return TC_ACT_SHOT;

    capture_dns = zi->flag & CAPTURE_DNS_FLAG;

    if (data + sizeof(*eth) > data_end)
        return TC_ACT_OK;

    // TODO: support ipv6
    if (eth->h_proto != bpf_htons(ETH_P_IP))
        return TC_ACT_OK;

    iph = data + sizeof(*eth);
    if (data + sizeof(*eth) + sizeof(*iph) > data_end)
        return TC_ACT_OK;

    host_info = get_host_ip(0);

}

func (r *RedirectServer) attachTCForZtunnel(ifindex, peerIndex uint32, namespace string) error {
	// attach to ztunnel host veth's ingress
	if err := r.attachTC("", ifindex, "ingress", r.ztunnelHostingressFd, r.ztunnelHostingressProgName); err != nil {
		return err
	}
	// attach to ztunnel veth's ingress in POD namespace
	if err := r.attachTC(namespace, peerIndex, "ingress", r.ztunnelIngressFd, r.ztunnelIngressProgName); err != nil {

Park, Dragan Mladjenovic, Eli Kobrin, Fadi Arafeh, Feiyue Chen, Frédéric Bastien, guozhong.zhuang, halseycamilla, Harshavardhan Bellamkonda, James Ward, jameshollyer, Jane Liu, johnnkp, jswag180, justkw, Kanvi Khanna, Keith Smiley, Koan-Sin Tan, Kulin Seth, Kun-Lu, kushanam, Lu Teng, mdfaijul, Mehdi Drissi, mgokulkrish, mraunak, Mustafa Uzun, Namrata Bhave, Pavel Emeliyanenko, pemeliya, Peng Sun, Philipp Hack, Pratik Joshi, Rahul Batra, Raunak, redwrasse, Saoirse Stewart, SaoirseARM, seanshpark, Shanbin...

}

func getVethWithDestinationOf(ip string) (*netlink.Veth, error) {
	link, err := getLinkWithDestinationOf(ip)
	if err != nil {
		return nil, err
	}
	veth, ok := link.(*netlink.Veth)
	if !ok {
		return nil, errors.New("not veth implemented CNI")
	}
	return veth, nil
}

func findVethLinkForPeerIP(peerIP net.IP) (*netlink.Veth, error) {
	links, err := netlink.LinkList()
	if err != nil {

type RedirectArgs struct {
	// IPAddrs is IP address list of the POD
	IPAddrs []netip.Addr

	// MacAddr is mac address of veth in POD namespace
	MacAddr net.HardwareAddr

	// Ifindex is ifIndex of veth in host namespace
	Ifindex int

	// PeerIndex is ifIndex of veth in POD namespace
	PeerIndex int

	// IsZtunnel indicates if the POD is ztunnel
	IsZtunnel bool

	// PeerNs is POD's network namespace

		// Do we care about that?
		veth, err := getVethWithDestinationOf(activePod.Status.PodIP)
		if err != nil {
			return fmt.Errorf("failed to get veth device: %v", err)
		}
		geneveDstPort := determineDstPortForGeneveLink(net.ParseIP(activePod.Status.PodIP), constants.InboundTunVNI, constants.OutboundTunVNI)
		// Create node-level networking rules for redirection

#define ZTUNNEL_OUTBOUND_PORT (15001)

// Limited to 1K pods per node
#define MAX_PODS_PER_NODE (1024)
#define APP_INFO_MAP_SIZE MAX_PODS_PER_NODE

#define ETH_ALEN 6
#define BPF_F_CURRENT_NETNS (-1L)
#define TC_ACT_OK       0
#define TC_ACT_SHOT     2
#define ETH_P_IP        (0x0800)
#define UDP_P_DNS       (53)
// #define PIN_GLOBAL_NS   2

#define CAPTURE_DNS_FLAG (1<<0)

#ifndef __inline

// Submitted by Q Misell <******@****.***>
musician.io
// Submitted by Matthias Merkel <******@****.***>
novecore.site

// staticland : https://static.land
// Submitted by Seth Vincent <******@****.***>
static.land
dev.static.land
sites.static.land

// Storebase : https://www.storebase.io
// Submitted by Tony Schirmer <******@****.***>
storebase.store

pkg syscall (linux-386), const ETH_P_CUST ideal-int
pkg syscall (linux-386), const ETH_P_DDCMP ideal-int
pkg syscall (linux-386), const ETH_P_DEC ideal-int
pkg syscall (linux-386), const ETH_P_DIAG ideal-int
pkg syscall (linux-386), const ETH_P_DNA_DL ideal-int
pkg syscall (linux-386), const ETH_P_DNA_RC ideal-int
pkg syscall (linux-386), const ETH_P_DNA_RT ideal-int

pkg syscall (linux-386), const ETH_P_DDCMP = 6
pkg syscall (linux-386), const ETH_P_DEC = 24576
pkg syscall (linux-386), const ETH_P_DIAG = 24581
pkg syscall (linux-386), const ETH_P_DNA_DL = 24577
pkg syscall (linux-386), const ETH_P_DNA_RC = 24578
pkg syscall (linux-386), const ETH_P_DNA_RT = 24579
pkg syscall (linux-386), const ETH_P_DSA = 27
pkg syscall (linux-386), const ETH_P_ECONET = 24