| Message ID | 9f01cc9fd918988613c6d34913cf52fbe7369515.1589405669.git.rdna@fb.com |
|---|---|
| State | Changes Requested |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | bpf: sk lookup, cgroup id helpers in cgroup skb | expand |
On 5/13/20 2:38 PM, Andrey Ignatov wrote: > Currently sk lookup helpers are allowed in tc, xdp, sk skb, and cgroup > sock_addr programs. > > But they would be useful in cgroup skb as well so that for example > cgroup skb ingress program can lookup a peer socket a packet comes from > on same host and make a decision whether to allow or deny this packet > based on the properties of that socket, e.g. cgroup that peer socket > belongs to. > > Allow the following sk lookup helpers in cgroup skb: > * bpf_sk_lookup_tcp; > * bpf_sk_lookup_udp; > * bpf_sk_release; > * bpf_skc_lookup_tcp. > > Signed-off-by: Andrey Ignatov <rdna@fb.com> Acked-by: Yonghong Song <yhs@fb.com>
diff --git a/net/core/filter.c b/net/core/filter.c index da0634979f53..ccb560c1a1db 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -6159,6 +6159,14 @@ cg_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) return &bpf_skb_cgroup_id_proto; #endif #ifdef CONFIG_INET + case BPF_FUNC_sk_lookup_tcp: + return &bpf_sk_lookup_tcp_proto; + case BPF_FUNC_sk_lookup_udp: + return &bpf_sk_lookup_udp_proto; + case BPF_FUNC_sk_release: + return &bpf_sk_release_proto; + case BPF_FUNC_skc_lookup_tcp: + return &bpf_skc_lookup_tcp_proto; case BPF_FUNC_tcp_sock: return &bpf_tcp_sock_proto; case BPF_FUNC_get_listener_sock:
Currently sk lookup helpers are allowed in tc, xdp, sk skb, and cgroup sock_addr programs. But they would be useful in cgroup skb as well so that for example cgroup skb ingress program can lookup a peer socket a packet comes from on same host and make a decision whether to allow or deny this packet based on the properties of that socket, e.g. cgroup that peer socket belongs to. Allow the following sk lookup helpers in cgroup skb: * bpf_sk_lookup_tcp; * bpf_sk_lookup_udp; * bpf_sk_release; * bpf_skc_lookup_tcp. Signed-off-by: Andrey Ignatov <rdna@fb.com> --- net/core/filter.c | 8 ++++++++ 1 file changed, 8 insertions(+)