additional fixes
This commit is contained in:
+7
-7
@@ -221,9 +221,7 @@ int xdp_drop_prog(struct xdp_md *ctx) {
|
|||||||
|
|
||||||
// check SYN
|
// check SYN
|
||||||
if (tcp_flags & SYN_MASK) {
|
if (tcp_flags & SYN_MASK) {
|
||||||
bpf_printk("packet is SYN\n");
|
if (mulberry32_at((__u32)time_seed, dst_port) % 3 == 0) {
|
||||||
if (/*mulberry32_at((__u32)time_seed, dst_port) % 3 == 0*/1) {
|
|
||||||
bpf_printk("DROPING!\n");
|
|
||||||
__u16 *src_port_ptr = (__u16 *)(tcp_packet_data + TCP_SRC_PORT_OFFSET);
|
__u16 *src_port_ptr = (__u16 *)(tcp_packet_data + TCP_SRC_PORT_OFFSET);
|
||||||
const __u16 src_port = bpf_ntohs(*src_port_ptr);
|
const __u16 src_port = bpf_ntohs(*src_port_ptr);
|
||||||
|
|
||||||
@@ -263,6 +261,9 @@ int xdp_drop_prog(struct xdp_md *ctx) {
|
|||||||
|
|
||||||
*(__u8 *)(ip_packet_data + IPV4_TTL_OFFSET) = DEFAULT_TTL;
|
*(__u8 *)(ip_packet_data + IPV4_TTL_OFFSET) = DEFAULT_TTL;
|
||||||
|
|
||||||
|
// set ID
|
||||||
|
*(__u16 *)(ip_packet_data + IPV4_ID_OFFSET) = bpf_get_prandom_u32();
|
||||||
|
|
||||||
{ // calculate ipv4 header checksum
|
{ // calculate ipv4 header checksum
|
||||||
if ((*ip_packet_data & 0b00001111) != 5) {
|
if ((*ip_packet_data & 0b00001111) != 5) {
|
||||||
return XDP_PASS;
|
return XDP_PASS;
|
||||||
@@ -282,11 +283,10 @@ int xdp_drop_prog(struct xdp_md *ctx) {
|
|||||||
}
|
}
|
||||||
new_checksum = (new_checksum & 0xFFFF) + (new_checksum >> 16);
|
new_checksum = (new_checksum & 0xFFFF) + (new_checksum >> 16);
|
||||||
new_checksum = (new_checksum & 0xFFFF) + (new_checksum >> 16);
|
new_checksum = (new_checksum & 0xFFFF) + (new_checksum >> 16);
|
||||||
*ipv4_checksum_ptr = bpf_htons((__u16)new_checksum);
|
*ipv4_checksum_ptr = bpf_htons((__u16)~new_checksum);
|
||||||
}
|
}
|
||||||
|
|
||||||
// set ID
|
|
||||||
*(__u16*)(ip_packet_data+IPV4_ID_OFFSET) = bpf_get_prandom_u32();
|
|
||||||
|
|
||||||
|
|
||||||
struct tcp_v4_pseudo_header pseudo_header = {
|
struct tcp_v4_pseudo_header pseudo_header = {
|
||||||
@@ -338,7 +338,7 @@ int xdp_drop_prog(struct xdp_md *ctx) {
|
|||||||
return XDP_TX;
|
return XDP_TX;
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
bpf_printk("packet is not SYN\n");
|
return XDP_DROP;
|
||||||
}
|
}
|
||||||
|
|
||||||
return XDP_PASS;
|
return XDP_PASS;
|
||||||
|
|||||||
Reference in New Issue
Block a user