1*25d11a86SBruce Richardson /* SPDX-License-Identifier: BSD-3-Clause 2*25d11a86SBruce Richardson * Copyright(c) 2018 Intel Corporation 3*25d11a86SBruce Richardson */ 4*25d11a86SBruce Richardson 5*25d11a86SBruce Richardson /* 6*25d11a86SBruce Richardson * eBPF program sample. 7*25d11a86SBruce Richardson * Accepts pointer to first segment packet data as an input parameter. 8*25d11a86SBruce Richardson * analog of tcpdump -s 1 -d 'dst 1.2.3.4 && udp && dst port 5000' 9*25d11a86SBruce Richardson * (000) ldh [12] 10*25d11a86SBruce Richardson * (001) jeq #0x800 jt 2 jf 12 11*25d11a86SBruce Richardson * (002) ld [30] 12*25d11a86SBruce Richardson * (003) jeq #0x1020304 jt 4 jf 12 13*25d11a86SBruce Richardson * (004) ldb [23] 14*25d11a86SBruce Richardson * (005) jeq #0x11 jt 6 jf 12 15*25d11a86SBruce Richardson * (006) ldh [20] 16*25d11a86SBruce Richardson * (007) jset #0x1fff jt 12 jf 8 17*25d11a86SBruce Richardson * (008) ldxb 4*([14]&0xf) 18*25d11a86SBruce Richardson * (009) ldh [x + 16] 19*25d11a86SBruce Richardson * (010) jeq #0x1388 jt 11 jf 12 20*25d11a86SBruce Richardson * (011) ret #1 21*25d11a86SBruce Richardson * (012) ret #0 22*25d11a86SBruce Richardson * 23*25d11a86SBruce Richardson * To compile on x86: 24*25d11a86SBruce Richardson * clang -O2 -U __GNUC__ -target bpf -c t1.c 25*25d11a86SBruce Richardson * 26*25d11a86SBruce Richardson * To compile on ARM: 27*25d11a86SBruce Richardson * clang -O2 -I/usr/include/aarch64-linux-gnu/ -target bpf -c t1.c 28*25d11a86SBruce Richardson */ 29*25d11a86SBruce Richardson 30*25d11a86SBruce Richardson #include <stdint.h> 31*25d11a86SBruce Richardson #include <net/ethernet.h> 32*25d11a86SBruce Richardson #include <netinet/ip.h> 33*25d11a86SBruce Richardson #include <netinet/udp.h> 34*25d11a86SBruce Richardson #include <arpa/inet.h> 35*25d11a86SBruce Richardson 36*25d11a86SBruce Richardson uint64_t entry(void * pkt)37*25d11a86SBruce Richardsonentry(void *pkt) 38*25d11a86SBruce Richardson { 39*25d11a86SBruce Richardson struct ether_header *ether_header = (void *)pkt; 40*25d11a86SBruce Richardson 41*25d11a86SBruce Richardson if (ether_header->ether_type != htons(0x0800)) 42*25d11a86SBruce Richardson return 0; 43*25d11a86SBruce Richardson 44*25d11a86SBruce Richardson struct iphdr *iphdr = (void *)(ether_header + 1); 45*25d11a86SBruce Richardson if (iphdr->protocol != 17 || (iphdr->frag_off & 0x1ffff) != 0 || 46*25d11a86SBruce Richardson iphdr->daddr != htonl(0x1020304)) 47*25d11a86SBruce Richardson return 0; 48*25d11a86SBruce Richardson 49*25d11a86SBruce Richardson int hlen = iphdr->ihl * 4; 50*25d11a86SBruce Richardson struct udphdr *udphdr = (void *)iphdr + hlen; 51*25d11a86SBruce Richardson 52*25d11a86SBruce Richardson if (udphdr->dest != htons(5000)) 53*25d11a86SBruce Richardson return 0; 54*25d11a86SBruce Richardson 55*25d11a86SBruce Richardson return 1; 56*25d11a86SBruce Richardson } 57