Merge branch 'expand-cg_skb-helpers'

Andrey Ignatov says: ==================== v2->v3: - better documentation for bpf_sk_cgroup_id in uapi (Yonghong Song) - save/restore errno in network helpers (Yonghong Song) - cleanup leftover after switching selftest to skeleton (Yonghong Song) - switch from map to skel->bss in selftest (Yonghong Song) v1->v2: - switch selftests to skeleton. This patch set allows a bunch of existing sk lookup and skb cgroup id helpers, and adds two new bpf_sk_{,ancestor_}cgroup_id helpers to be used in cgroup skb programs. It fills the gap to cover a use-case to apply intra-host cgroup-bpf network policy based on a source cgroup a packet comes from. For example, there can be multiple containers A, B, C running on a host. Every such container runs in its own cgroup that can have multiple sub-cgroups. But all these containers can share some IP addresses. At the same time container A wants to have a policy for a server S running in it so that only clients from this same container can connect to S, but not from other containers (such as B, C). Source IP address can't be used to decide whether to allow or deny a packet, but it looks reasonable to filter by cgroup id. The patch set allows to implement the following policy: * when an ingress packet comes to container's cgroup, lookup peer (client) socket this packet comes from; * having peer socket, get its cgroup id; * compare peer cgroup id with self cgroup id and allow packet only if they match, i.e. it comes from same cgroup; * the "sub-cgroup" part of the story can be addressed by getting not direct cgroup id of the peer socket, but ancestor cgroup id on specified level, similar to existing "ancestor" flavors of cgroup id helpers. A newly introduced selftest implements such a policy in its basic form to provide a better idea on the use-case. Patch 1 allows existing sk lookup helpers in cgroup skb. Patch 2 allows skb_ancestor_cgroup_id in cgrou skb. Patch 3 introduces two new helpers to get cgroup id of socket. Patch 4 extends network helpers to use them in the next patch. Patch 5 adds selftest / example of use-case. ====================

Alexei Starovoitov committed 6 years ago

Commit b92d44b2 parents 5b0004d 68e916b7 files · +386 −24Browse files

Unified · Split

7 files

include/uapi/linux/bpf.h +35 −1
net/core/filter.c +61 −9
tools/include/uapi/linux/bpf.h +35 −1
tools/testing/selftests/bpf/network_helpers.c +61 −13
tools/testing/selftests/bpf/network_helpers.h +2 −0
tools/testing/selftests/bpf/prog_tests/cgroup_skb_sk_lookup.c +95 −0
tools/testing/selftests/bpf/progs/cgroup_skb_sk_lookup_kern.c +97 −0

include/uapi/linux/bpf.h+35−1

@@ -3121,6 +3121,38 @@ union bpf_attr { · 3120 unmodified lines
3121	3121	* 0 on success, or a negative error in case of failure:
3122	3122	*
3123	3123	* -EOVERFLOW if an overflow happened: The same object will be tried again.
	3124	+ *
	3125	+ * u64 bpf_sk_cgroup_id(struct bpf_sock *sk)
	3126	+ * Description
	3127	+ * Return the cgroup v2 id of the socket sk.
	3128	+ *
	3129	+ * sk must be a non-NULL pointer to a full socket, e.g. one
	3130	+ * returned from bpf_sk_lookup_xxx\ (),
	3131	+ * bpf_sk_fullsock\ (), etc. The format of returned id is
	3132	+ * same as in bpf_skb_cgroup_id\ ().
	3133	+ *
	3134	+ * This helper is available only if the kernel was compiled with
	3135	+ * the CONFIG_SOCK_CGROUP_DATA configuration option.
	3136	+ * Return
	3137	+ * The id is returned or 0 in case the id could not be retrieved.
	3138	+ *
	3139	+ * u64 bpf_sk_ancestor_cgroup_id(struct bpf_sock *sk, int ancestor_level)
	3140	+ * Description
	3141	+ * Return id of cgroup v2 that is ancestor of cgroup associated
	3142	+ * with the sk at the ancestor_level. The root cgroup is at
	3143	+ * ancestor_level zero and each step down the hierarchy
	3144	+ * increments the level. If ancestor_level == level of cgroup
	3145	+ * associated with sk, then return value will be same as that
	3146	+ * of bpf_sk_cgroup_id\ ().
	3147	+ *
	3148	+ * The helper is useful to implement policies based on cgroups
	3149	+ * that are upper in hierarchy than immediate cgroup associated
	3150	+ * with sk.
	3151	+ *
	3152	+ * The format of returned id and helper limitations are same as in
	3153	+ * bpf_sk_cgroup_id\ ().
	3154	+ * Return
	3155	+ * The id is returned or 0 in case the id could not be retrieved.
3124	3156	*/
3125	3157	#define __BPF_FUNC_MAPPER(FN) \
3126	3158	FN(unspec), \
@@ -3250,7 +3282,9 @@ union bpf_attr { · 123 unmodified lines
3250	3282	FN(sk_assign), \
3251	3283	FN(ktime_get_boot_ns), \
3252	3284	FN(seq_printf), \
3253		− FN(seq_write),
	3285	+ FN(seq_write), \
	3286	+ FN(sk_cgroup_id), \
	3287	+ FN(sk_ancestor_cgroup_id),
3254	3288
3255	3289	/* integer value in 'imm' field of BPF_CALL instruction selects which helper
3256	3290	* function eBPF program intends to call

