From nobody Wed Apr 1 20:42:56 2026 Received: from out-171.mta0.migadu.com (out-171.mta0.migadu.com [91.218.175.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EE0FF2C030E for ; Wed, 1 Apr 2026 11:05:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775041551; cv=none; b=Cr45wrhhxaJPHkStjCxrcrFWtM8sv5IlOUbN3hhVsnW4ldIP7erTjFMb18o0yVaiPtRhF0S9/wdHxuQbaI+N4UgMnAQzybIjk6iwycbegg0jkq+ZrTN0jtqj45Mi4vjZzgWrzrgJRtYYVmkcchVUbKYmssrVUkY6sZQWLUci2oU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775041551; c=relaxed/simple; bh=Xj61EosfzjfHOO1sRpO/zWhpNA5ArLWmsHWmI2lirz0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AjfyvmKc7mGVpsYVU30StU1Qs3sDoMwcxY3s3WWmyAKcdL7OvIXR1udsH84Qknv7J9QUnIYsieTkaw3MdRRTtwTpy57iyeew9eUkgok0qOurH+bdbVnRWc9avFus/3RNMMgZLOene1iDzziafJZkhJJGOTl59drK66qZjCxZlPc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=IEBtDruy; arc=none smtp.client-ip=91.218.175.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="IEBtDruy" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1775041546; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nVZBa8UEvqHRKoYhIdivobtFZ6ps7cQbsfMsNGbhoHs=; b=IEBtDruyY5LD0VUQf2G4SAU/UWeYTCExNtUepsyMrfNZzrbn2EXYIcosLinbOmMOwTRe2y ORN1Tqe3jP7MMoBvEoXJ0aB83Y3hNpPV4yuHQN/cEhnX3PYG/oWHSEEKnM12yPk0vRcwhI NJUk3ZAyR/k/ibf+LSdozax71r5XUiY= From: Jiayuan Chen To: bpf@vger.kernel.org Cc: Jiayuan Chen , Kuniyuki Iwashima , Martin KaFai Lau , Daniel Borkmann , John Fastabend , Stanislav Fomichev , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Song Liu , Yonghong Song , KP Singh , Hao Luo , Jiri Olsa , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Shuah Khan , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf v5 1/2] bpf: tcp: Reject non-TCP skb in bpf_sk_assign_tcp_reqsk() Date: Wed, 1 Apr 2026 19:04:49 +0800 Message-ID: <20260401110511.73355-2-jiayuan.chen@linux.dev> In-Reply-To: <20260401110511.73355-1-jiayuan.chen@linux.dev> References: <20260401110511.73355-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" bpf_sk_assign_tcp_reqsk() only validates skb->protocol (L3) but does not check the L4 protocol in the IP header. A BPF program can call this kfunc on a UDP skb with a valid TCP listener socket, which will succeed and attach a TCP reqsk to the UDP skb. When the UDP skb enters the UDP receive path, skb_steal_sock() returns the TCP listener from the reqsk. The UDP code then passes this TCP socket to udp_unicast_rcv_skb() -> __udp_enqueue_schedule_skb(), which casts it to udp_sock and accesses UDP-specific fields at invalid offsets, causing a null pointer dereference and kernel panic: BUG: KASAN: null-ptr-deref in __udp_enqueue_schedule_skb+0x19d/0x1df0 Read of size 4 at addr 0000000000000008 by task test_progs/537 CPU: 1 UID: 0 PID: 537 Comm: test_progs Not tainted 7.0.0-rc4+ #46 PREEMPT Call Trace: dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:487) kasan_report (mm/kasan/report.c:597) __kasan_check_read (mm/kasan/shadow.c:32) __udp_enqueue_schedule_skb (net/ipv4/udp.c:1719) udp_queue_rcv_one_skb (net/ipv4/udp.c:2370 net/ipv4/udp.c:2500) udp_queue_rcv_skb (net/ipv4/udp.c:2532) udp_unicast_rcv_skb (net/ipv4/udp.c:2684) __udp4_lib_rcv (net/ipv4/udp.c:2742) udp_rcv (net/ipv4/udp.c:2937) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:209) ip_local_deliver_finish (./include/linux/rcupdate.h:879 net/ipv4/ip_inpu= t.c:242) ip_local_deliver (net/ipv4/ip_input.c:265) __netif_receive_skb_one_core (net/core/dev.c:6164 (discriminator 4)) __netif_receive_skb (net/core/dev.c:6280) Fix this by checking the IP header's protocol field in bpf_sk_assign_tcp_reqsk() and rejecting non-TCP skbs with -EINVAL. Note that for IPv6, the nexthdr check does not walk extension headers. This is uncommon for TCP SYN packets in practice, and keeping it simple was agreed upon by Kuniyuki Iwashima. Fixes: e472f88891ab ("bpf: tcp: Support arbitrary SYN Cookie.") Reviewed-by: Kuniyuki Iwashima Signed-off-by: Jiayuan Chen --- net/core/filter.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/net/core/filter.c b/net/core/filter.c index 78b548158fb0..f251744025e2 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -12248,11 +12248,23 @@ __bpf_kfunc int bpf_sk_assign_tcp_reqsk(struct __= sk_buff *s, struct sock *sk, =20 switch (skb->protocol) { case htons(ETH_P_IP): + if (!pskb_may_pull(skb, sizeof(struct iphdr))) + return -EINVAL; + + if (ip_hdr(skb)->protocol !=3D IPPROTO_TCP) + return -EINVAL; + ops =3D &tcp_request_sock_ops; min_mss =3D 536; break; #if IS_BUILTIN(CONFIG_IPV6) case htons(ETH_P_IPV6): + if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) + return -EINVAL; + + if (ipv6_hdr(skb)->nexthdr !=3D IPPROTO_TCP) + return -EINVAL; + ops =3D &tcp6_request_sock_ops; min_mss =3D IPV6_MIN_MTU - 60; break; --=20 2.43.0 From nobody Wed Apr 1 20:42:56 2026 Received: from out-173.mta0.migadu.com (out-173.mta0.migadu.com [91.218.175.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B43C236B04E for ; Wed, 1 Apr 2026 11:06:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775041562; cv=none; b=EsFxQYr+BAu1GZp/yNb3dRjCMDl4JttGFKazGZq6m5s5xdOPgp3C33G6Lo5mY1jpzvJtiKVV+Fl2sSYeDOjKedh/bFTz4kPXiTSUy+S9Rvwq2JB72ZdPY7TnY0usjRM6f8+O1RQ9ufkwuQigdPY+OpkO19AxOKZPuBGQdJdw8t0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775041562; c=relaxed/simple; bh=cPBmDKGfQA/x2FNSfuO8SV/6uR6TOlLuz1aJaJ0nOoU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DEPCPxGZymhc7DAhlxH1U4v0csL6ykMdCUUosyliEQoG/6IEaxIU4hHHYv6PXgTNtZc/qFkrj3u8V6yFs6jVawz4W0SjPeeNz8pDnYgygLDxChbo8ZQoq1clxYZeT9ydclnnX6K6E5n2fWC0D7Uj/4J87yTAJsX2TjxgjZUkkJc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=SUVp+7fG; arc=none smtp.client-ip=91.218.175.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="SUVp+7fG" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1775041558; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=UpPfSjlH3UMy2LiUOfTVIf8nD9bsIvAShICExqAy5Cs=; b=SUVp+7fGR2ZogNpHKxKV6haU5L6MxqD3YRNIcC8h9kzsbOrqQccBB+m54+itbvDL97l1sV vGvUR+mUy8S+IJnC1malfcNeXguVe5Mt2eQHDrEtqsw4z+JX8UmjNINzxyqASOCFKYvgRq 7vPR4Bj8Nski7GA9MZ6WN0+2IFBufCw= From: Jiayuan Chen To: bpf@vger.kernel.org Cc: Jiayuan Chen , Martin KaFai Lau , Daniel Borkmann , John Fastabend , Stanislav Fomichev , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Song Liu , Yonghong Song , KP Singh , Hao Luo , Jiri Olsa , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Shuah