#define IP_PROTO_TCP 6
#define IP_PROTO_UDP 17
#define IP_PROTO_ICMP 1
-#define IP_PROTO_ICMPV6 58
+#define IP6_PROTO_ICMPV6 58
+#define IP6_PROTO_FRAG 44
typedef __uint128_t uint128_t;
uint128_t daddr;
} __attribute__((packed));
+#define IP6_MF 1
+#define IP6_FRAGOFF 0xfff8
+struct ip6_fraghdr {
+ uint8_t nexthdr;
+ uint8_t _reserved;
+ uint16_t frag_off; // BE low 3 bits flags, last is "more frags"
+ uint32_t id;
+} __attribute__((packed));
+
// Our own ethhdr with optional vlan tags
struct ethhdr_vlan {
unsigned char h_dest[ETH_ALEN]; /* destination eth addr */
// Note rules.h may also define PARSE_IHL
#include "rules.h"
+#define unlikely(a) __builtin_expect(a, 0)
+#define likely(a) __builtin_expect(a, 1)
+
#ifdef TEST
// 64 bit version of xdp_md for testing
struct xdp_md {
unsigned short eth_proto;
{
- if ((void*)(size_t)ctx->data + sizeof(struct ethhdr) > data_end)
+ if (unlikely((void*)(size_t)ctx->data + sizeof(struct ethhdr) > data_end))
return XDP_DROP;
const struct ethhdr *const eth = (void*)(size_t)ctx->data;
#ifdef PARSE_8021Q
- if (eth->h_proto == BE16(ETH_P_8021Q)) {
- if ((void*)(size_t)ctx->data + sizeof(struct ethhdr_vlan) > data_end)
+ if (likely(eth->h_proto == BE16(ETH_P_8021Q))) {
+ if (unlikely((void*)(size_t)ctx->data + sizeof(struct ethhdr_vlan) > data_end))
return XDP_DROP;
const struct ethhdr_vlan *const eth_vlan = (void*)(size_t)ctx->data;
#ifdef REQ_8021Q
- if ((eth_vlan->tci & BE16(0xfff)) != BE16(REQ_8021Q))
+ if (unlikely((eth_vlan->tci & BE16(0xfff)) != BE16(REQ_8021Q)))
return XDP_DROP;
#endif
const struct udphdr *udp = NULL;
const struct icmphdr *icmp = NULL;
const struct icmp6hdr *icmpv6 = NULL;
+ const struct ip6_fraghdr *frag6 = NULL;
const struct iphdr *ip = NULL;
const struct ip6hdr *ip6 = NULL;
const void *l4hdr = NULL;
if (eth_proto == BE16(ETH_P_IP)) {
- if (pktdata + sizeof(struct iphdr) > data_end)
+ if (unlikely(pktdata + sizeof(struct iphdr) > data_end))
return XDP_DROP;
ip = (struct iphdr*) pktdata;
#ifdef PARSE_IHL
- if (ip->ihl < 5) return XDP_DROP;
+ if (unlikely(ip->ihl < 5)) return XDP_DROP;
l4hdr = pktdata + ip->ihl * 4;
#else
if (ip->ihl != 5) return XDP_DROP;
l4hdr = pktdata + 5*4;
#endif
if (ip->protocol == IP_PROTO_TCP) {
- if (l4hdr + sizeof(struct tcphdr) > data_end)
+ if (unlikely(l4hdr + sizeof(struct tcphdr) > data_end))
return XDP_DROP;
tcp = (struct tcphdr*) l4hdr;
} else if (ip->protocol == IP_PROTO_UDP) {
- if (l4hdr + sizeof(struct udphdr) > data_end)
+ if (unlikely(l4hdr + sizeof(struct udphdr) > data_end))
return XDP_DROP;
udp = (struct udphdr*) l4hdr;
} else if (ip->protocol == IP_PROTO_ICMP) {
- if (l4hdr + sizeof(struct icmphdr) > data_end)
+ if (unlikely(l4hdr + sizeof(struct icmphdr) > data_end))
return XDP_DROP;
icmp = (struct icmphdr*) l4hdr;
}
} else if (eth_proto == BE16(ETH_P_IPV6)) {
- if (pktdata + sizeof(struct ip6hdr) > data_end)
+ if (unlikely(pktdata + sizeof(struct ip6hdr) > data_end))
return XDP_DROP;
ip6 = (struct ip6hdr*) pktdata;
l4hdr = pktdata + 40;
- if (ip6->nexthdr == IP_PROTO_TCP) {
- if (l4hdr + sizeof(struct tcphdr) > data_end)
+
+ uint8_t v6nexthdr;
+ if (ip6->nexthdr == IP6_PROTO_FRAG) {
+ if (unlikely(l4hdr + sizeof(struct ip6_fraghdr) > data_end))
+ return XDP_DROP;
+ frag6 = (struct ip6_fraghdr*) l4hdr;
+ l4hdr = l4hdr + sizeof(struct ip6_fraghdr);
+ v6nexthdr = frag6->nexthdr;
+ } else {
+ v6nexthdr = ip6->nexthdr;
+ }
+
+ if (v6nexthdr == IP_PROTO_TCP) {
+ if (unlikely(l4hdr + sizeof(struct tcphdr) > data_end))
return XDP_DROP;
tcp = (struct tcphdr*) l4hdr;
- } else if (ip6->nexthdr == IP_PROTO_UDP) {
- if (l4hdr + sizeof(struct udphdr) > data_end)
+ } else if (v6nexthdr == IP_PROTO_UDP) {
+ if (unlikely(l4hdr + sizeof(struct udphdr) > data_end))
return XDP_DROP;
udp = (struct udphdr*) l4hdr;
- } else if (ip6->nexthdr == IP_PROTO_ICMPV6) {
- if (l4hdr + sizeof(struct icmp6hdr) > data_end)
+ } else if (v6nexthdr == IP6_PROTO_ICMPV6) {
+ if (unlikely(l4hdr + sizeof(struct icmp6hdr) > data_end))
return XDP_DROP;
icmpv6 = (struct icmp6hdr*) l4hdr;
}