New bpfloader netd kernel program

Change the netd bpf program to the new format. Adding map definition and
necessary helper functions to the kernel program code. Move the netd bpf
programs out of bpfloader to a new directory.

Test: dumpsys netd trafficcontroller
Bug: 112334572
Change-Id: I9287285d188e966193532b1522b5d3e67e32e930

4 files changed, 1 insertions, 316 deletions

diff --git a/bpfloader/Android.bp b/bpfloader/Android.bp
index 9f92ce3..22b6d73 100644
--- a/bpfloader/Android.bp
+++ b/bpfloader/Android.bp
@@ -44,19 +44,9 @@ cc_binary {
     ],
 
     required: [
-        "bpf_kern.o",
+        "netd.o",
 // Uncomment once security related patches ready
 //      "time_in_state.o",
     ],
 
 }
-
-bpf {
-    name: "bpf_kern.o",
-    srcs: ["bpf_kern.c"],
-    cflags: [
-        "-Wall",
-        "-Werror",
-    ],
-    include_dirs: ["system/netd/libnetdbpf/include"],
-}
diff --git a/bpfloader/BpfLoader.cpp b/bpfloader/BpfLoader.cpp
index 169ff4c..966f3f6 100644
--- a/bpfloader/BpfLoader.cpp
+++ b/bpfloader/BpfLoader.cpp
@@ -53,7 +53,6 @@ using android::base::unique_fd;
 using std::string;
 
 #define BPF_PROG_PATH "/system/etc/bpf/"
-#define BPF_PROG_SRC BPF_PROG_PATH "bpf_kern.o"
 