net/core/filter.c+61−9

@@ -4003,16 +4003,22 @@ static const struct bpf_func_proto bpf_skb_under_cgroup_proto = { · 4002 unmodified lines
4003	4003	};
4004	4004
4005	4005	#ifdef CONFIG_SOCK_CGROUP_DATA
	4006	+static inline u64 __bpf_sk_cgroup_id(struct sock *sk)
	4007	+{
	4008	+ struct cgroup *cgrp;
	4009	+
	4010	+ cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
	4011	+ return cgroup_id(cgrp);
	4012	+}
	4013	+
4006	4014	BPF_CALL_1(bpf_skb_cgroup_id, const struct sk_buff *, skb)
4007	4015	{
4008	4016	struct sock *sk = skb_to_full_sk(skb);
4009		− struct cgroup *cgrp;
4010	4017
4011	4018	if (!sk \|\| !sk_fullsock(sk))
4012	4019	return 0;
4013	4020
4014		− cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
4015		− return cgroup_id(cgrp);
	4021	+ return __bpf_sk_cgroup_id(sk);
4016	4022	}
4017	4023
4018	4024	static const struct bpf_func_proto bpf_skb_cgroup_id_proto = {
@@ -4022,16 +4028,12 @@ static const struct bpf_func_proto bpf_skb_cgroup_id_proto = { · 3 unmodified lines
4022	4028	.arg1_type = ARG_PTR_TO_CTX,
4023	4029	};
4024	4030
4025		−BPF_CALL_2(bpf_skb_ancestor_cgroup_id, const struct sk_buff *, skb, int,
4026		− ancestor_level)
	4031	+static inline u64 __bpf_sk_ancestor_cgroup_id(struct sock *sk,
	4032	+ int ancestor_level)
4027	4033	{
4028		− struct sock *sk = skb_to_full_sk(skb);
4029	4034	struct cgroup *ancestor;
4030	4035	struct cgroup *cgrp;
4031	4036
4032		− if (!sk \|\| !sk_fullsock(sk))
4033		− return 0;
4034		−
4035	4037	cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
4036	4038	ancestor = cgroup_ancestor(cgrp, ancestor_level);
4037	4039	if (!ancestor)
@@ -4040,6 +4042,17 @@ BPF_CALL_2(bpf_skb_ancestor_cgroup_id, const struct sk_buff *, skb, int, · 2 unmodified lines
4040	4042	return cgroup_id(ancestor);
4041	4043	}
4042	4044
	4045	+BPF_CALL_2(bpf_skb_ancestor_cgroup_id, const struct sk_buff *, skb, int,
	4046	+ ancestor_level)
	4047	+{
	4048	+ struct sock *sk = skb_to_full_sk(skb);
	4049	+
	4050	+ if (!sk \|\| !sk_fullsock(sk))
	4051	+ return 0;
	4052	+
	4053	+ return __bpf_sk_ancestor_cgroup_id(sk, ancestor_level);
	4054	+}
	4055	+
4043	4056	static const struct bpf_func_proto bpf_skb_ancestor_cgroup_id_proto = {