Khan , Kuniyuki Iwashima , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf v5 2/2] selftests/bpf: Add protocol check test for bpf_sk_assign_tcp_reqsk() Date: Wed, 1 Apr 2026 19:04:50 +0800 Message-ID: <20260401110511.73355-3-jiayuan.chen@linux.dev> In-Reply-To: <20260401110511.73355-1-jiayuan.chen@linux.dev> References: <20260401110511.73355-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Add test_tcp_custom_syncookie_protocol_check to verify that bpf_sk_assign_tcp_reqsk() rejects non-TCP skbs. The test sends a UDP packet through TC ingress where a BPF program calls bpf_sk_assign_tcp_reqsk() on it and checks that the kfunc returns an error. A UDP server recv() is used as synchronization to ensure the BPF program has finished processing before checking the result. Without the fix in bpf_sk_assign_tcp_reqsk(), the kfunc succeeds and attaches a TCP reqsk to the UDP skb, which causes a null pointer dereference panic when the kernel processes it through the UDP receive path. Test result: ./test_progs -a tcp_custom_syncookie_protocol_check -v setup_netns:PASS:create netns 0 nsec setup_netns:PASS:ip 0 nsec write_sysctl:PASS:open sysctl 0 nsec write_sysctl:PASS:write sysctl 0 nsec setup_netns:PASS:write_sysctl 0 nsec test_tcp_custom_syncookie_protocol_check:PASS:open_and_load 0 nsec setup_tc:PASS:qdisc add dev lo clsact 0 nsec setup_tc:PASS:filter add dev lo ingress 0 nsec run_protocol_check:PASS:start tcp_server 0 nsec run_protocol_check:PASS:start udp_server 0 nsec run_protocol_check:PASS:connect udp_client 0 nsec run_protocol_check:PASS:send udp 0 nsec run_protocol_check:PASS:recv udp 0 nsec run_protocol_check:PASS:recv data 0 nsec run_protocol_check:PASS:udp_intercepted 0 nsec run_protocol_check:PASS:assign_ret 0 nsec #471/1 tcp_custom_syncookie_protocol_check/IPv4 TCP:OK run_protocol_check:PASS:start tcp_server 0 nsec run_protocol_check:PASS:start udp_server 0 nsec run_protocol_check:PASS:connect udp_client 0 nsec run_protocol_check:PASS:send udp 0 nsec run_protocol_check:PASS:recv udp 0 nsec run_protocol_check:PASS:recv data 0 nsec run_protocol_check:PASS:udp_intercepted 0 nsec run_protocol_check:PASS:assign_ret 0 nsec #471/2 tcp_custom_syncookie_protocol_check/IPv6 TCP:OK #471 tcp_custom_syncookie_protocol_check:OK Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED Cc: Jiayuan Chen Signed-off-by: Jiayuan Chen --- .../bpf/prog_tests/tcp_custom_syncookie.c | 93 ++++++++++++++- .../bpf/progs/test_tcp_custom_syncookie.c | 109 ++++++++++++++++++ 2 files changed, 198 insertions(+), 4 deletions(-) diff --git a/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c = b/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c index eaf441dc7e79..017836581669 100644 --- a/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c +++ b/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c @@ -5,6 +5,7 @@ #include #include #include +#include =20 #include "test_progs.h" #include "cgroup_helpers.h" @@ -47,11 +48,10 @@ static int setup_netns(void) return -1; } =20 -static int setup_tc(struct test_tcp_custom_syncookie *skel) +static int setup_tc(int prog_fd) { LIBBPF_OPTS(bpf_tc_hook, qdisc_lo, .attach_point =3D