badboy / ebpf-icmp-ping

Send ICMP Echo Replies using eBPF

The code parses the passed network packet into its Ethernet, IP and ICMP header, swaps addresses (MAC and IP addresses), changes the ICMP type to ICMP Echo Reply, re-calculates the ICMP checksum and sends the modified packet back out over the same interface.

Requirements

• A recent kernel. Tested with 4.8 and 4.9
• iproute2 v4.9. v4.10 has a bug makig it unusable. If your system does not provide it, compile it from git. Installation is not needed, the tc binary is enough.
• Clang >= 3.8. eBPF backend required.

Code was tested on Ubuntu 16.10 with self-compiled iproute2 v4.9 and clang 4.0.

Run

First create a qdisc, then attach the classification and action, and at last show logging information:

make bpf.o
make qdisc
make run
make show exec

Delete filters and qdiscs afterwards:

make delete
make qdisc-delete

The code

The code in bpf.c is commented to explain each step.

Resources

• ebpf-trekking, an implementation using bcc

ebpf-icmp-ping's Issues

ingress handle usage

Can we use any other handle for ingress, other than ffff:

2 Network-Interfaces Scenario

I have 2 interfaces enp2s0 and enp2s1
I want to make a demo switch out of this system.
I am trying to send packets to enp2s0 and forward them to enp2s1. But the order in which i am attaching bpf-0.o and bpf-1.o to these interfaces is affecting which bpf code takes control of my packet.

Can you suggest any thing.
Thanks a lot !