Files
linux/include/uapi/linux
Andrey Ignatov aac3fc320d bpf: Post-hooks for sys_bind
"Post-hooks" are hooks that are called right before returning from
sys_bind. At this time IP and port are already allocated and no further
changes to `struct sock` can happen before returning from sys_bind but
BPF program has a chance to inspect the socket and change sys_bind
result.

Specifically it can e.g. inspect what port was allocated and if it
doesn't satisfy some policy, BPF program can force sys_bind to fail and
return EPERM to user.

Another example of usage is recording the IP:port pair to some map to
use it in later calls to sys_connect. E.g. if some TCP server inside
cgroup was bound to some IP:port_n, it can be recorded to a map. And
later when some TCP client inside same cgroup is trying to connect to
127.0.0.1:port_n, BPF hook for sys_connect can override the destination
and connect application to IP:port_n instead of 127.0.0.1:port_n. That
helps forcing all applications inside a cgroup to use desired IP and not
break those applications if they e.g. use localhost to communicate
between each other.

== Implementation details ==

Post-hooks are implemented as two new attach types
`BPF_CGROUP_INET4_POST_BIND` and `BPF_CGROUP_INET6_POST_BIND` for
existing prog type `BPF_PROG_TYPE_CGROUP_SOCK`.

Separate attach types for IPv4 and IPv6 are introduced to avoid access
to IPv6 field in `struct sock` from `inet_bind()` and to IPv4 field from
`inet6_bind()` since those fields might not make sense in such cases.

Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-03-31 02:16:26 +02:00
..
…
2017-08-31 17:32:38 -04:00
2017-11-24 16:22:58 -07:00
2018-03-31 02:16:26 +02:00
…
…
2018-01-25 19:32:55 -05:00
…
2017-11-08 11:20:49 +09:00
…
…
2017-12-14 10:35:15 -05:00
2017-11-28 16:54:00 +01:00
2018-03-05 10:43:37 -05:00
2018-01-14 23:06:30 -05:00
2018-01-16 16:47:29 +01:00
…
2018-01-31 10:10:32 -06:00
…
2018-02-06 22:53:56 +00:00
…
2017-11-24 10:18:41 +00:00
2017-11-16 10:49:00 +09:00
2017-11-11 18:53:16 +09:00
…
2018-03-17 17:11:46 -04:00
2017-11-27 16:19:52 -05:00
2018-02-06 18:32:44 -08:00
2016-12-16 00:13:32 +02:00
…