71 lines · c
1// SPDX-License-Identifier: GPL-2.02// Copyright (c) 2020 Isovalent, Inc.3#include "vmlinux.h"4#include <bpf/bpf_helpers.h>5 6struct {7 __uint(type, BPF_MAP_TYPE_SOCKMAP);8 __uint(max_entries, 2);9 __type(key, __u32);10 __type(value, __u64);11} sock_map SEC(".maps");12 13struct {14 __uint(type, BPF_MAP_TYPE_SOCKHASH);15 __uint(max_entries, 2);16 __type(key, __u32);17 __type(value, __u64);18} sock_hash SEC(".maps");19 20struct {21 __uint(type, BPF_MAP_TYPE_SK_STORAGE);22 __uint(map_flags, BPF_F_NO_PREALLOC);23 __type(key, __u32);24 __type(value, __u64);25} socket_storage SEC(".maps");26 27static int prog_msg_verdict_common(struct sk_msg_md *msg)28{29 struct task_struct *task = (struct task_struct *)bpf_get_current_task();30 int verdict = SK_PASS;31 __u32 pid, tpid;32 __u64 *sk_stg;33 34 pid = bpf_get_current_pid_tgid() >> 32;35 sk_stg = bpf_sk_storage_get(&socket_storage, msg->sk, 0, BPF_SK_STORAGE_GET_F_CREATE);36 if (!sk_stg)37 return SK_DROP;38 *sk_stg = pid;39 bpf_probe_read_kernel(&tpid , sizeof(tpid), &task->tgid);40 if (pid != tpid)41 verdict = SK_DROP;42 bpf_sk_storage_delete(&socket_storage, (void *)msg->sk);43 return verdict;44}45 46SEC("sk_msg")47int prog_msg_verdict(struct sk_msg_md *msg)48{49 return prog_msg_verdict_common(msg);50}51 52SEC("sk_msg")53int prog_msg_verdict_clone(struct sk_msg_md *msg)54{55 return prog_msg_verdict_common(msg);56}57 58SEC("sk_msg")59int prog_msg_verdict_clone2(struct sk_msg_md *msg)60{61 return prog_msg_verdict_common(msg);62}63 64SEC("sk_skb/stream_verdict")65int prog_skb_verdict(struct __sk_buff *skb)66{67 return SK_PASS;68}69 70char _license[] SEC("license") = "GPL";71