additional fixes
This commit is contained in:
+7
-7
@@ -221,9 +221,7 @@ int xdp_drop_prog(struct xdp_md *ctx) {
|
||||
|
||||
// check SYN
|
||||
if (tcp_flags & SYN_MASK) {
|
||||
bpf_printk("packet is SYN\n");
|
||||
if (/*mulberry32_at((__u32)time_seed, dst_port) % 3 == 0*/1) {
|
||||
bpf_printk("DROPING!\n");
|
||||
if (mulberry32_at((__u32)time_seed, dst_port) % 3 == 0) {
|
||||
__u16 *src_port_ptr = (__u16 *)(tcp_packet_data + TCP_SRC_PORT_OFFSET);
|
||||
const __u16 src_port = bpf_ntohs(*src_port_ptr);
|
||||
|
||||
@@ -263,6 +261,9 @@ int xdp_drop_prog(struct xdp_md *ctx) {
|
||||
|
||||
*(__u8 *)(ip_packet_data + IPV4_TTL_OFFSET) = DEFAULT_TTL;
|
||||
|
||||
// set ID
|
||||
*(__u16 *)(ip_packet_data + IPV4_ID_OFFSET) = bpf_get_prandom_u32();
|
||||
|
||||
{ // calculate ipv4 header checksum
|
||||
if ((*ip_packet_data & 0b00001111) != 5) {
|
||||
return XDP_PASS;
|
||||
@@ -282,11 +283,10 @@ int xdp_drop_prog(struct xdp_md *ctx) {
|
||||
}
|
||||
new_checksum = (new_checksum & 0xFFFF) + (new_checksum >> 16);
|
||||
new_checksum = (new_checksum & 0xFFFF) + (new_checksum >> 16);
|
||||
*ipv4_checksum_ptr = bpf_htons((__u16)new_checksum);
|
||||
*ipv4_checksum_ptr = bpf_htons((__u16)~new_checksum);
|
||||
}
|
||||
|
||||
// set ID
|
||||
*(__u16*)(ip_packet_data+IPV4_ID_OFFSET) = bpf_get_prandom_u32();
|
||||
|
||||
|
||||
|
||||
struct tcp_v4_pseudo_header pseudo_header = {
|
||||
@@ -338,7 +338,7 @@ int xdp_drop_prog(struct xdp_md *ctx) {
|
||||
return XDP_TX;
|
||||
}
|
||||
} else {
|
||||
bpf_printk("packet is not SYN\n");
|
||||
return XDP_DROP;
|
||||
}
|
||||
|
||||
return XDP_PASS;
|
||||
|
||||
Reference in New Issue
Block a user