4044	4057	.func = bpf_skb_ancestor_cgroup_id,
4045	4058	.gpl_only = false,
@@ -4047,6 +4060,31 @@ static const struct bpf_func_proto bpf_skb_ancestor_cgroup_id_proto = { · 1 unmodified line
4047	4060	.arg1_type = ARG_PTR_TO_CTX,
4048	4061	.arg2_type = ARG_ANYTHING,
4049	4062	};
	4063	+
	4064	+BPF_CALL_1(bpf_sk_cgroup_id, struct sock *, sk)
	4065	+{
	4066	+ return __bpf_sk_cgroup_id(sk);
	4067	+}
	4068	+
	4069	+static const struct bpf_func_proto bpf_sk_cgroup_id_proto = {
	4070	+ .func = bpf_sk_cgroup_id,
	4071	+ .gpl_only = false,
	4072	+ .ret_type = RET_INTEGER,
	4073	+ .arg1_type = ARG_PTR_TO_SOCKET,
	4074	+};
	4075	+
	4076	+BPF_CALL_2(bpf_sk_ancestor_cgroup_id, struct sock *, sk, int, ancestor_level)
	4077	+{
	4078	+ return __bpf_sk_ancestor_cgroup_id(sk, ancestor_level);
	4079	+}
	4080	+
	4081	+static const struct bpf_func_proto bpf_sk_ancestor_cgroup_id_proto = {
	4082	+ .func = bpf_sk_ancestor_cgroup_id,
	4083	+ .gpl_only = false,
	4084	+ .ret_type = RET_INTEGER,
	4085	+ .arg1_type = ARG_PTR_TO_SOCKET,
	4086	+ .arg2_type = ARG_ANYTHING,
	4087	+};
4050	4088	#endif
4051	4089
4052	4090	static unsigned long bpf_xdp_copy(void dst_buff, const void src_buff,
@@ -6157,8 +6195,22 @@ cg_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) · 2104 unmodified lines
6157	6195	#ifdef CONFIG_SOCK_CGROUP_DATA
6158	6196	case BPF_FUNC_skb_cgroup_id:
6159	6197	return &bpf_skb_cgroup_id_proto;
	6198	+ case BPF_FUNC_skb_ancestor_cgroup_id:
	6199	+ return &bpf_skb_ancestor_cgroup_id_proto;
	6200	+ case BPF_FUNC_sk_cgroup_id:
	6201	+ return &bpf_sk_cgroup_id_proto;
	6202	+ case BPF_FUNC_sk_ancestor_cgroup_id:
	6203	+ return &bpf_sk_ancestor_cgroup_id_proto;
6160	6204	#endif
6161	6205	#ifdef CONFIG_INET
	6206	+ case BPF_FUNC_sk_lookup_tcp:
	6207	+ return &bpf_sk_lookup_tcp_proto;
	6208	+ case BPF_FUNC_sk_lookup_udp:
	6209	+ return &bpf_sk_lookup_udp_proto;
	6210	+ case BPF_FUNC_sk_release:
	6211	+ return &bpf_sk_release_proto;
	6212	+ case BPF_FUNC_skc_lookup_tcp:
	6213	+ return &bpf_skc_lookup_tcp_proto;
6162	6214	case BPF_FUNC_tcp_sock:
6163	6215	return &bpf_tcp_sock_proto;
6164	6216	case BPF_FUNC_get_listener_sock:

