bpf/progs/bind_perm.c

0001 // SPDX-License-Identifier: GPL-2.0
0002
0003 #include <linux/stddef.h>
0004 #include <linux/bpf.h>
0005 #include <sys/types.h>
0006 #include <sys/socket.h>
0007 #include <bpf/bpf_helpers.h>
0008 #include <bpf/bpf_endian.h>
0009
0010 static __always_inline int bind_prog(struct bpf_sock_addr *ctx, int family)
0011 {
0012     struct bpf_sock *sk;
0013
0014     sk = ctx->sk;
0015     if (!sk)
0016         return 0;
0017
0018     if (sk->family != family)
0019         return 0;
0020
0021     if (ctx->type != SOCK_STREAM)
0022         return 0;
0023
0024     /* Return 1 OR'ed with the first bit set to indicate
0025      * that CAP_NET_BIND_SERVICE should be bypassed.
0026      */
0027     if (ctx->user_port == bpf_htons(111))
0028         return (1 | 2);
0029
0030     return 1;
0031 }
0032
0033 SEC("cgroup/bind4")
0034 int bind_v4_prog(struct bpf_sock_addr *ctx)
0035 {
0036     return bind_prog(ctx, AF_INET);
0037 }
0038
0039 SEC("cgroup/bind6")
0040 int bind_v6_prog(struct bpf_sock_addr *ctx)
0041 {
0042     return bind_prog(ctx, AF_INET6);
0043 }
0044
0045 char _license[] SEC("license") = "GPL";