71 lines
1.8 KiB
C
71 lines
1.8 KiB
C
//go:build ignore
|
|
|
|
#include "bpf_endian.h"
|
|
#include "common.h"
|
|
|
|
char __license[] SEC("license") = "Dual MIT/GPL";
|
|
|
|
#define MAX_MAP_ENTRIES 16
|
|
|
|
/* Define an LRU hash map for storing packet count by source IPv4 address */
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_LRU_HASH);
|
|
__uint(max_entries, MAX_MAP_ENTRIES);
|
|
__type(key, __u32); // source IPv4 address
|
|
__type(value, __u32); // packet count
|
|
} xdp_stats_map SEC(".maps");
|
|
|
|
/*
|
|
Attempt to parse the IPv4 source address from the packet.
|
|
Returns 0 if there is no IPv4 header field; otherwise returns non-zero.
|
|
*/
|
|
static __always_inline int parse_ip_src_addr(struct xdp_md *ctx, __u32 *ip_src_addr) {
|
|
void *data_end = (void *)(long)ctx->data_end;
|
|
void *data = (void *)(long)ctx->data;
|
|
|
|
// First, parse the ethernet header.
|
|
struct ethhdr *eth = data;
|
|
if ((void *)(eth + 1) > data_end) {
|
|
return 0;
|
|
}
|
|
|
|
if (eth->h_proto != bpf_htons(ETH_P_IP)) {
|
|
// The protocol is not IPv4, so we can't parse an IPv4 source address.
|
|
return 0;
|
|
}
|
|
|
|
// Then parse the IP header.
|
|
struct iphdr *ip = (void *)(eth + 1);
|
|
if ((void *)(ip + 1) > data_end) {
|
|
return 0;
|
|
}
|
|
|
|
// Return the source IP address in network byte order.
|
|
*ip_src_addr = (__u32)(ip->saddr);
|
|
return 1;
|
|
}
|
|
|
|
SEC("xdp")
|
|
int xdp_prog_func(struct xdp_md *ctx) {
|
|
__u32 ip;
|
|
if (!parse_ip_src_addr(ctx, &ip)) {
|
|
// Not an IPv4 packet, so don't count it.
|
|
goto done;
|
|
}
|
|
|
|
__u32 *pkt_count = bpf_map_lookup_elem(&xdp_stats_map, &ip);
|
|
if (!pkt_count) {
|
|
// No entry in the map for this IP address yet, so set the initial value to 1.
|
|
__u32 init_pkt_count = 1;
|
|
bpf_map_update_elem(&xdp_stats_map, &ip, &init_pkt_count, BPF_ANY);
|
|
} else {
|
|
// Entry already exists for this IP address,
|
|
// so increment it atomically using an LLVM built-in.
|
|
__sync_fetch_and_add(pkt_count, 1);
|
|
}
|
|
|
|
done:
|
|
// Try changing this to XDP_DROP and see what happens!
|
|
return XDP_PASS;
|
|
}
|