5

I found an eBPF sample which proxies requests, which filter which requests to filter based on the target port.

I'm trying to filter by the process_id of the client instead of the target port and tried adding the bpf_get_current_pid_tgid() here. However it seems that the method is not found/available in that context.

How can I find the right method to get the connection owners process_id in this context?

halfer
  • 19,824
  • 17
  • 99
  • 186
Shubham Jain
  • 431
  • 3
  • 13

1 Answers1

2

BPF_PROG_TYPE_SK_LOOKUP programs are invoked at the point where a host knows an incoming connection should be handled by a local socket, but not yet which one. Normally the kernel would look at the IPs and ports the sockets are bound on, but this program type allows us to replace that logic and assign connections to sockets which normally are not allowed. For example to send traffic for a whole /24 to a single socket (bind only allows you to listen on a specific IP or a wildcard, not IP ranges).

So since it is the job of this program type to pick an owner for a connection, there is no PID yet which could be returned. The verifier will reject any program that attempts to use the bpf_get_current_pid_tgid helper in the BPF_PROG_TYPE_SK_LOOKUP program type.

How can I find the right method to get the connection owners process_id in this context?

You are likely looking for another program type which triggers at another location.

halfer
  • 19,824
  • 17
  • 99
  • 186
Dylan Reimerink
  • 5,874
  • 2
  • 15
  • 21
  • thanks @Dylan for discussing this on ebpf slack too! To summarise that conversation, Dylan suggested to add all sockets that we want to redirect to a sockmap, and then fill this sockmap with a secondary BPF program of type `BPF_PROG_TYPE_SK_MSG`. – Shubham Jain Mar 25 '23 at 03:27
  • he also suggested that we can write a `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` and then use the `connect()`, `getpeername()`.. to also achieve the same goal. But we are not sure at this stage if a cgroup would needed around the application (maybe the whole system is also running in a root cgroup?) – Shubham Jain Mar 25 '23 at 03:28
  • please free add anything I missed or misunderstood :) – Shubham Jain Mar 25 '23 at 03:29