From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
To: David Ahern <dsa@cumulusnetworks.com>
Cc: netdev@vger.kernel.org, daniel@zonque.org, ast@fb.com,
daniel@iogearbox.net, maheshb@google.com, tgraf@suug.ch
Subject: Re: [PATCH net-next v6 6/6] samples/bpf: add userspace example for prohibiting sockets
Date: Wed, 30 Nov 2016 21:59:55 -0800 [thread overview]
Message-ID: <20161201055953.GB42375@ast-mbp.thefacebook.com> (raw)
In-Reply-To: <1480529810-25850-7-git-send-email-dsa@cumulusnetworks.com>
On Wed, Nov 30, 2016 at 10:16:50AM -0800, David Ahern wrote:
> Add examples preventing a process in a cgroup from opening a socket
> based family, protocol and type.
>
> Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
...
> +++ b/samples/bpf/sock_flags_kern.c
> @@ -0,0 +1,37 @@
> +#include <uapi/linux/bpf.h>
> +#include <linux/socket.h>
> +#include "bpf_helpers.h"
> +
> +SEC("cgroup/sock1")
> +int bpf_prog1(struct bpf_sock *sk)
> +{
> + char fmt[] = "socket: family %d type %d protocol %d\n";
> +
> + bpf_trace_printk(fmt, sizeof(fmt), sk->family, sk->type, sk->protocol);
> +
> + /* block PF_INET6, SOCK_RAW, IPPROTO_ICMPV6 sockets
> + * ie., make ping6 fail
> + */
> + if (sk->family == PF_INET6 && sk->type == 3 && sk->protocol == 58)
> + return 0;
why not to use SOCK_RAW and IPPROTO_ICMPV6 instead of constants?
Thanks for the test!
next prev parent reply other threads:[~2016-12-01 6:00 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-30 18:16 [PATCH net-next v6 0/6] net: Add bpf support for sockets David Ahern
2016-11-30 18:16 ` [PATCH net-next v6 1/6] bpf: Refactor cgroups code in prep for new type David Ahern
2016-11-30 18:16 ` [PATCH net-next v6 2/6] bpf: Add new cgroup attach type to enable sock modifications David Ahern
2016-11-30 18:16 ` [PATCH net-next v6 3/6] samples: bpf: add userspace example for modifying sk_bound_dev_if David Ahern
2016-11-30 18:16 ` [PATCH net-next v6 4/6] bpf: Add support for reading socket family, type, protocol David Ahern
2016-12-01 5:53 ` Alexei Starovoitov
2016-11-30 18:16 ` [PATCH net-next v6 5/6] samples/bpf: Update bpf loader for cgroup section names David Ahern
2016-11-30 18:16 ` [PATCH net-next v6 6/6] samples/bpf: add userspace example for prohibiting sockets David Ahern
2016-12-01 5:59 ` Alexei Starovoitov [this message]
2016-12-01 15:13 ` David Ahern
2016-12-05 10:51 ` David Laight
2016-12-05 14:31 ` David Ahern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161201055953.GB42375@ast-mbp.thefacebook.com \
--to=alexei.starovoitov@gmail.com \
--cc=ast@fb.com \
--cc=daniel@iogearbox.net \
--cc=daniel@zonque.org \
--cc=dsa@cumulusnetworks.com \
--cc=maheshb@google.com \
--cc=netdev@vger.kernel.org \
--cc=tgraf@suug.ch \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox