feat:user defined struct casting

This commit is contained in:
2025-11-27 12:41:57 +05:30
parent 4905649700
commit 1593b7bcfe
6 changed files with 176 additions and 63 deletions

View File

@ -1,72 +1,38 @@
// xdp_ip_map.c
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <bpf/bpf_helpers.h>
struct ip_key {
__u8 family; // 4 = IPv4
__u8 pad[3]; // padding for alignment
__u8 addr[16]; // IPv4 uses first 4 bytes
struct fake_iphdr {
unsigned short useless;
unsigned short tot_len;
unsigned short id;
unsigned short frag_off;
unsigned char ttl;
unsigned char protocol;
unsigned short check;
unsigned int saddr;
unsigned int daddr;
};
// key → packet count
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 16384);
__type(key, struct ip_key);
__type(value, __u64);
} ip_count_map SEC(".maps");
SEC("xdp")
int xdp_ip_map(struct xdp_md *ctx)
int xdp_prog(struct xdp_md *ctx)
{
void *data_end = (void *)(long)ctx->data_end;
void *data = (void *)(long)ctx->data;
struct ethhdr *eth = data;
void *data_end = (void *)(long)ctx->data_end;
void *data = (void *)(long)ctx->data;
if (eth + 1 > (struct ethhdr *)data_end)
return XDP_PASS;
struct ethhdr *eth = data;
if ((void *)(eth + 1) > data_end)
return XDP_ABORTED;
if (eth->h_proto != __constant_htons(ETH_P_IP))
return XDP_PASS;
__u16 h_proto = eth->h_proto;
void *nh = data + sizeof(*eth);
struct fake_iphdr *iph = (struct fake_iphdr *)(eth + 1);
if ((void *)(iph + 1) > data_end)
return XDP_ABORTED;
bpf_printk("%d", iph->saddr);
// VLAN handling: single tag
if (h_proto == bpf_htons(ETH_P_8021Q) ||
h_proto == bpf_htons(ETH_P_8021AD)) {
if (nh + 4 > data_end)
return XDP_PASS;
h_proto = *(__u16 *)(nh + 2);
nh += 4;
}
struct ip_key key = {};
// IPv4
if (h_proto == bpf_htons(ETH_P_IP)) {
struct iphdr *iph = nh;
if (iph + 1 > (struct iphdr *)data_end)
return XDP_PASS;
key.family = 4;
// Copy 4 bytes of IPv4 address
__builtin_memcpy(key.addr, &iph->saddr, 4);
__u64 *val = bpf_map_lookup_elem(&ip_count_map, &key);
if (val)
(*val)++;
else {
__u64 init = 1;
bpf_map_update_elem(&ip_count_map, &key, &init, BPF_ANY);
}
return XDP_PASS;
}
return XDP_PASS;
return XDP_PASS;
}
char _license[] SEC("license") = "GPL";

View File

@ -0,0 +1,46 @@
from vmlinux import XDP_PASS, XDP_DROP
from vmlinux import (
struct_xdp_md,
struct_ethhdr,
)
from pythonbpf import bpf, section, bpfglobal, compile, compile_to_ir, struct
from ctypes import c_int64, c_ubyte, c_ushort, c_uint32
@bpf
@struct
class iphdr:
useless: c_ushort
tot_len: c_ushort
id: c_ushort
frag_off: c_ushort
ttl: c_ubyte
protocol: c_ubyte
check: c_ushort
saddr: c_uint32
daddr: c_uint32
@bpf
@section("xdp")
def ip_detector(ctx: struct_xdp_md) -> c_int64:
data = ctx.data
data_end = ctx.data_end
eth = struct_ethhdr(ctx.data)
nh = ctx.data + 14
if nh + 20 > data_end:
return c_int64(XDP_DROP)
iph = iphdr(nh)
h_proto = eth.h_proto
h_proto_ext = c_int64(h_proto)
ipv4 = iph.saddr
print(f"ipaddress: {ipv4}")
return c_int64(XDP_PASS)
@bpf
@bpfglobal
def LICENSE() -> str:
return "GPL"
compile_to_ir("xdp_test_1.py", "xdp_test_1.ll")
compile()