Struct redbpf_probes::socket::SkBuff

pub struct SkBuff {
    pub skb: *const __sk_buff,
}

Context object provided to Socket-related programs.

Fields

skb: *const __sk_buff

The low level skb instance.

Implementations

impl SkBuff

pub fn load<T: FromBe>(&self, offset: usize) -> Result<T, SocketError>

Loads data from the socket buffer.

Provide an easy way to load data from a packet.

Example

use core::mem;
use memoffset::offset_of;
use redbpf_probes::socket_filter::prelude::*;

#[socket_filter]
fn forward_tcp(skb: SkBuff) -> SkBuffResult {
    let eth_len = mem::size_of::<ethhdr>();
    let eth_proto: u16 = skb.load(offset_of!(ethhdr, h_proto))?;
    let ip_proto: u8 = skb.load(eth_len + offset_of!(iphdr, protocol))?;

    // only parse TCP
    if !(eth_proto as u32 == ETH_P_IP && ip_proto as u32 == IPPROTO_TCP) {
        return Ok(SkBuffAction::Ignore);
    }
    Ok(SkBuffAction::SendToUserspace)
}