1
#include "vmlinux.h"
2
#include <bpf/bpf_helpers.h>
3

4
SEC("tc")
5
int tc_ingress(struct __sk_buff *skb)
6
{
7
    // 可以访问完整的 sk_buff 信息
8
    void *data = (void *)(long)skb->data;
9
    void *data_end = (void *)(long)skb->data_end;
10

11
    // 解析数据包
12
    struct ethhdr *eth = data;
13
    if ((void *)(eth + 1) > data_end)
14
        return TC_ACT_OK;
15

16
    // 处理逻辑...
17

18
    return TC_ACT_OK;  // 继续处理
19
}
20

21
char LICENSE[] SEC("license") = "GPL";

1
// 将数据包重定向到另一个网卡接口
2
struct {
3
    __uint(type, BPF_MAP_TYPE_DEVMAP);
4
    __uint(max_entries, 64);
5
    __type(key, __u32);   // ifindex
6
    __type(value, __u32); // redirect ifindex
7
} redirect_map SEC(".maps");
8

9
SEC("tc")
10
int tc_redirect(struct __sk_buff *skb)
11
{
12
    // 查找目标接口
13
    __u32 *target_ifindex = bpf_map_lookup_elem(&redirect_map, &skb->ifindex);
14
    if (target_ifindex)
15
        return bpf_redirect(*target_ifindex, 0);
16

17
    // redirect_neigh：自动做邻居解析，适合 L3 转发
18
    // return bpf_redirect_neigh(*target_ifindex, NULL, 0, 0);
19

20
    return TC_ACT_OK;
21
}

1
# 附加 TC eBPF 程序（Direct Action 模式）
2
sudo tc qdisc add dev eth0 clsact
3
sudo tc filter add dev eth0 ingress bpf da obj tc_prog.o sec tc-ingress
4
sudo tc filter add dev eth0 egress bpf da obj tc_prog.o sec tc-egress

1
#include "vmlinux.h"
2
#include <bpf/bpf_helpers.h>
3
#include <bpf/bpf_endian.h>
4

5
// 规则：源 IP + 端口 → 动作
6
struct rule_key {
7
    __u32 src_ip;
8
    __u16 dst_port;
9
    __u8 protocol;
10
    __u8 pad;
11
};
12

13
struct rule_value {
14
    __u32 action;  // TC_ACT_OK or TC_ACT_SHOT
15
};
16

17
struct {
18
    __uint(type, BPF_MAP_TYPE_HASH);
19
    __uint(max_entries, 65536);
20
    __type(key, struct rule_key);
21
    __type(value, struct rule_value);
22
} firewall_rules SEC(".maps");
23

24
SEC("tc")
25
int tc_ingress_firewall(struct __sk_buff *skb)
26
{
27
    void *data = (void *)(long)skb->data;
28
    void *data_end = (void *)(long)skb->data_end;
29

30
    struct ethhdr *eth = data;
31
    if ((void *)(eth + 1) > data_end)
32
        return TC_ACT_OK;
33

34
    if (eth->h_proto != bpf_htons(ETH_P_IP))
35
        return TC_ACT_OK;
36

37
    struct iphdr *iph = (void *)(eth + 1);
38
    if ((void *)(iph + 1) > data_end)
39
        return TC_ACT_OK;
40

41
    // 解析 TCP/UDP 端口
42
    struct rule_key key = {};
43
    key.src_ip = iph->saddr;
44
    key.protocol = iph->protocol;
45

46
    if (iph->protocol == IPPROTO_TCP) {
47
        struct tcphdr *tcp = (void *)(iph + 1);
48
        if ((void *)(tcp + 1) > data_end)
49
            return TC_ACT_OK;
50
        key.dst_port = tcp->dest;
51
    } else if (iph->protocol == IPPROTO_UDP) {
52
        struct udphdr *udp = (void *)(iph + 1);
53
        if ((void *)(udp + 1) > data_end)
54
            return TC_ACT_OK;
55
        key.dst_port = udp->dest;
56
    }
57

58
    // 查找规则
59
    struct rule_value *rule = bpf_map_lookup_elem(&firewall_rules, &key);
60
    if (rule)
61
        return rule->action;
62

63
    // 默认允许
64
    return TC_ACT_OK;
65
}
66

67
char LICENSE[] SEC("license") = "GPL";

1
SEC("tc")
2
int tc_egress_nat(struct __sk_buff *skb)
3
{
4
    void *data = (void *)(long)skb->data;
5
    void *data_end = (void *)(long)skb->data_end;
6

7
    struct ethhdr *eth = data;
8
    if ((void *)(eth + 1) > data_end)
9
        return TC_ACT_OK;
10

11
    if (eth->h_proto != bpf_htons(ETH_P_IP))
12
        return TC_ACT_OK;
13

14
    struct iphdr *iph = (void *)(eth + 1);
15
    if ((void *)(iph + 1) > data_end)
16
        return TC_ACT_OK;
17

18
    // SNAT：修改源 IP
19
    __u32 orig_src = iph->saddr;
20
    __u32 *new_src = bpf_map_lookup_elem(&nat_map, &orig_src);
21
    if (new_src) {
22
        // 修改源 IP
23
        iph->saddr = *new_src;
24

25
        // 重新计算 IP 校验和
26
        iph->check = 0;
27
        iph->check = bpf_csum_diff(0, 0, (void *)iph, sizeof(*iph), 0);
28

