap("whitelist_map", entries);
}
 
void XdpBlocker::UpdateBlacklist(const std::vector<BlockEntry> &entries) {
  UpdateMap("blacklist_map", entries);
}
 
/**********************************************************************/
/*  Drop counter reading                                               */
/**********************************************************************/
 
/// @brief Читает все записи из карты drop_counter и атомарно очищает их.
std::vector<std::pair<uint32_t, uint64_t>>
XdpBlocker::ReadAndClearDropCounters() {
  std::vector<std::pair<uint32_t, uint64_t>> result;
 
  int fd = bpf_map__fd(drop_counter_map_);
  if (fd < 0)
    return result;
 
  __u32 *cur_key = nullptr;
  __u32 next_key = 0;
  __u64 value = 0;
 
  while (bpf_map_get_next_key(fd, cur_key, &next_key) == 0) {
    if (bpf_map_lookup_elem(fd, &next_key, &value) == 0 && value > 0)
      result.emplace_back(next_key, value);
    bpf_map_delete_elem(fd, &next_key);
    cur_key = &next_key;
  }
 
  return result;
}