clj-ebpf.dsl.socket — org.clojars.pgdad/clj-ebpf 0.2.4

High-level Socket Filter DSL for BPF programs.

Socket filter programs can be attached to sockets to filter incoming packets. They run on each packet and decide whether to pass or drop it.

Return values:

• 0: Drop the packet

• 0: Number of bytes to pass (use packet length to pass all)

Socket filters use __sk_buff as context (same as TC).

Example: (defsocket-filter-instructions allow-all {:default-action :accept} [])

build-socket-filter clj

(build-socket-filter {:keys [ctx-reg data-reg data-end-reg body default-action]
                      :or
                        {data-reg :r2 data-end-reg :r3 default-action :accept}})

Build a complete socket filter program.

Parameters:

• opts: Map with: :ctx-reg - Register to save __sk_buff pointer (optional) :data-reg - Register for data pointer (default :r2) :data-end-reg - Register for data_end (default :r3) :body - Vector of body instructions :default-action - :accept or :reject (default :accept)

Returns assembled program bytes.

defsocket-filter-instructions clj macro

(defsocket-filter-instructions fn-name options & body)

Define a socket filter program as a function returning instructions.

Parameters:

• fn-name: Name for the defined function
• options: Map with: :ctx-reg - Register to save context (optional) :data-reg - Register for data pointer (default :r2) :data-end-reg - Register for data_end (default :r3) :default-action - :accept or :reject (default :accept)
• body: Body expressions (should return vectors of instructions)

Example: (defsocket-filter-instructions accept-all {:default-action :accept} [])

ethernet-header-size clj

ethernet-offsets clj

ethertypes clj

ip-protocols clj

ipv4-header-min-size clj

ipv4-offsets clj

ipv4-to-int clj

ipv6-header-size clj

ipv6-offsets clj

make-socket-filter-info clj

(make-socket-filter-info program-name instructions)

Create program metadata for a socket filter.

Parameters:

• program-name: Name for the BPF program
• instructions: Program instructions

Returns map with program metadata.

skb-offset clj

skb-offsets clj

socket-accept clj

(socket-accept ctx-reg)

Generate instructions to accept packet (return packet length).

Parameters:

• ctx-reg: Register containing __sk_buff pointer

Returns vector of instructions that returns the packet length.

socket-accept-bytes clj

(socket-accept-bytes num-bytes)

Generate instructions to accept specific number of bytes.

Parameters:

• num-bytes: Number of bytes to accept

Returns vector of instructions.

socket-action clj

(socket-action action)

Get socket filter action value.

Parameters:

• action: :reject (0) or :accept (packet length)

Returns integer value.

Note: :accept returns -1 as a marker; you should return actual packet length for accept. Use socket-accept for this.

socket-bounds-check clj

socket-filter-actions clj

Socket filter return values.

socket-filter-by-ip clj

(socket-filter-by-ip data-reg data-end-reg ip-addr src-or-dst accept-on-match)

Generate filter to match source or destination IP.

Parameters:

• data-reg: Register with data pointer
• data-end-reg: Register with data_end pointer
• ip-addr: IP address as integer
• src-or-dst: :src or :dst
• accept-on-match: Accept if IP matches

Returns vector of instructions.

socket-filter-by-port clj

(socket-filter-by-port data-reg
                       data-end-reg
                       ip-offset
                       port
                       src-or-dst
                       accept-on-match)

Generate filter to match TCP/UDP port.

Parameters:

• data-reg: Register with data pointer
• data-end-reg: Register with data_end pointer
• ip-offset: IP header offset (usually ethernet-header-size)
• port: Port number to match (host byte order)
• src-or-dst: :src or :dst
• accept-on-match: Accept if port matches (true) or reject (false)

Returns vector of instructions.

Note: This assumes TCP/UDP header follows IP header directly. For variable-length IP headers, calculate IHL first.

socket-filter-by-protocol clj

(socket-filter-by-protocol data-reg data-end-reg protocol accept-on-match)

Generate filter to match IP protocol.

Parameters:

• data-reg: Register with data pointer
• data-end-reg: Register with data_end pointer
• protocol: IP protocol number (6=TCP, 17=UDP, 1=ICMP)
• accept-on-match: Accept if protocol matches (true) or reject (false)

Returns vector of instructions.

socket-filter-section-name clj

(socket-filter-section-name)

(socket-filter-section-name name)

Generate ELF section name for socket filter.

Returns "socket" or "socket/<name>".

socket-get-ifindex clj

(socket-get-ifindex ctx-reg dst-reg)

Get interface index from sk_buff.

Parameters:

• ctx-reg: Register containing __sk_buff pointer
• dst-reg: Destination register

Returns ldx instruction.

socket-get-len clj

(socket-get-len ctx-reg dst-reg)

Get packet length from sk_buff.

Parameters:

• ctx-reg: Register containing __sk_buff pointer
• dst-reg: Destination register

Returns ldx instruction.

socket-get-protocol clj

(socket-get-protocol ctx-reg dst-reg)

Get protocol from sk_buff.

Parameters:

• ctx-reg: Register containing __sk_buff pointer
• dst-reg: Destination register

Returns ldx instruction.

socket-load-ctx-field clj

socket-load-data-pointers clj

socket-parse-ethernet clj

socket-parse-ipv4 clj

socket-parse-ipv6 clj

socket-parse-tcp clj

socket-parse-udp clj

socket-prologue clj

(socket-prologue data-reg data-end-reg)

(socket-prologue ctx-save-reg data-reg data-end-reg)

Generate standard socket filter prologue.

Saves context and loads data pointers.

Parameters:

• ctx-save-reg: Register to save __sk_buff pointer (optional)
• data-reg: Register for data pointer
• data-end-reg: Register for data_end pointer

Returns vector of instructions.

socket-reject clj

(socket-reject)

Generate instructions to reject/drop packet.

Returns vector of instructions.

tcp-flags clj

tcp-header-min-size clj

tcp-offsets clj

udp-header-size clj

udp-offsets clj