1

BPF_PROG_TYPE_SOCK_OPS is a BPF program type which is called when a set of actions is performed on a TCP socket.

Right now, I am using it to mark TCP sockets that are trying to connect with an fwmark.

I want to do the same for UDP sockets, but unfortunately the BPF_PROG_TYPE_SOCK_OPS probe is not called on UDP packets.

Is there an equivalent?

Anonymous Rust Programmer
  • 15
  • 5

1 Answers1

0

UDP sockets don't really connect, so similar event to trigger on. Closest thing would be to trigger on socket creation with the use of a BPF_PROG_TYPE_CGROUP_SOCK program.

You can also find a list of all BPF sockets here. Since you want to set a socket option, you can also look at the man page of the bpf helpers. For bpf_setsockopt, you will find a list of attach points for which this helper will be available. Note though that for some BPF probes, you can also edit the socket mark directly (e.g. BPF_CGROUP_INET_SOCK_CREATE) without calling the helper function.

Anonymous Rust Programmer
  • 15
  • 5
Dylan Reimerink
  • 5,874
  • 2
  • 15
  • 21
  • Thank you for your answer! I ended up using `BPF_PROG_TYPE_CGROUP_SOCK` like you suggested. I was surprised that it's possible to edit the socket mark directly in the struct, without calling the BPF helper for that. – Anonymous Rust Programmer Jul 22 '23 at 19:00