Adds a bpf helper, bpf_skb_in_cgroup, to decide if a skb->sk belongs to a descendant of a cgroup2. It is similar to the feature added in netfilter: commit c38c4597e4bf ("netfilter: implement xt_cgroup cgroup2 path match") The user is expected to populate a BPF_MAP_TYPE_CGROUP_ARRAY which will be used by the bpf_skb_in_cgroup. Modifications to the bpf verifier is to ensure BPF_MAP_TYPE_CGROUP_ARRAY and bpf_skb_in_cgroup() are always used together.
Showing the changes to include/uapi (1 of 3 files). Show all
Unified · Split
| @@ -337,6 +337,17 @@ enum bpf_func_id { · 336 unmodified lines | ||
| 337 | 337 | */ |
| 338 | 338 | BPF_FUNC_skb_change_type, |
| 339 | 339 | |
| 340 | + /** | |
| 341 | + * bpf_skb_in_cgroup(skb, map, index) - Check cgroup2 membership of skb | |
| 342 | + * @skb: pointer to skb | |
| 343 | + * @map: pointer to bpf_map in BPF_MAP_TYPE_CGROUP_ARRAY type | |
| 344 | + * @index: index of the cgroup in the bpf_map | |
| 345 | + * Return: | |
| 346 | + * == 0 skb failed the cgroup2 descendant test | |
| 347 | + * == 1 skb succeeded the cgroup2 descendant test | |
| 348 | + * < 0 error | |
| 349 | + */ | |
| 350 | + BPF_FUNC_skb_in_cgroup, | |
| 340 | 351 | __BPF_FUNC_MAX_ID, |
| 341 | 352 | }; |
| 342 | 353 | |