BPF_TC_INGRESS); - LIBBPF_OPTS(bpf_tc_opts, tc_attach, - .prog_fd =3D bpf_program__fd(skel->progs.tcp_custom_syncookie)); + LIBBPF_OPTS(bpf_tc_opts, tc_attach, .prog_fd =3D prog_fd); =20 qdisc_lo.ifindex =3D if_nametoindex("lo"); if (!ASSERT_OK(bpf_tc_hook_create(&qdisc_lo), "qdisc add dev lo clsact")) @@ -127,7 +127,7 @@ void test_tcp_custom_syncookie(void) if (!ASSERT_OK_PTR(skel, "open_and_load")) return; =20 - if (setup_tc(skel)) + if (setup_tc(bpf_program__fd(skel->progs.tcp_custom_syncookie))) goto destroy_skel; =20 for (i =3D 0; i < ARRAY_SIZE(test_cases); i++) { @@ -145,6 +145,91 @@ void test_tcp_custom_syncookie(void) =20 destroy_skel: system("tc qdisc del dev lo clsact"); + test_tcp_custom_syncookie__destroy(skel); +} + +/* Test: bpf_sk_assign_tcp_reqsk() should reject non-TCP skb. + * + * Send a UDP packet through TC ingress where a BPF program calls + * bpf_sk_assign_tcp_reqsk() on it. The kfunc should return an error + * because the skb carries UDP, not TCP. + * + * TCP and UDP servers share the same port. The BPF program intercepts + * the UDP packet, looks up the TCP listener via the dest port, and + * attempts to assign a TCP reqsk to the UDP skb. + */ +static void run_protocol_check(struct test_tcp_custom_syncookie *skel, + int family, const char *addr) +{ + int tcp_server, udp_server, udp_client; + char buf[] =3D "test"; + int port, ret; + + tcp_server =3D start_server(family, SOCK_STREAM, addr, 0, 0); + if (!ASSERT_NEQ(tcp_server, -1, "start tcp_server")) + return; + + port =3D ntohs(get_socket_local_port(tcp_server)); + + /* UDP server on same port for synchronization and port sharing */ + udp_server =3D start_server(family, SOCK_DGRAM, addr, port, 0); + if (!ASSERT_NEQ(udp_server, -1, "start udp_server")) + goto close_tcp; + + skel->bss->udp_intercepted =3D false; + skel->bss->assign_ret =3D 0; + + udp_client =3D connect_to_fd(udp_server, 0); + if (!ASSERT_NEQ(udp_client, -1, "connect udp_client")) + goto close_udp_server; + + ret =3D send(udp_client, buf, sizeof(buf), 0); + if (!ASSERT_EQ(ret, sizeof(buf), "send udp")) + goto close_udp_client; + + memset(buf, 0, sizeof(buf)); + + /* recv() ensures TC ingress BPF has processed the skb */ + ret =3D recv(udp_server, buf, sizeof(buf), 0); + if (!ASSERT_EQ(ret, sizeof(buf), "recv udp")) + goto close_udp_client; + + ASSERT_STREQ(buf, "test", "recv data"); + ASSERT_EQ(skel->bss->udp_intercepted, true, "udp_intercepted"); + ASSERT_EQ(skel->bss->assign_ret, -EINVAL, "assign_ret"); + +close_udp_client: + close(udp_client); +close_udp_server: + close(udp_server); +close_tcp: + close(tcp_server); +} + +void test_tcp_custom_syncookie_protocol_check(void) +{ + struct test_tcp_custom_syncookie *skel; + int i; + + if (setup_netns()) + return; + + skel =3D test_tcp_custom_syncookie__open_and_load(); + if (!ASSERT_OK_PTR(skel, "open_and_load")) + return; + + if (setup_tc(bpf_program__fd(skel->progs.tcp_custom_syncookie_badproto))) + goto destroy_skel; + + for (i =3D 0; i < ARRAY_SIZE(test_cases); i++) { + if (!test__start_subtest(test_cases[i].name)) + continue; =20 + run_protocol_check(skel, test_cases[i].family, + test_cases[i].addr); + } + +destroy_skel: + system("tc qdisc