1*4418919fSjohnjiang /* SPDX-License-Identifier: BSD-3-Clause 2*4418919fSjohnjiang * Copyright(c) 2018 Intel Corporation 3*4418919fSjohnjiang */ 4*4418919fSjohnjiang 5*4418919fSjohnjiang /* 6*4418919fSjohnjiang * eBPF program sample. 7*4418919fSjohnjiang * Accepts pointer to first segment packet data as an input parameter. 8*4418919fSjohnjiang * analog of tcpdump -s 1 -d 'dst 1.2.3.4 && udp && dst port 5000' 9*4418919fSjohnjiang * (000) ldh [12] 10*4418919fSjohnjiang * (001) jeq #0x800 jt 2 jf 12 11*4418919fSjohnjiang * (002) ld [30] 12*4418919fSjohnjiang * (003) jeq #0x1020304 jt 4 jf 12 13*4418919fSjohnjiang * (004) ldb [23] 14*4418919fSjohnjiang * (005) jeq #0x11 jt 6 jf 12 15*4418919fSjohnjiang * (006) ldh [20] 16*4418919fSjohnjiang * (007) jset #0x1fff jt 12 jf 8 17*4418919fSjohnjiang * (008) ldxb 4*([14]&0xf) 18*4418919fSjohnjiang * (009) ldh [x + 16] 19*4418919fSjohnjiang * (010) jeq #0x1388 jt 11 jf 12 20*4418919fSjohnjiang * (011) ret #1 21*4418919fSjohnjiang * (012) ret #0 22*4418919fSjohnjiang * 23*4418919fSjohnjiang * To compile on x86: 24*4418919fSjohnjiang * clang -O2 -U __GNUC__ -target bpf -c t1.c 25*4418919fSjohnjiang * 26*4418919fSjohnjiang * To compile on ARM: 27*4418919fSjohnjiang * clang -O2 -I/usr/include/aarch64-linux-gnu/ -target bpf -c t1.c 28*4418919fSjohnjiang */ 29*4418919fSjohnjiang 30*4418919fSjohnjiang #include <stdint.h> 31*4418919fSjohnjiang #include <net/ethernet.h> 32*4418919fSjohnjiang #include <netinet/ip.h> 33*4418919fSjohnjiang #include <netinet/udp.h> 34*4418919fSjohnjiang #include <arpa/inet.h> 35*4418919fSjohnjiang 36*4418919fSjohnjiang uint64_t entry(void * pkt)37*4418919fSjohnjiangentry(void *pkt) 38*4418919fSjohnjiang { 39*4418919fSjohnjiang struct ether_header *ether_header = (void *)pkt; 40*4418919fSjohnjiang 41*4418919fSjohnjiang if (ether_header->ether_type != htons(0x0800)) 42*4418919fSjohnjiang return 0; 43*4418919fSjohnjiang 44*4418919fSjohnjiang struct iphdr *iphdr = (void *)(ether_header + 1); 45*4418919fSjohnjiang if (iphdr->protocol != 17 || (iphdr->frag_off & 0x1ffff) != 0 || 46*4418919fSjohnjiang iphdr->daddr != htonl(0x1020304)) 47*4418919fSjohnjiang return 0; 48*4418919fSjohnjiang 49*4418919fSjohnjiang int hlen = iphdr->ihl * 4; 50*4418919fSjohnjiang struct udphdr *udphdr = (void *)iphdr + hlen; 51*4418919fSjohnjiang 52*4418919fSjohnjiang if (udphdr->dest != htons(5000)) 53*4418919fSjohnjiang return 0; 54*4418919fSjohnjiang 55*4418919fSjohnjiang return 1; 56*4418919fSjohnjiang } 57