tools/include/uapi/linux/bpf.h+35−1

@@ -3121,6 +3121,38 @@ union bpf_attr { · 3120 unmodified lines
3121	3121	* 0 on success, or a negative error in case of failure:
3122	3122	*
3123	3123	* -EOVERFLOW if an overflow happened: The same object will be tried again.
	3124	+ *
	3125	+ * u64 bpf_sk_cgroup_id(struct bpf_sock *sk)
	3126	+ * Description
	3127	+ * Return the cgroup v2 id of the socket sk.
	3128	+ *
	3129	+ * sk must be a non-NULL pointer to a full socket, e.g. one
	3130	+ * returned from bpf_sk_lookup_xxx\ (),
	3131	+ * bpf_sk_fullsock\ (), etc. The format of returned id is
	3132	+ * same as in bpf_skb_cgroup_id\ ().
	3133	+ *
	3134	+ * This helper is available only if the kernel was compiled with
	3135	+ * the CONFIG_SOCK_CGROUP_DATA configuration option.
	3136	+ * Return
	3137	+ * The id is returned or 0 in case the id could not be retrieved.
	3138	+ *
	3139	+ * u64 bpf_sk_ancestor_cgroup_id(struct bpf_sock *sk, int ancestor_level)
	3140	+ * Description
	3141	+ * Return id of cgroup v2 that is ancestor of cgroup associated
	3142	+ * with the sk at the ancestor_level. The root cgroup is at
	3143	+ * ancestor_level zero and each step down the hierarchy
	3144	+ * increments the level. If ancestor_level == level of cgroup
	3145	+ * associated with sk, then return value will be same as that
	3146	+ * of bpf_sk_cgroup_id\ ().
	3147	+ *
	3148	+ * The helper is useful to implement policies based on cgroups
	3149	+ * that are upper in hierarchy than immediate cgroup associated
	3150	+ * with sk.
	3151	+ *
	3152	+ * The format of returned id and helper limitations are same as in
	3153	+ * bpf_sk_cgroup_id\ ().
	3154	+ * Return
	3155	+ * The id is returned or 0 in case the id could not be retrieved.
3124	3156	*/
3125	3157	#define __BPF_FUNC_MAPPER(FN) \
3126	3158	FN(unspec), \
@@ -3250,7 +3282,9 @@ union bpf_attr { · 123 unmodified lines
3250	3282	FN(sk_assign), \
3251	3283	FN(ktime_get_boot_ns), \
3252	3284	FN(seq_printf), \
3253		− FN(seq_write),
	3285	+ FN(seq_write), \
	3286	+ FN(sk_cgroup_id), \
	3287	+ FN(sk_ancestor_cgroup_id),
3254	3288
3255	3289	/* integer value in 'imm' field of BPF_CALL instruction selects which helper
3256	3290	* function eBPF program intends to call

