1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2 
3 /* The SPDX header above is actually correct in claiming this was
4  * LGPL-2.1-or-later, because it is. Since the kernel doesn't consider that
5  * compatible with GPL we will claim this to be GPL however, which should be
6  * fine given that LGPL-2.1-or-later downgrades to GPL if needed.
7  */
8 
9 #include <linux/types.h>
10 
11 /*
12  * Bind rule is matched with socket fields accessible to cgroup/bind{4,6} hook
13  * through bpf_sock_addr struct.
14  * 'address_family' is expected to be one of AF_UNSPEC, AF_INET or AF_INET6.
15  * Matching by family is bypassed for rules with AF_UNSPEC set, which makes the
16  * rest of a rule applicable for both IPv4 and IPv6 addresses.
17  * If matching by family is either successful or bypassed, a rule and a socket
18  * are matched by ip protocol.
19  * If 'protocol' is 0, matching is bypassed.
20  * 'nr_ports' and 'port_min' fields specify a set of ports to match a user port
21  * with.
22  * If 'nr_ports' is 0, matching by port is bypassed, making that rule applicable
23  * for all possible ports, e.g. [1, 65535] range. Thus a rule with
24  * 'address_family', 'protocol' and 'nr_ports' equal to AF_UNSPEC, 0 and 0
25  * correspondingly forms 'allow any' or 'deny any' cases.
26  * For positive 'nr_ports', a user_port lying in a range from 'port_min' to'
27  * 'port_min' + 'nr_ports' exclusively is considered to be a match. 'nr_ports'
28  * equalling to 1 forms a rule for a single port.
29  * Ports are in host order.
30  *
31  * Examples:
32  * AF_UNSPEC, 1, 0, 7777: match IPv4 and IPv6 addresses with 7777 user port;
33  *
34  * AF_INET, 1023, 0, 1: match IPv4 addresses with user port in [1, 1023]
35  * range inclusively;
36  *
37  * AF_INET6, 0, 0, 0: match IPv6 addresses;
38  *
39  * AF_UNSPEC, 0, 0, 0: match IPv4 and IPv6 addresses;
40  *
41  * AF_INET6, IPPROTO_TCP, 0, 0: match IPv6/TCP addresses.
42  */
43 
44 struct socket_bind_rule {
45         __u32 address_family;
46         __u32 protocol;
47         __u16 nr_ports;
48         __u16 port_min;
49 };
50 
51 #define SOCKET_BIND_MAX_RULES 128
52