OSDN Git Service

bpf: Allow sk lookup helpers in cgroup skb
authorAndrey Ignatov <rdna@fb.com>
Thu, 14 May 2020 20:03:45 +0000 (13:03 -0700)
committerAlexei Starovoitov <ast@kernel.org>
Fri, 15 May 2020 01:41:07 +0000 (18:41 -0700)
commitd56c2f95adb3d401bf982b6cf8fc4bb6d2f7acdd
tree8b46a965e49905f1bc932fb85ff3df8b53946ab5
parent5b0004d92b4511c39db0df23aa84395722f1d706
bpf: Allow sk lookup helpers in cgroup skb

Currently sk lookup helpers are allowed in tc, xdp, sk skb, and cgroup
sock_addr programs.

But they would be useful in cgroup skb as well so that for example
cgroup skb ingress program can lookup a peer socket a packet comes from
on same host and make a decision whether to allow or deny this packet
based on the properties of that socket, e.g. cgroup that peer socket
belongs to.

Allow the following sk lookup helpers in cgroup skb:
* bpf_sk_lookup_tcp;
* bpf_sk_lookup_udp;
* bpf_sk_release;
* bpf_skc_lookup_tcp.

Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/f8c7ee280f1582b586629436d777b6db00597d63.1589486450.git.rdna@fb.com
net/core/filter.c