bpf: Invoke cgroup/connect{4,6} programs for unprivileged ICMP ping
authorYiFei Zhu <zhuyifei@google.com>
Fri, 9 Sep 2022 00:49:39 +0000 (00:49 +0000)
committerMartin KaFai Lau <martin.lau@kernel.org>
Fri, 9 Sep 2022 17:40:45 +0000 (10:40 -0700)
commit0ffe2412531e95a309d7f0bfe985fc4ca4d39de8
tree2c391b0f14d8bdbc1af1726182486400a8151e5a
parent665f5d3577ef43e929d59cf39683037887c351bf
bpf: Invoke cgroup/connect{4,6} programs for unprivileged ICMP ping

Usually when a TCP/UDP connection is initiated, we can bind the socket
to a specific IP attached to an interface in a cgroup/connect hook.
But for pings, this is impossible, as the hook is not being called.

This adds the hook invocation to unprivileged ICMP ping (i.e. ping
sockets created with SOCK_DGRAM IPPROTO_ICMP(V6) as opposed to
SOCK_RAW. Logic is mirrored from UDP sockets where the hook is invoked
during pre_connect, after a check for suficiently sized addr_len.

Signed-off-by: YiFei Zhu <zhuyifei@google.com>
Link: https://lore.kernel.org/r/5764914c252fad4cd134fb6664c6ede95f409412.1662682323.git.zhuyifei@google.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
net/ipv4/ping.c
net/ipv6/ping.c