del dev lo clsact"); test_tcp_custom_syncookie__destroy(skel); } diff --git a/tools/testing/selftests/bpf/progs/test_tcp_custom_syncookie.c = b/tools/testing/selftests/bpf/progs/test_tcp_custom_syncookie.c index 7d5293de1952..331435c837cc 100644 --- a/tools/testing/selftests/bpf/progs/test_tcp_custom_syncookie.c +++ b/tools/testing/selftests/bpf/progs/test_tcp_custom_syncookie.c @@ -588,4 +588,113 @@ int tcp_custom_syncookie(struct __sk_buff *skb) return tcp_handle_ack(&ctx); } =20 +/* Test: call bpf_sk_assign_tcp_reqsk() on a UDP skb. + * The kfunc should reject it because the skb is not TCP. + * + * TCP and UDP servers share the same port. The BPF program intercepts + * UDP packets, looks up the TCP listener on the same port, and tries + * to assign a TCP reqsk to the UDP skb. + */ +int assign_ret; +bool udp_intercepted; + +static int badproto_lookup_assign(struct __sk_buff *skb, struct udphdr *ud= p, + struct bpf_sock_tuple *tuple, u32 tuple_size) +{ + struct bpf_tcp_req_attrs attrs =3D {}; + struct bpf_sock *skc; + struct sock *sk; + + skc =3D bpf_skc_lookup_tcp(skb, tuple, tuple_size, -1, 0); + if (!skc) + return TC_ACT_OK; + + if (skc->state !=3D TCP_LISTEN) { + bpf_sk_release(skc); + return TC_ACT_OK; + } + + sk =3D (struct sock *)bpf_skc_to_tcp_sock(skc); + if (!sk) { + bpf_sk_release(skc); + return TC_ACT_OK; + } + + attrs.mss =3D 1460; + attrs.wscale_ok =3D 1; + attrs.snd_wscale =3D 7; + attrs.rcv_wscale =3D 7; + attrs.sack_ok =3D 1; + + assign_ret =3D bpf_sk_assign_tcp_reqsk(skb, sk, &attrs, sizeof(attrs)); + + bpf_sk_release(skc); + return TC_ACT_OK; +} + +SEC("tc") +int tcp_custom_syncookie_badproto(struct __sk_buff *skb) +{ + void *data =3D (void *)(long)skb->data; + void *data_end =3D (void *)(long)skb->data_end; + struct bpf_sock_tuple tuple =3D {}; + struct ethhdr *eth; + struct iphdr *iph; + struct ipv6hdr *ip6h; + struct udphdr *udp; + + eth =3D (struct ethhdr *)data; + if (eth + 1 > data_end) + return TC_ACT_OK; + + switch (bpf_ntohs(eth->h_proto)) { + case ETH_P_IP: + iph =3D (struct iphdr *)(eth + 1); + if (iph + 1 > data_end) + return TC_ACT_OK; + + if (iph->protocol !=3D IPPROTO_UDP) + return TC_ACT_OK; + + udp =3D (struct udphdr *)(iph + 1); + if (udp + 1 > data_end) + return TC_ACT_OK; + + udp_intercepted =3D true; + + tuple.ipv4.saddr =3D iph->saddr; + tuple.ipv4.daddr =3D iph->daddr; + tuple.ipv4.sport =3D udp->source; + tuple.ipv4.dport =3D udp->dest; + + return badproto_lookup_assign(skb, udp, &tuple, + sizeof(tuple.ipv4)); + case ETH_P_IPV6: + ip6h =3D (struct ipv6hdr *)(eth + 1); + if (ip6h + 1 > data_end) + return TC_ACT_OK; + + if (ip6h->nexthdr !=3D IPPROTO_UDP) + return TC_ACT_OK; + + udp =3D (struct udphdr *)(ip6h + 1); + if (udp + 1 > data_end) + return TC_ACT_OK; + + udp_intercepted =3D true; + + __builtin_memcpy(tuple.ipv6.saddr, &ip6h->saddr, + sizeof(tuple.ipv6.saddr)); + __builtin_memcpy(tuple.ipv6.daddr, &ip6h->daddr, + sizeof(tuple.ipv6.daddr)); + tuple.ipv6.sport =3D udp->source; + tuple.ipv6.dport =3D udp->dest; + + return badproto_lookup_assign(skb, udp, &tuple, + sizeof(tuple.ipv6)); + default: + return TC_ACT_OK; + } +} + char _license[] SEC("license") =3D "GPL"; --=20 2.43.0