]> git.baikalelectronics.ru Git - kernel.git/commit
bpf: Allow sk lookup helpers in cgroup skb
authorAndrey Ignatov <rdna@fb.com>
Thu, 14 May 2020 20:03:45 +0000 (13:03 -0700)
committerAlexei Starovoitov <ast@kernel.org>
Fri, 15 May 2020 01:41:07 +0000 (18:41 -0700)
commitc1e645e9398e1e52a84a7e575753c3515a439eed
tree8b46a965e49905f1bc932fb85ff3df8b53946ab5
parenta673d402f89d3f5a520d675b1eae15c472b4d67b
bpf: Allow sk lookup helpers in cgroup skb

Currently sk lookup helpers are allowed in tc, xdp, sk skb, and cgroup
sock_addr programs.

But they would be useful in cgroup skb as well so that for example
cgroup skb ingress program can lookup a peer socket a packet comes from
on same host and make a decision whether to allow or deny this packet
based on the properties of that socket, e.g. cgroup that peer socket
belongs to.

Allow the following sk lookup helpers in cgroup skb:
* bpf_sk_lookup_tcp;
* bpf_sk_lookup_udp;
* bpf_sk_release;
* bpf_skc_lookup_tcp.

Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/f8c7ee280f1582b586629436d777b6db00597d63.1589486450.git.rdna@fb.com
net/core/filter.c