1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
|
/* Copyright (c) 2016 Facebook
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of version 2 of the GNU General Public
* License as published by the Free Software Foundation.
*/
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/in.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <uapi/linux/bpf.h>
#include <net/ip.h>
#include "bpf_helpers.h"
#define DEFAULT_PKTGEN_UDP_PORT 9
#define DEBUG 0
static int tcp(void *data, uint64_t tp_off, void *data_end)
{
struct tcphdr *tcp = data + tp_off;
if (tcp + 1 > data_end)
return 0;
if (tcp->dest == htons(80) || tcp->source == htons(80))
return TC_ACT_SHOT;
return 0;
}
static int udp(void *data, uint64_t tp_off, void *data_end)
{
struct udphdr *udp = data + tp_off;
if (udp + 1 > data_end)
return 0;
if (udp->dest == htons(DEFAULT_PKTGEN_UDP_PORT) ||
udp->source == htons(DEFAULT_PKTGEN_UDP_PORT)) {
if (DEBUG) {
char fmt[] = "udp port 9 indeed\n";
bpf_trace_printk(fmt, sizeof(fmt));
}
return TC_ACT_SHOT;
}
return 0;
}
static int parse_ipv4(void *data, uint64_t nh_off, void *data_end)
{
struct iphdr *iph;
uint64_t ihl_len;
iph = data + nh_off;
if (iph + 1 > data_end)
return 0;
if (ip_is_fragment(iph))
return 0;
ihl_len = iph->ihl * 4;
if (iph->protocol == IPPROTO_IPIP) {
iph = data + nh_off + ihl_len;
if (iph + 1 > data_end)
return 0;
ihl_len += iph->ihl * 4;
}
if (iph->protocol == IPPROTO_TCP)
return tcp(data, nh_off + ihl_len, data_end);
else if (iph->protocol == IPPROTO_UDP)
return udp(data, nh_off + ihl_len, data_end);
return 0;
}
static int parse_ipv6(void *data, uint64_t nh_off, void *data_end)
{
struct ipv6hdr *ip6h;
struct iphdr *iph;
uint64_t ihl_len = sizeof(struct ipv6hdr);
uint64_t nexthdr;
ip6h = data + nh_off;
if (ip6h + 1 > data_end)
return 0;
nexthdr = ip6h->nexthdr;
if (nexthdr == IPPROTO_IPIP) {
iph = data + nh_off + ihl_len;
if (iph + 1 > data_end)
return 0;
ihl_len += iph->ihl * 4;
nexthdr = iph->protocol;
} else if (nexthdr == IPPROTO_IPV6) {
ip6h = data + nh_off + ihl_len;
if (ip6h + 1 > data_end)
return 0;
ihl_len += sizeof(struct ipv6hdr);
nexthdr = ip6h->nexthdr;
}
if (nexthdr == IPPROTO_TCP)
return tcp(data, nh_off + ihl_len, data_end);
else if (nexthdr == IPPROTO_UDP)
return udp(data, nh_off + ihl_len, data_end);
return 0;
}
struct vlan_hdr {
uint16_t h_vlan_TCI;
uint16_t h_vlan_encapsulated_proto;
};
SEC("varlen")
int handle_ingress(struct __sk_buff *skb)
{
void *data = (void *)(long)skb->data;
struct ethhdr *eth = data;
void *data_end = (void *)(long)skb->data_end;
uint64_t h_proto, nh_off;
nh_off = sizeof(*eth);
if (data + nh_off > data_end)
return 0;
h_proto = eth->h_proto;
if (h_proto == ETH_P_8021Q || h_proto == ETH_P_8021AD) {
struct vlan_hdr *vhdr;
vhdr = data + nh_off;
nh_off += sizeof(struct vlan_hdr);
if (data + nh_off > data_end)
return 0;
h_proto = vhdr->h_vlan_encapsulated_proto;
}
if (h_proto == ETH_P_8021Q || h_proto == ETH_P_8021AD) {
struct vlan_hdr *vhdr;
vhdr = data + nh_off;
nh_off += sizeof(struct vlan_hdr);
if (data + nh_off > data_end)
return 0;
h_proto = vhdr->h_vlan_encapsulated_proto;
}
if (h_proto == htons(ETH_P_IP))
return parse_ipv4(data, nh_off, data_end);
else if (h_proto == htons(ETH_P_IPV6))
return parse_ipv6(data, nh_off, data_end);
return 0;
}
char _license[] SEC("license") = "GPL";
|