 #define CLEANANDEXIT(ret, mapPatterns)                    \
     do {                                                  \
@@ -89,37 +88,4 @@ void loadAllElfObjects(void) {
 int main() {
     // Load all ELF objects, create programs and maps, and pin them
     loadAllElfObjects();
-
-    const std::vector<BpfMapInfo> mapPatterns = {
-        BpfMapInfo(COOKIE_TAG_MAP, COOKIE_TAG_MAP_PATH),
-        BpfMapInfo(UID_COUNTERSET_MAP, UID_COUNTERSET_MAP_PATH),
-        BpfMapInfo(APP_UID_STATS_MAP, APP_UID_STATS_MAP_PATH),
-        BpfMapInfo(UID_STATS_MAP, UID_STATS_MAP_PATH),
-        BpfMapInfo(TAG_STATS_MAP, TAG_STATS_MAP_PATH),
-        BpfMapInfo(IFACE_STATS_MAP, IFACE_STATS_MAP_PATH),
-        BpfMapInfo(CONFIGURATION_MAP, CONFIGURATION_MAP_PATH),
-        BpfMapInfo(UID_OWNER_MAP, UID_OWNER_MAP_PATH),
-    };
-    for (size_t i = 0; i < mapPatterns.size(); i++) {
-        if (mapPatterns[i].fd < 0) {
-            ALOGE("Rerieve Map from %s failed: %d", mapPatterns[i].path.c_str(), mapPatterns[i].fd);
-            CLEANANDEXIT(-1, mapPatterns);
-        }
-    }
-    BpfProgInfo programs[] = {
-        {BPF_CGROUP_INET_EGRESS, BPF_EGRESS_PROG_PATH, BPF_CGROUP_EGRESS_PROG_NAME,
-         BPF_PROG_TYPE_CGROUP_SKB, unique_fd(-1)},
-        {BPF_CGROUP_INET_INGRESS, BPF_INGRESS_PROG_PATH, BPF_CGROUP_INGRESS_PROG_NAME,
-         BPF_PROG_TYPE_CGROUP_SKB, unique_fd(-1)},
-        {MAX_BPF_ATTACH_TYPE, XT_BPF_INGRESS_PROG_PATH, XT_BPF_INGRESS_PROG_NAME,
-         BPF_PROG_TYPE_SOCKET_FILTER, unique_fd(-1)},
-        {MAX_BPF_ATTACH_TYPE, XT_BPF_EGRESS_PROG_PATH, XT_BPF_EGRESS_PROG_NAME,
-         BPF_PROG_TYPE_SOCKET_FILTER, unique_fd(-1)},
-        {MAX_BPF_ATTACH_TYPE, XT_BPF_WHITELIST_PROG_PATH, XT_BPF_WHITELIST_PROG_NAME,
-         BPF_PROG_TYPE_SOCKET_FILTER, unique_fd(-1)},
-        {MAX_BPF_ATTACH_TYPE, XT_BPF_BLACKLIST_PROG_PATH, XT_BPF_BLACKLIST_PROG_NAME,
-         BPF_PROG_TYPE_SOCKET_FILTER, unique_fd(-1)}};
-    int ret = android::bpf::parseProgramsFromFile(BPF_PROG_SRC, programs, ARRAY_SIZE(programs),
-                                                  mapPatterns);
-    CLEANANDEXIT(ret, mapPatterns);
 }
diff --git a/bpfloader/bpf_kern.c b/bpfloader/bpf_kern.c
deleted file mode 100644
index 4fe8140..0000000
--- a/bpfloader/bpf_kern.c
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <linux/bpf.h>
-#include "bpf_kern.h"
-
-
-ELF_SEC(BPF_CGROUP_INGRESS_PROG_NAME)
-int bpf_cgroup_ingress(struct __sk_buff* skb) {
-    return bpf_traffic_account(skb, BPF_INGRESS);
-}
-
-ELF_SEC(BPF_CGROUP_EGRESS_PROG_NAME)
-int bpf_cgroup_egress(struct __sk_buff* skb) {
-    return bpf_traffic_account(skb, BPF_EGRESS);
-}
-
-ELF_SEC(XT_BPF_EGRESS_PROG_NAME)
-int xt_bpf_egress_prog(struct __sk_buff* skb) {
-    uint32_t key = skb->ifindex;
-    bpf_update_stats(skb, IFACE_STATS_MAP, BPF_EGRESS, &key);
-    return BPF_MATCH;
-}
-
-ELF_SEC(XT_BPF_INGRESS_PROG_NAME)
-int xt_bpf_ingress_prog(struct __sk_buff* skb) {
-    uint32_t key = skb->ifindex;
-    bpf_update_stats(skb, IFACE_STATS_MAP, BPF_INGRESS, &key);
-    return BPF_MATCH;
-}
-
-ELF_SEC(XT_BPF_WHITELIST_PROG_NAME)
-int xt_bpf_whitelist_prog(struct __sk_buff* skb) {
-    uint32_t sock_uid = get_socket_uid(skb);
-    if (is_system_uid(sock_uid)) return BPF_MATCH;
-    uint8_t* whitelistMatch = find_map_entry(UID_OWNER_MAP, &sock_uid);
-    if (whitelistMatch) return *whitelistMatch & HAPPY_BOX_MATCH;
-    return BPF_NOMATCH;
-}
-
