1*fae6e9adSlinfeng // SPDX-License-Identifier: (APACHE-2.0 OR MIT) 2*fae6e9adSlinfeng // Copyright 2016 6WIND S.A. <quentin.monnet@6wind.com> 3*fae6e9adSlinfeng 4*fae6e9adSlinfeng // Block TCP packets on source or destination port 0x9999. 5*fae6e9adSlinfeng 6*fae6e9adSlinfeng #include <linux/ip.h> 7*fae6e9adSlinfeng #include <linux/in.h> 8*fae6e9adSlinfeng #include <linux/tcp.h> 9*fae6e9adSlinfeng #include <linux/bpf.h> 10*fae6e9adSlinfeng 11*fae6e9adSlinfeng #define ETH_ALEN 6 12*fae6e9adSlinfeng #define ETH_P_IP 0x0008 /* htons(0x0800) */ 13*fae6e9adSlinfeng #define TCP_HDR_LEN 20 14*fae6e9adSlinfeng 15*fae6e9adSlinfeng #define BLOCKED_TCP_PORT 0x9999 16*fae6e9adSlinfeng 17*fae6e9adSlinfeng struct eth_hdr { 18*fae6e9adSlinfeng unsigned char h_dest[ETH_ALEN]; 19*fae6e9adSlinfeng unsigned char h_source[ETH_ALEN]; 20*fae6e9adSlinfeng unsigned short h_proto; 21*fae6e9adSlinfeng }; 22*fae6e9adSlinfeng 23*fae6e9adSlinfeng #define SEC(NAME) __attribute__((section(NAME), used)) 24*fae6e9adSlinfeng SEC(".classifier") handle_ingress(struct __sk_buff * skb)25*fae6e9adSlinfengint handle_ingress(struct __sk_buff *skb) 26*fae6e9adSlinfeng { 27*fae6e9adSlinfeng void *data = (void *)(long)skb->data; 28*fae6e9adSlinfeng void *data_end = (void *)(long)skb->data_end; 29*fae6e9adSlinfeng struct eth_hdr *eth = data; 30*fae6e9adSlinfeng struct iphdr *iph = data + sizeof(*eth); 31*fae6e9adSlinfeng struct tcphdr *tcp = data + sizeof(*eth) + sizeof(*iph); 32*fae6e9adSlinfeng 33*fae6e9adSlinfeng /* single length check */ 34*fae6e9adSlinfeng if (data + sizeof(*eth) + sizeof(*iph) + sizeof(*tcp) > data_end) 35*fae6e9adSlinfeng return 0; 36*fae6e9adSlinfeng if (eth->h_proto != ETH_P_IP) 37*fae6e9adSlinfeng return 0; 38*fae6e9adSlinfeng if (iph->protocol != IPPROTO_TCP) 39*fae6e9adSlinfeng return 0; 40*fae6e9adSlinfeng if (tcp->source == BLOCKED_TCP_PORT || tcp->dest == BLOCKED_TCP_PORT) 41*fae6e9adSlinfeng return -1; 42*fae6e9adSlinfeng return 0; 43*fae6e9adSlinfeng } 44