Adds a bpf helper, bpf_skb_in_cgroup, to decide if a skb->sk belongs to a descendant of a cgroup2. It is similar to the feature added in netfilter: commit c38c4597e4bf ("netfilter: implement xt_cgroup cgroup2 path match") The user is expected to populate a BPF_MAP_TYPE_CGROUP_ARRAY which will be used by the bpf_skb_in_cgroup. Modifications to the bpf verifier is to ensure BPF_MAP_TYPE_CGROUP_ARRAY and bpf_skb_in_cgroup() are always used together.
Showing the changes to include/uapi (1 of 3 files). Show all
Unified · Split
| @@ -337,6 +337,17 @@ enum bpf_func_id { · 336 unmodified lines | |||
| 337 | */ | 337 | */ |
| 338 | BPF_FUNC_skb_change_type, | 338 | BPF_FUNC_skb_change_type, |
| 339 | 339 | ||
| 340 | /** | ||
| 341 | * bpf_skb_in_cgroup(skb, map, index) - Check cgroup2 membership of skb | ||
| 342 | * @skb: pointer to skb | ||
| 343 | * @map: pointer to bpf_map in BPF_MAP_TYPE_CGROUP_ARRAY type | ||
| 344 | * @index: index of the cgroup in the bpf_map | ||
| 345 | * Return: | ||
| 346 | * == 0 skb failed the cgroup2 descendant test | ||
| 347 | * == 1 skb succeeded the cgroup2 descendant test | ||
| 348 | * < 0 error | ||
| 349 | */ | ||
| 350 | BPF_FUNC_skb_in_cgroup, | ||
| 340 | __BPF_FUNC_MAX_ID, | 351 | __BPF_FUNC_MAX_ID, |
| 341 | }; | 352 | }; |
| 342 | 353 | ||