Re: [PATCH net-next 2/3] bpf: Add new cgroups prog type to enable sock modifications
From: David Ahern <hidden>
Date: 2016-10-26 20:42:12
On 10/26/16 2:31 PM, Mahesh Bandewar (महेश बंडेवार) wrote:
The hook insertion in sk_alloc() may not solve all control-path checks as not much can be done (probably apart for changing sk_bound_dev_if) during allocation but hooks in bind(), listen(), setsockopt() etc. (not a complete list) will be needed. Also pushing this change (changing sk_bound_dev_if) later (than sk_alloc()) you might avoid the case dumazet@ has mentioned.
For v2 I moved the running of the filter to the end of inet{6}_create.