29
        // 重新计算 TCP/UDP 校验和
30
        if (iph->protocol == IPPROTO_TCP) {
31
            struct tcphdr *tcp = (void *)(iph + 1);
32
            if ((void *)(tcp + 1) > data_end)
33
                return TC_ACT_OK;
34
            tcp->check = bpf_csum_diff(&orig_src, 4, new_src, 4, tcp->check);
35
        }
36
    }
37

38
    return TC_ACT_OK;
39
}

1
// ingress 程序：解析并标记
2
SEC("tc")
3
int tc_ingress_mark(struct __sk_buff *skb)
4
{
5
    void *data = (void *)(long)skb->data;
6
    void *data_end = (void *)(long)skb->data_end;
7

8
    struct ethhdr *eth = data;
9
    if ((void *)(eth + 1) > data_end)
10
        return TC_ACT_OK;
11

12
    // cb[0]：连接跟踪 ID（从 conntrack Map 查得）
13
    // cb[1]：身份标识（Cilium security ID）
14
    // cb[2]：NAT 标记（是否已做 DNAT）
15
    skb->cb[0] = conntrack_id;
16
    skb->cb[1] = sec_id;
17
    skb->cb[2] = 0;  // 未做 DNAT
18

19
    return TC_ACT_OK;
20
}
21

22
// egress 程序：读取标记并执行策略
23
SEC("tc")
24
int tc_egress_policy(struct __sk_buff *skb)
25
{
26
    __u32 ct_id = skb->cb[0];
27
    __u32 sec_id = skb->cb[1];
28
    __u32 nat_flag = skb->cb[2];
29

30
    // 根据 ingress 阶段的标记做策略判断
31
    if (sec_id == BLOCKED_ID)
32
        return TC_ACT_SHOT;
33

34
    // 如果未做 DNAT，egress 阶段需要补 SNAT
35
    if (!nat_flag)
36
        do_snat(skb, ct_id);
37

38
    return TC_ACT_OK;
39
}

1
struct {
2
    __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
3
    __uint(max_entries, 8);
4
    __type(key, __u32);
5
    __type(value, __u32);  // program fd
6
} tc_progs SEC(".maps");
7

8
// 主程序：解析后分发
9
SEC("tc")
10
int tc_dispatcher(struct __sk_buff *skb)
11
{
12
    void *data = (void *)(long)skb->data;
13
    void *data_end = (void *)(long)skb->data_end;
14
    struct ethhdr *eth = data;
15
    if ((void *)(eth + 1) > data_end)
16
        return TC_ACT_OK;
17

18
    if (eth->h_proto == bpf_htons(ETH_P_IP))
19
        bpf_tail_call(skb, &tc_progs, 0);  // → IPv4 处理
20
    else if (eth->h_proto == bpf_htons(ETH_P_IPV6))
21
        bpf_tail_call(skb, &tc_progs, 1);  // → IPv6 处理
22

23
    return TC_ACT_OK;  // 兜底：尾调用失败则放行
24
}

1
# 创建 clsact qdisc（必须先创建）
2
sudo tc qdisc add dev eth0 clsact
3

4
# 附加 ingress 程序
5
sudo tc filter add dev eth0 ingress bpf da obj tc_prog.o sec tc-ingress
6

7
# 附加 egress 程序
8
sudo tc filter add dev eth0 egress bpf da obj tc_prog.o sec tc-egress
9

10
# 查看已附加的程序
11
sudo tc filter show dev eth0 ingress
12
sudo tc filter show dev eth0 egress
13

14
# 删除所有 TC 过滤器
15
sudo tc filter del dev eth0 ingress
16
sudo tc filter del dev eth0 egress
17

18
# 删除 clsact qdisc
19
sudo tc qdisc del dev eth0 clsact

1
# 查看 TC 类型的 eBPF 程序
2
sudo bpftool prog show type sched_cls
3

4
# 查看程序详情
5
sudo bpftool prog show id <id>
6

7
# 查看程序字节码
8
sudo bpftool prog dump xlated id <id>

1
# 编译 TC eBPF 程序
2
clang -O2 -target bpf -c tc_firewall.bpf.c -o tc_firewall.bpf.o
3

4
# 创建 clsact qdisc
5
sudo tc qdisc add dev eth0 clsact
6

7
# 附加 ingress 程序
8
sudo tc filter add dev eth0 ingress \
9
    prio 1 handle 1 bpf da obj tc_firewall.bpf.o sec tc-ingress
10

11
# 查看附加结果
12
sudo tc filter show dev eth0 ingress
13

14
# 测试：添加黑名单规则（通过用户态程序更新 Map）
15

16
# 清理
17
sudo tc filter del dev eth0 ingress
18
sudo tc qdisc del dev eth0 clsact

1
# 附加 ingress 和 egress
2
sudo tc qdisc add dev eth0 clsact
3
sudo tc filter add dev eth0 ingress bpf da obj tc_prog.o sec tc-in
4
sudo tc filter add dev eth0 egress bpf da obj tc_prog.o sec tc-out
5

6
# 查看双向过滤器
7
sudo tc filter show dev eth0 ingress
8
sudo tc filter show dev eth0 egress

1
# 追踪 TC 分类器调用
2
sudo bpftrace -e 'kprobe:cls_bpf_classify {
3
    printf("TC classify: skb=%p\n", arg0);
4
}'
5

6
# 追踪 TC 动作
7
sudo bpftrace -e 'kretprobe:cls_bpf_classify {
8
    printf("TC action: %d\n", retval);
9
}'