tools/testing/selftests/bpf/network_helpers.c+61−13

@@ -4,10 +4,14 @@ · 3 unmodified lines
4	4	#include <stdio.h>
5	5	#include <string.h>
6	6	#include <unistd.h>
	7	+
	8	+#include <sys/epoll.h>
	9	+
7	10	#include <linux/err.h>
8	11	#include <linux/in.h>
9	12	#include <linux/in6.h>
10	13
	14	+#include "bpf_util.h"
11	15	#include "network_helpers.h"
12	16
13	17	#define clean_errno() (errno == 0 ? "None" : strerror(errno))
@@ -77,9 +81,7 @@ static const size_t timeo_optlen = sizeof(timeo_sec); · 63 unmodified lines
77	81
78	82	int connect_to_fd(int family, int type, int server_fd)
79	83	{
80		− struct sockaddr_storage addr;
81		− socklen_t len = sizeof(addr);
82		− int fd;
	84	+ int fd, save_errno;
83	85
84	86	fd = socket(family, type, 0);
85	87	if (fd < 0) {
@@ -87,24 +89,70 @@ int connect_to_fd(int family, int type, int server_fd) · 1 unmodified line
87	89	return -1;
88	90	}
89	91
90		− if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo_sec, timeo_optlen)) {
	92	+ if (connect_fd_to_fd(fd, server_fd) < 0 && errno != EINPROGRESS) {
	93	+ save_errno = errno;
	94	+ close(fd);
	95	+ errno = save_errno;
	96	+ return -1;
	97	+ }
	98	+
	99	+ return fd;
	100	+}
	101	+
	102	+int connect_fd_to_fd(int client_fd, int server_fd)
	103	+{
	104	+ struct sockaddr_storage addr;
	105	+ socklen_t len = sizeof(addr);
	106	+ int save_errno;
	107	+
	108	+ if (setsockopt(client_fd, SOL_SOCKET, SO_RCVTIMEO, &timeo_sec,
	109	+ timeo_optlen)) {
91	110	log_err("Failed to set SO_RCVTIMEO");
92		− goto out;
	111	+ return -1;
93	112	}
94	113
95	114	if (getsockname(server_fd, (struct sockaddr *)&addr, &len)) {
96	115	log_err("Failed to get server addr");
97		− goto out;
	116	+ return -1;
98	117	}
99	118
100		− if (connect(fd, (const struct sockaddr *)&addr, len) < 0) {
101		− log_err("Fail to connect to server with family %d", family);
102		− goto out;
	119	+ if (connect(client_fd, (const struct sockaddr *)&addr, len) < 0) {
	120	+ if (errno != EINPROGRESS) {
	121	+ save_errno = errno;
	122	+ log_err("Failed to connect to server");
	123	+ errno = save_errno;
	124	+ }
	125	+ return -1;
103	126	}
104	127
105		− return fd;
	128	+ return 0;
	129	+}
	130	+
	131	+int connect_wait(int fd)
	132	+{
	133	+ struct epoll_event ev = {}, events[2];
	134	+ int timeout_ms = 1000;
	135	+ int efd, nfd;
	136	+
	137	+ efd = epoll_create1(EPOLL_CLOEXEC);
	138	+ if (efd < 0) {
	139	+ log_err("Failed to open epoll fd");
	140	+ return -1;
	141	+ }
	142	+
	143	+ ev.events = EPOLLRDHUP \| EPOLLOUT;
	144	+ ev.data.fd = fd;
	145	+
	146	+ if (epoll_ctl(efd, EPOLL_CTL_ADD, fd, &ev) < 0) {
	147	+ log_err("Failed to register fd=%d on epoll fd=%d", fd, efd);
	148	+ close(efd);
	149	+ return -1;
	150	+ }
	151	+
	152	+ nfd = epoll_wait(efd, events, ARRAY_SIZE(events), timeout_ms);
	153	+ if (nfd < 0)
	154	+ log_err("Failed to wait for I/O event on epoll fd=%d", efd);
106	155
107		−out:
108		− close(fd);
109		− return -1;
	156	+ close(efd);
	157	+ return nfd;
110	158	}

tools/testing/selftests/bpf/network_helpers.h+2−0

@@ -35,5 +35,7 @@ extern struct ipv6_packet pkt_v6; · 34 unmodified lines
35	35
36	36	int start_server(int family, int type);
37	37	int connect_to_fd(int family, int type, int server_fd);
	38	+int connect_fd_to_fd(int client_fd, int server_fd);
	39	+int connect_wait(int client_fd);
38	40
39	41	#endif