-ELF_SEC(XT_BPF_BLACKLIST_PROG_NAME)
-int xt_bpf_blacklist_prog(struct __sk_buff* skb) {
-    uint32_t sock_uid = get_socket_uid(skb);
-    uint8_t* blacklistMatch = find_map_entry(UID_OWNER_MAP, &sock_uid);
-    if (blacklistMatch) return *blacklistMatch & PENALTY_BOX_MATCH;
-    return BPF_NOMATCH;
-}
diff --git a/bpfloader/bpf_kern.h b/bpfloader/bpf_kern.h
deleted file mode 100644
index 25edbd4..0000000
--- a/bpfloader/bpf_kern.h
+++ /dev/null
@@ -1,211 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/*
- * This h file together with bpf_kern.c is used for compiling the eBPF kernel
- * program.
- */
-
-#include <linux/bpf.h>
-#include <linux/if.h>
-#include <linux/if_ether.h>
-#include <linux/in.h>
-#include <linux/in6.h>
-#include <linux/ip.h>
-#include <linux/ipv6.h>
-#include <stdbool.h>
-#include <stdint.h>
-#include "netdbpf/bpf_shared.h"
-
-#define ELF_SEC(NAME) __attribute__((section(NAME), used))
-
-struct uid_tag {
-    uint32_t uid;
-    uint32_t tag;
-};
-
-struct stats_key {
-    uint32_t uid;
-    uint32_t tag;
-    uint32_t counterSet;
-    uint32_t ifaceIndex;
-};
-
-struct stats_value {
-    uint64_t rxPackets;
-    uint64_t rxBytes;
-    uint64_t txPackets;
-    uint64_t txBytes;
-};
-
-/* helper functions called from eBPF programs written in C */
-static void* (*find_map_entry)(uint64_t map, void* key) = (void*)BPF_FUNC_map_lookup_elem;
-static int (*write_to_map_entry)(uint64_t map, void* key, void* value,
-                                 uint64_t flags) = (void*)BPF_FUNC_map_update_elem;
-static int (*delete_map_entry)(uint64_t map, void* key) = (void*)BPF_FUNC_map_delete_elem;
-static uint64_t (*get_socket_cookie)(struct __sk_buff* skb) = (void*)BPF_FUNC_get_socket_cookie;
-static uint32_t (*get_socket_uid)(struct __sk_buff* skb) = (void*)BPF_FUNC_get_socket_uid;
-static int (*bpf_skb_load_bytes)(struct __sk_buff* skb, int off, void* to,
-                                 int len) = (void*)BPF_FUNC_skb_load_bytes;
-
-// This is defined for cgroup bpf filter only.
-#define BPF_PASS 1
-#define BPF_DROP 0
-
-// This is used for xt_bpf program only.
-#define BPF_NOMATCH 0
-#define BPF_MATCH 1
-
-#define BPF_EGRESS 0
-#define BPF_INGRESS 1
-
-#define IP_PROTO_OFF offsetof(struct iphdr, protocol)
-#define IPV6_PROTO_OFF offsetof(struct ipv6hdr, nexthdr)
-#define IPPROTO_IHL_OFF 0
-#define TCP_FLAG_OFF 13
-#define RST_OFFSET 2
-
-static __always_inline int is_system_uid(uint32_t uid) {
-    return (uid <= MAX_SYSTEM_UID) && (uid >= MIN_SYSTEM_UID);
-}
-
-static __always_inline inline void bpf_update_stats(struct __sk_buff* skb, uint64_t map,
-                                                    int direction, void *key) {
-    struct stats_value* value;
-    value = find_map_entry(map, key);
-    if (!value) {
-        struct stats_value newValue = {};
-        write_to_map_entry(map, key, &newValue, BPF_NOEXIST);
-        value = find_map_entry(map, key);
-    }
-    if (value) {
-        if (direction == BPF_EGRESS) {
-            __sync_fetch_and_add(&value->txPackets, 1);
-            __sync_fetch_and_add(&value->txBytes, skb->len);
-        } else if (direction == BPF_INGRESS) {
-            __sync_fetch_and_add(&value->rxPackets, 1);
-            __sync_fetch_and_add(&value->rxBytes, skb->len);
-        }
-    }
-}
-
-static inline bool skip_owner_match(struct __sk_buff* skb) {
-    int offset = -1;
-    int ret = 0;
-    if (skb->protocol == ETH_P_IP) {
-        offset = IP_PROTO_OFF;
