network-programmingebpfbpfsystems-programming

BPF: sock_ops equivalent for UDP sockets


BPF_PROG_TYPE_SOCK_OPS is a BPF program type which is called when a set of actions is performed on a TCP socket.

Right now, I am using it to mark TCP sockets that are trying to connect with an fwmark.

I want to do the same for UDP sockets, but unfortunately the BPF_PROG_TYPE_SOCK_OPS probe is not called on UDP packets.

Is there an equivalent?


Solution

  • UDP sockets don't really connect, so similar event to trigger on. Closest thing would be to trigger on socket creation with the use of a BPF_PROG_TYPE_CGROUP_SOCK program.

    You can also find a list of all BPF sockets here. Since you want to set a socket option, you can also look at the man page of the bpf helpers. For bpf_setsockopt, you will find a list of attach points for which this helper will be available. Note though that for some BPF probes, you can also edit the socket mark directly (e.g. BPF_CGROUP_INET_SOCK_CREATE) without calling the helper function.