tools/testing/selftests/bpf/prog_tests/cgroup_skb_sk_lookup.c+95−0

@@ -0,0 +1,95 @@
	1	+// SPDX-License-Identifier: GPL-2.0
	2	+// Copyright (c) 2020 Facebook
	3	+
	4	+#include <test_progs.h>
	5	+
	6	+#include "network_helpers.h"
	7	+#include "cgroup_skb_sk_lookup_kern.skel.h"
	8	+
	9	+static void run_lookup_test(__u16 *g_serv_port, int out_sk)
	10	+{
	11	+ int serv_sk = -1, in_sk = -1, serv_in_sk = -1, err;
	12	+ struct sockaddr_in6 addr = {};
	13	+ socklen_t addr_len = sizeof(addr);
	14	+ __u32 duration = 0;
	15	+
	16	+ serv_sk = start_server(AF_INET6, SOCK_STREAM);
	17	+ if (CHECK(serv_sk < 0, "start_server", "failed to start server\n"))
	18	+ return;
	19	+
	20	+ err = getsockname(serv_sk, (struct sockaddr *)&addr, &addr_len);
	21	+ if (CHECK(err, "getsockname", "errno %d\n", errno))
	22	+ goto cleanup;
	23	+
	24	+ *g_serv_port = addr.sin6_port;
	25	+
	26	+ /* Client outside of test cgroup should fail to connect by timeout. */
	27	+ err = connect_fd_to_fd(out_sk, serv_sk);
	28	+ if (CHECK(!err \|\| errno != EINPROGRESS, "connect_fd_to_fd",
	29	+ "unexpected result err %d errno %d\n", err, errno))
	30	+ goto cleanup;
	31	+
	32	+ err = connect_wait(out_sk);
	33	+ if (CHECK(err, "connect_wait", "unexpected result %d\n", err))
	34	+ goto cleanup;
	35	+
	36	+ /* Client inside test cgroup should connect just fine. */
	37	+ in_sk = connect_to_fd(AF_INET6, SOCK_STREAM, serv_sk);
	38	+ if (CHECK(in_sk < 0, "connect_to_fd", "errno %d\n", errno))
	39	+ goto cleanup;
	40	+
	41	+ serv_in_sk = accept(serv_sk, NULL, NULL);
	42	+ if (CHECK(serv_in_sk < 0, "accept", "errno %d\n", errno))
	43	+ goto cleanup;
	44	+
	45	+cleanup:
	46	+ close(serv_in_sk);
	47	+ close(in_sk);
	48	+ close(serv_sk);
	49	+}
	50	+
	51	+static void run_cgroup_bpf_test(const char *cg_path, int out_sk)
	52	+{
	53	+ struct cgroup_skb_sk_lookup_kern *skel;
	54	+ struct bpf_link *link;
	55	+ __u32 duration = 0;
	56	+ int cgfd = -1;
	57	+
	58	+ skel = cgroup_skb_sk_lookup_kern__open_and_load();
	59	+ if (CHECK(!skel, "skel_open_load", "open_load failed\n"))
	60	+ return;
	61	+
	62	+ cgfd = test__join_cgroup(cg_path);
	63	+ if (CHECK(cgfd < 0, "cgroup_join", "cgroup setup failed\n"))
	64	+ goto cleanup;
	65	+
	66	+ link = bpf_program__attach_cgroup(skel->progs.ingress_lookup, cgfd);
	67	+ if (CHECK(IS_ERR(link), "cgroup_attach", "err: %ld\n", PTR_ERR(link)))
	68	+ goto cleanup;
	69	+
	70	+ run_lookup_test(&skel->bss->g_serv_port, out_sk);
	71	+
	72	+ bpf_link__destroy(link);
	73	+
	74	+cleanup:
	75	+ close(cgfd);
	76	+ cgroup_skb_sk_lookup_kern__destroy(skel);
	77	+}
	78	+
	79	+void test_cgroup_skb_sk_lookup(void)
	80	+{
	81	+ const char *cg_path = "/foo";
	82	+ int out_sk;
	83	+
	84	+ /* Create a socket before joining testing cgroup so that its cgroup id
	85	+ * differs from that of testing cgroup. Moving selftests process to
	86	+ * testing cgroup won't change cgroup id of an already created socket.
	87	+ */
	88	+ out_sk = socket(AF_INET6, SOCK_STREAM \| SOCK_NONBLOCK, 0);
	89	+ if (CHECK_FAIL(out_sk < 0))
	90	+ return;
	91	+
	92	+ run_cgroup_bpf_test(cg_path, out_sk);
	93	+
	94	+ close(out_sk);
	95	+}

