You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Andrey Ignatov 83fc9b709f BACKPORT: bpf: Post-hooks for sys_bind ... "Post-hooks" are hooks that are called right before returning from sys_bind. At this time IP and port are already allocated and no further changes to `struct sock` can happen before returning from sys_bind but BPF program has a chance to inspect the socket and change sys_bind result. Specifically it can e.g. inspect what port was allocated and if it doesn't satisfy some policy, BPF program can force sys_bind to fail and return EPERM to user. Another example of usage is recording the IP:port pair to some map to use it in later calls to sys_connect. E.g. if some TCP server inside cgroup was bound to some IP:port_n, it can be recorded to a map. And later when some TCP client inside same cgroup is trying to connect to 127.0.0.1:port_n, BPF hook for sys_connect can override the destination and connect application to IP:port_n instead of 127.0.0.1:port_n. That helps forcing all applications inside a cgroup to use desired IP and not break those applications if they e.g. use localhost to communicate between each other. == Implementation details == Post-hooks are implemented as two new attach types `BPF_CGROUP_INET4_POST_BIND` and `BPF_CGROUP_INET6_POST_BIND` for existing prog type `BPF_PROG_TYPE_CGROUP_SOCK`. Separate attach types for IPv4 and IPv6 are introduced to avoid access to IPv6 field in `struct sock` from `inet_bind()` and to IPv4 field from `inet6_bind()` since those fields might not make sense in such cases. Change-Id: Ibef21eed069c37684321b2401e5bb52f689ab8e7 Signed-off-by: Andrey Ignatov <rdna@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>		2 months ago
..
ila	Import A525FXXU3AUG4	3 years ago
netfilter	Import A525FXXU3AUG4	3 years ago
Kconfig	Import A525FXXU3AUG4	3 years ago
Makefile	Import A525FXXU3AUG4	3 years ago
addrconf.c	A525FXXU4AUJ2	2 years ago
addrconf_core.c	Import A525FXXU3AUG4	3 years ago
addrlabel.c	Import A525FXXU3AUG4	3 years ago
af_inet6.c	BACKPORT: bpf: Post-hooks for sys_bind	2 months ago
ah6.c	Import A525FXXU3AUG4	3 years ago
anycast.c	Import A525FXXU3AUG4	3 years ago
calipso.c	Import A525FXXU3AUG4	3 years ago
datagram.c	Import A525FXXU3AUG4	3 years ago
esp6.c	Import A525FXXU3AUG4	3 years ago
esp6_offload.c	Import A525FXXU3AUG4	3 years ago
exthdrs.c	Import A525FXXU3AUG4	3 years ago
exthdrs_core.c	Import A525FXXU3AUG4	3 years ago
exthdrs_offload.c	Import A525FXXU3AUG4	3 years ago
fib6_notifier.c	Import A525FXXU3AUG4	3 years ago
fib6_rules.c	Import A525FXXU3AUG4	3 years ago
fou6.c	Import A525FXXU3AUG4	3 years ago
icmp.c	Import A525FXXU3AUG4	3 years ago
inet6_connection_sock.c	Import A525FXXU3AUG4	3 years ago
inet6_hashtables.c	Import A525FXXU3AUG4	3 years ago
ip6_checksum.c	Import A525FXXU3AUG4	3 years ago
ip6_fib.c	Import A525FXXU3AUG4	3 years ago
ip6_flowlabel.c	Import A525FXXU3AUG4	3 years ago
ip6_gre.c	Import A525FXXU3AUG4	3 years ago
ip6_icmp.c	Import A525FXXU3AUG4	3 years ago
ip6_input.c	Import A525FXXU3AUG4	3 years ago
ip6_offload.c	Import A525FXXU3AUG4	3 years ago
ip6_offload.h	Import A525FXXU3AUG4	3 years ago
ip6_output.c	Import A525FXXU3AUG4	3 years ago
ip6_tunnel.c	Import A525FXXU3AUG4	3 years ago
ip6_udp_tunnel.c	Import A525FXXU3AUG4	3 years ago
ip6_vti.c	Import A525FXXU3AUG4	3 years ago
ip6mr.c	Import A525FXXU3AUG4	3 years ago
ipcomp6.c	Import A525FXXU3AUG4	3 years ago
ipv6_sockglue.c	Import A525FXXU3AUG4	3 years ago
mcast.c	Import A525FXXU3AUG4	3 years ago
mcast_snoop.c	Import A525FXXU3AUG4	3 years ago
mip6.c	Import A525FXXU3AUG4	3 years ago
ndisc.c	Import A525FXXU3AUG4	3 years ago
netfilter.c	Import A525FXXU3AUG4	3 years ago
output_core.c	Import A525FXXU3AUG4	3 years ago
ping.c	Import A525FXXU3AUG4	3 years ago
proc.c	Import A525FXXU3AUG4	3 years ago
protocol.c	Import A525FXXU3AUG4	3 years ago
raw.c	Import A525FXXU3AUG4	3 years ago
reassembly.c	Import A525FXXU3AUG4	3 years ago
route.c	Import A525FXXU3AUG4	3 years ago
seg6.c	Import A525FXXU3AUG4	3 years ago
seg6_hmac.c	Import A525FXXU3AUG4	3 years ago
seg6_iptunnel.c	Import A525FXXU3AUG4	3 years ago
seg6_local.c	Import A525FXXU3AUG4	3 years ago
sit.c	Import A525FXXU3AUG4	3 years ago
syncookies.c	Import A525FXXU3AUG4	3 years ago
sysctl_net_ipv6.c	Import A525FXXU3AUG4	3 years ago
tcp_ipv6.c	BACKPORT: bpf: Hooks for sys_connect	2 months ago
tcpv6_offload.c	Import A525FXXU3AUG4	3 years ago
tunnel6.c	Import A525FXXU3AUG4	3 years ago
udp.c	BACKPORT: bpf: Hooks for sys_connect	2 months ago
udp_impl.h	Import A525FXXU3AUG4	3 years ago
udp_offload.c	Import A525FXXU3AUG4	3 years ago
udplite.c	Import A525FXXU3AUG4	3 years ago
xfrm6_input.c	Import A525FXXU3AUG4	3 years ago
xfrm6_mode_beet.c	Import A525FXXU3AUG4	3 years ago
xfrm6_mode_ro.c	Import A525FXXU3AUG4	3 years ago
xfrm6_mode_transport.c	Import A525FXXU3AUG4	3 years ago
xfrm6_mode_tunnel.c	Import A525FXXU3AUG4	3 years ago
xfrm6_output.c	Import A525FXXU3AUG4	3 years ago
xfrm6_policy.c	Import A525FXXU3AUG4	3 years ago
xfrm6_protocol.c	Import A525FXXU3AUG4	3 years ago
xfrm6_state.c	Import A525FXXU3AUG4	3 years ago
xfrm6_tunnel.c	Import A525FXXU3AUG4	3 years ago