- /*
- * Comment:
- *
- * I've selected not to see LL header, so BPF doesn't see it, too.
- * The filter may also pass non-IP and non-ARP packets, but we do
- * a more complete check when receiving the message in userspace.
- *
- * and filter shamelessly stolen from:
- *
- * http://www.flamewarmaster.de/software/dhcpclient/
- *
- * There are a few other interesting ideas on that page (look under
- * "Motivation"). Use of netlink events is most interesting. Think
- * of various network servers listening for events and reconfiguring.
- * That would obsolete sending HUP signals and/or make use of restarts.
- *
- * Copyright: 2006, 2007 Stefan Rompf <sux@loplof.de>.
- * License: GPL v2.
- *
- * TODO: make conditional?
- */
- static const struct sock_filter filter_instr[] = {
- /* load 9th byte (protocol) */
- BPF_STMT(BPF_LD|BPF_B|BPF_ABS, 9),
- /* jump to L1 if it is IPPROTO_UDP, else to L4 */
- BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, IPPROTO_UDP, 0, 6),
- /* L1: load halfword from offset 6 (flags and frag offset) */
- BPF_STMT(BPF_LD|BPF_H|BPF_ABS, 6),
- /* jump to L4 if any bits in frag offset field are set, else to L2 */
- BPF_JUMP(BPF_JMP|BPF_JSET|BPF_K, 0x1fff, 4, 0),
- /* L2: skip IP header (load index reg with header len) */
- BPF_STMT(BPF_LDX|BPF_B|BPF_MSH, 0),
- /* load udp destination port from halfword[header_len + 2] */
- BPF_STMT(BPF_LD|BPF_H|BPF_IND, 2),
- /* jump to L3 if udp dport is CLIENT_PORT, else to L4 */
- BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 68, 0, 1),
- /* L3: accept packet */
- BPF_STMT(BPF_RET|BPF_K, 0xffffffff),
- /* L4: discard packet */
- BPF_STMT(BPF_RET|BPF_K, 0),
- };
- static const struct sock_fprog filter_prog = {
- .len = sizeof(filter_instr) / sizeof(filter_instr[0]),
- /* casting const away: */
- .filter = (struct sock_filter *) filter_instr,
- };
-
- log1("Opening raw socket on ifindex %d", ifindex); //log2?