-        uint8_t proto, ihl;
-        uint16_t flag;
-        ret = bpf_skb_load_bytes(skb, offset, &proto, 1);
-        if (!ret) {
-            if (proto == IPPROTO_ESP) {
-                return true;
-            } else if (proto == IPPROTO_TCP) {
-                ret = bpf_skb_load_bytes(skb, IPPROTO_IHL_OFF, &ihl, 1);
-                ihl = ihl & 0x0F;
-                ret = bpf_skb_load_bytes(skb, ihl * 4 + TCP_FLAG_OFF, &flag, 1);
-                if (ret == 0 && (flag >> RST_OFFSET & 1)) {
-                    return true;
-                }
-            }
-        }
-    } else if (skb->protocol == ETH_P_IPV6) {
-        offset = IPV6_PROTO_OFF;
-        uint8_t proto;
-        ret = bpf_skb_load_bytes(skb, offset, &proto, 1);
-        if (!ret) {
-            if (proto == IPPROTO_ESP) {
-                return true;
-            } else if (proto == IPPROTO_TCP) {
-                uint16_t flag;
-                ret = bpf_skb_load_bytes(skb, sizeof(struct ipv6hdr) + TCP_FLAG_OFF, &flag, 1);
-                if (ret == 0 && (flag >> RST_OFFSET & 1)) {
-                    return true;
-                }
-            }
-        }
-    }
-    return false;
-}
-
-static __always_inline BpfConfig getConfig() {
-    uint32_t mapSettingKey = CONFIGURATION_KEY;
-    BpfConfig* config = find_map_entry(CONFIGURATION_MAP, &mapSettingKey);
-    if (!config) {
-        // Couldn't read configuration entry. Assume everything is disabled.
-        return DEFAULT_CONFIG;
-    }
-    return *config;
-}
-
-static inline int bpf_owner_match(struct __sk_buff* skb, uint32_t uid) {
-    if (skip_owner_match(skb)) return BPF_PASS;
-
-    if ((uid <= MAX_SYSTEM_UID) && (uid >= MIN_SYSTEM_UID)) return BPF_PASS;
-
-    BpfConfig enabledRules = getConfig();
-    if (!enabledRules) {
-        return BPF_PASS;
-    }
-
-    uint8_t* uidEntry = find_map_entry(UID_OWNER_MAP, &uid);
-    uint8_t uidRules = uidEntry ? *uidEntry : 0;
-    if ((enabledRules & DOZABLE_MATCH) && !(uidRules & DOZABLE_MATCH)) {
-        return BPF_DROP;
-    }
-    if ((enabledRules & STANDBY_MATCH) && (uidRules & STANDBY_MATCH)) {
-        return BPF_DROP;
-    }
-    if ((enabledRules & POWERSAVE_MATCH) && !(uidRules & POWERSAVE_MATCH)) {
-        return BPF_DROP;
-    }
-    return BPF_PASS;
-}
-
-static __always_inline inline int bpf_traffic_account(struct __sk_buff* skb, int direction) {
-    uint32_t sock_uid = get_socket_uid(skb);
-    int match = bpf_owner_match(skb, sock_uid);
-    if ((direction == BPF_EGRESS) && (match == BPF_DROP)) {
-        // If an outbound packet is going to be dropped, we do not count that
-        // traffic.
-        return match;
-    }
-
-    uint64_t cookie = get_socket_cookie(skb);
-    struct uid_tag* utag = find_map_entry(COOKIE_TAG_MAP, &cookie);
-    uint32_t uid, tag;
-    if (utag) {
-        uid = utag->uid;
-        tag = utag->tag;
-    } else {
-        uid = sock_uid;
-        tag = 0;
-    }
-
-    struct stats_key key = {.uid = uid, .tag = tag, .counterSet = 0, .ifaceIndex = skb->ifindex};
-
-    uint8_t* counterSet = find_map_entry(UID_COUNTERSET_MAP, &uid);
-    if (counterSet) key.counterSet = (uint32_t)*counterSet;
-
-    if (tag) {
-        bpf_update_stats(skb, TAG_STATS_MAP, direction, &key);
-    }
-
-    key.tag = 0;
-    bpf_update_stats(skb, UID_STATS_MAP, direction, &key);
-    bpf_update_stats(skb, APP_UID_STATS_MAP, direction, &uid);
-    return match;
-}