blob: 32cde5c8e020fc8f4e20470dcaa395a1c4f5bb5f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
/* SPDX-License-Identifier: LGPL-2.1-or-later */
/* <linux/bpf.h> must precede <bpf/bpf_helpers.h> due to integer types
* in bpf helpers signatures.
*/
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
const volatile __u8 is_allow_list = 0;
/* Map containing the network interfaces indexes.
* The interpretation of the map depends on the value of is_allow_list.
*/
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__type(key, __u32);
__type(value, __u8);
} sd_restrictif SEC(".maps");
#define DROP 0
#define PASS 1
static __always_inline int restrict_network_interfaces_impl(const struct __sk_buff *sk) {
__u32 zero = 0, ifindex;
__u8 *lookup_result;
ifindex = sk->ifindex;
lookup_result = bpf_map_lookup_elem(&sd_restrictif, &ifindex);
if (is_allow_list) {
/* allow-list: let the packet pass if iface in the list */
if (lookup_result)
return PASS;
} else {
/* deny-list: let the packet pass if iface *not* in the list */
if (!lookup_result)
return PASS;
}
return DROP;
}
SEC("cgroup_skb/egress")
int sd_restrictif_e(const struct __sk_buff *sk) {
return restrict_network_interfaces_impl(sk);
}
SEC("cgroup_skb/ingress")
int sd_restrictif_i(const struct __sk_buff *sk) {
return restrict_network_interfaces_impl(sk);
}
static const char _license[] SEC("license") = "LGPL-2.1-or-later";
|
