12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394 |
- #include "netd.h"
- #include <linux/bpf.h>
- #include <linux/if_packet.h>
- SEC("cgroupskb/ingress/stats")
- int bpf_cgroup_ingress(struct __sk_buff* skb) {
- return bpf_traffic_account(skb, BPF_INGRESS);
- }
- SEC("cgroupskb/egress/stats")
- int bpf_cgroup_egress(struct __sk_buff* skb) {
- return bpf_traffic_account(skb, BPF_EGRESS);
- }
- SEC("skfilter/egress/xtbpf")
- int xt_bpf_egress_prog(struct __sk_buff* skb) {
- uint32_t key = skb->ifindex;
- update_iface_stats_map(skb, BPF_EGRESS, &key);
- return BPF_MATCH;
- }
- SEC("skfilter/ingress/xtbpf")
- int xt_bpf_ingress_prog(struct __sk_buff* skb) {
- uint32_t key = skb->ifindex;
- update_iface_stats_map(skb, BPF_INGRESS, &key);
- return BPF_MATCH;
- }
- SEC("skfilter/whitelist/xtbpf")
- int xt_bpf_whitelist_prog(struct __sk_buff* skb) {
- uint32_t sock_uid = bpf_get_socket_uid(skb);
- if (is_system_uid(sock_uid)) return BPF_MATCH;
-
-
-
-
- if ((sock_uid == 65534) && !bpf_get_socket_cookie(skb) &&
- (skb->pkt_type == PACKET_HOST || skb->pkt_type == PACKET_BROADCAST ||
- skb->pkt_type == PACKET_MULTICAST))
- return BPF_MATCH;
- UidOwnerValue* whitelistMatch = bpf_uid_owner_map_lookup_elem(&sock_uid);
- if (whitelistMatch) return whitelistMatch->rule & HAPPY_BOX_MATCH ? BPF_MATCH : BPF_NOMATCH;
- return BPF_NOMATCH;
- }
- SEC("skfilter/blacklist/xtbpf")
- int xt_bpf_blacklist_prog(struct __sk_buff* skb) {
- uint32_t sock_uid = bpf_get_socket_uid(skb);
- UidOwnerValue* blacklistMatch = bpf_uid_owner_map_lookup_elem(&sock_uid);
- if (blacklistMatch) return blacklistMatch->rule & PENALTY_BOX_MATCH ? BPF_MATCH : BPF_NOMATCH;
- return BPF_NOMATCH;
- }
- DEFINE_BPF_MAP(uid_permission_map, HASH, uint32_t, uint8_t, UID_OWNER_MAP_SIZE)
- SEC("cgroupsock/inet/create")
- int inet_socket_create(struct bpf_sock* sk) {
- uint64_t gid_uid = bpf_get_current_uid_gid();
-
- uint32_t appId = (gid_uid & 0xffffffff) % PER_USER_RANGE;
- uint8_t* permissions = bpf_uid_permission_map_lookup_elem(&appId);
- if (!permissions) {
-
- return 1;
- }
-
- return (*permissions & BPF_PERMISSION_INTERNET) == BPF_PERMISSION_INTERNET;
- }
- char _license[] SEC("license") = "Apache 2.0";
|