tools/testing/selftests/bpf/progs/cgroup_skb_sk_lookup_kern.c+97−0

@@ -0,0 +1,97 @@
	1	+// SPDX-License-Identifier: GPL-2.0
	2	+// Copyright (c) 2020 Facebook
	3	+
	4	+#include <linux/bpf.h>
	5	+#include <bpf/bpf_endian.h>
	6	+#include <bpf/bpf_helpers.h>
	7	+
	8	+#include <linux/if_ether.h>
	9	+#include <linux/in.h>
	10	+#include <linux/in6.h>
	11	+#include <linux/ipv6.h>
	12	+#include <linux/tcp.h>
	13	+
	14	+#include <sys/types.h>
	15	+#include <sys/socket.h>
	16	+
	17	+int _version SEC("version") = 1;
	18	+char _license[] SEC("license") = "GPL";
	19	+
	20	+__u16 g_serv_port = 0;
	21	+
	22	+static inline void set_ip(__u32 dst, const struct in6_addr src)
	23	+{
	24	+ dst[0] = src->in6_u.u6_addr32[0];
	25	+ dst[1] = src->in6_u.u6_addr32[1];
	26	+ dst[2] = src->in6_u.u6_addr32[2];
	27	+ dst[3] = src->in6_u.u6_addr32[3];
	28	+}
	29	+
	30	+static inline void set_tuple(struct bpf_sock_tuple *tuple,
	31	+ const struct ipv6hdr *ip6h,
	32	+ const struct tcphdr *tcph)
	33	+{
	34	+ set_ip(tuple->ipv6.saddr, &ip6h->daddr);
	35	+ set_ip(tuple->ipv6.daddr, &ip6h->saddr);
	36	+ tuple->ipv6.sport = tcph->dest;
	37	+ tuple->ipv6.dport = tcph->source;
	38	+}
	39	+
	40	+static inline int is_allowed_peer_cg(struct __sk_buff *skb,
	41	+ const struct ipv6hdr *ip6h,
	42	+ const struct tcphdr *tcph)
	43	+{
	44	+ __u64 cgid, acgid, peer_cgid, peer_acgid;
	45	+ struct bpf_sock_tuple tuple;
	46	+ size_t tuple_len = sizeof(tuple.ipv6);
	47	+ struct bpf_sock *peer_sk;
	48	+
	49	+ set_tuple(&tuple, ip6h, tcph);
	50	+
	51	+ peer_sk = bpf_sk_lookup_tcp(skb, &tuple, tuple_len,
	52	+ BPF_F_CURRENT_NETNS, 0);
	53	+ if (!peer_sk)
	54	+ return 0;
	55	+
	56	+ cgid = bpf_skb_cgroup_id(skb);
	57	+ peer_cgid = bpf_sk_cgroup_id(peer_sk);
	58	+
	59	+ acgid = bpf_skb_ancestor_cgroup_id(skb, 2);
	60	+ peer_acgid = bpf_sk_ancestor_cgroup_id(peer_sk, 2);
	61	+
	62	+ bpf_sk_release(peer_sk);
	63	+
	64	+ return cgid && cgid == peer_cgid && acgid && acgid == peer_acgid;
	65	+}
	66	+
	67	+SEC("cgroup_skb/ingress")
	68	+int ingress_lookup(struct __sk_buff *skb)
	69	+{
	70	+ __u32 serv_port_key = 0;
	71	+ struct ipv6hdr ip6h;
	72	+ struct tcphdr tcph;
	73	+
	74	+ if (skb->protocol != bpf_htons(ETH_P_IPV6))
	75	+ return 1;
	76	+
	77	+ /* For SYN packets coming to listening socket skb->remote_port will be
	78	+ * zero, so IPv6/TCP headers are loaded to identify remote peer
	79	+ * instead.
	80	+ */
	81	+ if (bpf_skb_load_bytes(skb, 0, &ip6h, sizeof(ip6h)))
	82	+ return 1;
	83	+
	84	+ if (ip6h.nexthdr != IPPROTO_TCP)
	85	+ return 1;
	86	+
	87	+ if (bpf_skb_load_bytes(skb, sizeof(ip6h), &tcph, sizeof(tcph)))
	88	+ return 1;
	89	+
	90	+ if (!g_serv_port)
	91	+ return 0;
	92	+
	93	+ if (tcph.dest != g_serv_port)
	94	+ return 1;
	95	+
	96	+ return is_allowed_peer_cg(skb, &ip6h, &tcph);
	97	+}