From: Daniel Mack <dan...@zonque.org>
Date: Tue, 25 Oct 2016 12:14:13 +0200
> @@ -312,6 +314,13 @@ int ip_mc_output(struct net *net, struct sock *sk,
> struct sk_buff *skb)
> skb->dev = dev;
> skb->protocol = htons(ETH_P_IP);
>
> + ret = cgroup_bpf_run_filter(sk_to_full_sk(sk), skb,
> + BPF_CGROUP_INET_EGRESS);
> + if (ret) {
> + kfree_skb(skb);
> + return ret;
> + }
> +
> /*
> * Multicasts are looped back for other local users
> */
> @@ -364,12 +373,20 @@ int ip_mc_output(struct net *net, struct sock *sk,
> struct sk_buff *skb)
> int ip_output(struct net *net, struct sock *sk, struct sk_buff *skb)
> {
> struct net_device *dev = skb_dst(skb)->dev;
> + int ret;
>
> IP_UPD_PO_STATS(net, IPSTATS_MIB_OUT, skb->len);
>
> skb->dev = dev;
> skb->protocol = htons(ETH_P_IP);
>
> + ret = cgroup_bpf_run_filter(sk_to_full_sk(sk), skb,
> + BPF_CGROUP_INET_EGRESS);
> + if (ret) {
> + kfree_skb(skb);
> + return ret;
> + }
> +
> return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
> net, sk, skb, NULL, dev,
> ip_finish_output,
The "sk" here is not necessarily the application socket. It could be
a UDP tunnel socket or similar encapsulation object.
"skb->sk" is always the application socket, so is probably what you
need to pass down into the cgroup bpf run filter hook.
