1*4882a593Smuzhiyun #include <uapi/linux/bpf.h>
2*4882a593Smuzhiyun #include <linux/socket.h>
3*4882a593Smuzhiyun #include <linux/net.h>
4*4882a593Smuzhiyun #include <uapi/linux/in.h>
5*4882a593Smuzhiyun #include <uapi/linux/in6.h>
6*4882a593Smuzhiyun #include <bpf/bpf_helpers.h>
7*4882a593Smuzhiyun
8*4882a593Smuzhiyun SEC("cgroup/sock1")
bpf_prog1(struct bpf_sock * sk)9*4882a593Smuzhiyun int bpf_prog1(struct bpf_sock *sk)
10*4882a593Smuzhiyun {
11*4882a593Smuzhiyun char fmt[] = "socket: family %d type %d protocol %d\n";
12*4882a593Smuzhiyun char fmt2[] = "socket: uid %u gid %u\n";
13*4882a593Smuzhiyun __u64 gid_uid = bpf_get_current_uid_gid();
14*4882a593Smuzhiyun __u32 uid = gid_uid & 0xffffffff;
15*4882a593Smuzhiyun __u32 gid = gid_uid >> 32;
16*4882a593Smuzhiyun
17*4882a593Smuzhiyun bpf_trace_printk(fmt, sizeof(fmt), sk->family, sk->type, sk->protocol);
18*4882a593Smuzhiyun bpf_trace_printk(fmt2, sizeof(fmt2), uid, gid);
19*4882a593Smuzhiyun
20*4882a593Smuzhiyun /* block PF_INET6, SOCK_RAW, IPPROTO_ICMPV6 sockets
21*4882a593Smuzhiyun * ie., make ping6 fail
22*4882a593Smuzhiyun */
23*4882a593Smuzhiyun if (sk->family == PF_INET6 &&
24*4882a593Smuzhiyun sk->type == SOCK_RAW &&
25*4882a593Smuzhiyun sk->protocol == IPPROTO_ICMPV6)
26*4882a593Smuzhiyun return 0;
27*4882a593Smuzhiyun
28*4882a593Smuzhiyun return 1;
29*4882a593Smuzhiyun }
30*4882a593Smuzhiyun
31*4882a593Smuzhiyun SEC("cgroup/sock2")
bpf_prog2(struct bpf_sock * sk)32*4882a593Smuzhiyun int bpf_prog2(struct bpf_sock *sk)
33*4882a593Smuzhiyun {
34*4882a593Smuzhiyun char fmt[] = "socket: family %d type %d protocol %d\n";
35*4882a593Smuzhiyun
36*4882a593Smuzhiyun bpf_trace_printk(fmt, sizeof(fmt), sk->family, sk->type, sk->protocol);
37*4882a593Smuzhiyun
38*4882a593Smuzhiyun /* block PF_INET, SOCK_RAW, IPPROTO_ICMP sockets
39*4882a593Smuzhiyun * ie., make ping fail
40*4882a593Smuzhiyun */
41*4882a593Smuzhiyun if (sk->family == PF_INET &&
42*4882a593Smuzhiyun sk->type == SOCK_RAW &&
43*4882a593Smuzhiyun sk->protocol == IPPROTO_ICMP)
44*4882a593Smuzhiyun return 0;
45*4882a593Smuzhiyun
46*4882a593Smuzhiyun return 1;
47*4882a593Smuzhiyun }
48*4882a593Smuzhiyun
49*4882a593Smuzhiyun char _license[] SEC("license") = "GPL";
50