#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <netinet/in.h>

#define SEC(NAME) __attribute__((section(NAME), used))

static const char http_host[] = "Host: blah.acmecorp.com";

SEC("socket_filter")
int egress_firewall(struct __sk_buff *skb) {
    // Assuming Ethernet (without VLAN tags) + IPv4 + TCP without options
    int eth_header_len = 14; // Ethernet header length
    int ip_header_len = 20; // Minimum IP header length
    int tcp_header_len = 20; // Minimum TCP header length
    int total_headers_len = eth_header_len + ip_header_len + tcp_header_len;

    if (skb->data + total_headers_len > skb->data_end) {
        return 1; // Pass the packet if we can't inspect the whole header
    }

    // Check if destination port is 80 (HTTP)
    unsigned short dest_port = load_half(skb, eth_header_len + ip_header_len + 2);
    if (dest_port != __constant_htons(80)) {
        return 1; // Allow if not HTTP
    }

    // Start of the payload
    const char *payload = (const char *)(long)skb->data + total_headers_len;
    // Payload length
    unsigned int payload_len = skb->data_end - skb->data - total_headers_len;

    // Search for the "Host:" header within the payload
    for (int i = 0; i < payload_len - sizeof(http_host) + 1; i++) {
        if (bpf_memcmp(payload + i, http_host, sizeof(http_host) - 1) == 0) {
            return 1; // Found the header, allow the packet
        }
    }

    return 0; // Drop the packet if the specific "Host:" header is not found
}

char _license[] SEC("license") = "GPL";