Modifying Packet at Ethernet/IPv4/TCP layers on user space can be done by using AF_XDP and Socket? (It will be used for blocking traffic) #414
Description
I have this on eBPF side. I want to manipulate and modify a packet at the Ethernet/IPv4/TCP layers and then send it to the kernel. This way, for example, I can block it. Can I block the packet at user space using AF_XDP modifying packet. I just need some information about it to continue trying.
Not: I can receive packets, can decode layers on the user space. Can you guide me at this point?
SEC("xdp_sock")
int xdp_sock_prog(struct xdp_md *ctx) {
int index = ctx->rx_queue_index;
// L2
__u32 *pkt_count;
pkt_count = bpf_map_lookup_elem(&xdp_stats_map, &index);
if (pkt_count) {
/* We pass every other packet */
if ((*pkt_count)++ & 1)
return XDP_PASS;
}
/* A set entry here means that the correspnding queue_id
* has an active AF_XDP socket bound to it. */
if (bpf_map_lookup_elem(&xsks_map, &index)){
return bpf_redirect_map(&xsks_map, index, 0);
}
return XDP_PASS;
}