Skip to content

Commit fbdef16

Browse files
ebpf: obtain udpv6 source IP in more scenarios
Following the previous change 20a03e1, now we obtain the source IP for UDPv6 connections with it's set in an ancillary message.
1 parent 20a03e1 commit fbdef16

File tree

1 file changed

+6
-5
lines changed

1 file changed

+6
-5
lines changed

ebpf_prog/opensnitch.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -313,11 +313,12 @@ int kprobe__udpv6_sendmsg(struct pt_regs *ctx)
313313
bpf_probe_read(&udpv6_key.sport, sizeof(udpv6_key.sport), &sk->__sk_common.skc_num);
314314
bpf_probe_read(&udpv6_key.saddr, sizeof(udpv6_key.saddr), &sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
315315

316-
// TODO: obtain IPs from ancillary messages if daddr == 0 || saddr == 0
317-
// https://elixir.bootlin.com/linux/v4.4.60/source/net/ipv4/ip_sockglue.c#L224
318-
//
319-
// IPV6_PKTINFO, in6_pktinfo
320-
316+
if (udpv6_key.saddr.part1 == 0){
317+
u64 cmsg=0;
318+
bpf_probe_read(&cmsg, sizeof(cmsg), &msg->msg_control);
319+
struct in6_pktinfo *inpkt = (struct in6_pktinfo *)CMSG_DATA(cmsg);
320+
bpf_probe_read(&udpv6_key.saddr, sizeof(udpv6_key.saddr), &inpkt->ipi6_addr.s6_addr32);
321+
}
321322

322323
#if defined(__i386__)
323324
struct sock_on_x86_32_t sock;

0 commit comments

Comments
 (0)