[3/3] Add CGROUP_SOCK_ADDR matcher support#465
Open
yaakov-stein wants to merge 8 commits intofacebook:mainfrom
Open
[3/3] Add CGROUP_SOCK_ADDR matcher support#465yaakov-stein wants to merge 8 commits intofacebook:mainfrom
CGROUP_SOCK_ADDR matcher support#465yaakov-stein wants to merge 8 commits intofacebook:mainfrom
Conversation
yaakov-stein
changed the title
CGROUP_SOCK_ADDR matcher supportCGROUP_SOCK_ADDR matcher support
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Claude: review of facebook/bpfilter #465 (2cb9ddc) Must fix
Suggestions
Nits
|
This was referenced Mar 9, 2026
yaakov-stein
force-pushed
the
add_cgroup_sock_addr_matcher_support
branch
from
08ad95f to
d0d91e6
Compare
yaakov-stein
commented
Mar 11, 2026
Separate comparison logic from data loading in matcher codegen. bf_cmp_value, bf_cmp_masked_value, bf_cmp_range, and bf_cmp_bitfield encapsulate the BPF bytecode patterns previously duplicated across ip4.c, ip6.c, tcp.c, udp.c, icmp.c, and meta.c. No behavioral change; emitted bytecode is identical.
Remove ip4.c/h, ip6.c/h, tcp.c/h, udp.c/h, and icmp.c/h by absorbing their loading logic into packet.c. Protocol guards and header loads now go through bf_stub_rule_check_protocol and bf_stub_load_header driven by _bf_matcher_metas, while comparisons use the shared cmp.c functions. This centralises all packet matcher codegen in a single dispatch point, making it straightforward to add new flavor-specific dispatch without touching per-protocol files.
Add BF_FLAVOR_CGROUP_SOCK_ADDR and BF_HOOK_CGROUP_SOCK_ADDR_CONNECT4/CONNECT6 to support BPF_PROG_TYPE_CGROUP_SOCK_ADDR programs. This is the foundational enum/mapping work for sock_addr filtering. All mapping tables (hook strings, flavor, prog_type, attach_type), BPF type constants, link creation, and hookopts are updated. All existing matchers are blocked on the new hooks via unsupported_hooks. Flavor ops are registered as NULL and codegen is added in a follow-up.
Implement bf_flavor_ops for BF_FLAVOR_CGROUP_SOCK_ADDR so chains with a default policy can be loaded and attached to a cgroup.
yaakov-stein
force-pushed
the
add_cgroup_sock_addr_matcher_support
branch
from
d0d91e6 to
8f1a356
Compare
Replace the -ENOTSUP stub with a dispatcher that loads fields from bpf_sock_addr (user_ip4, user_ip6, user_port, protocol) and reuses the shared bf_cmp_*() comparison functions. Update unsupported_hooks to unblock the supported matchers on CONNECT4/CONNECT6 hooks.
yaakov-stein
force-pushed
the
add_cgroup_sock_addr_matcher_support
branch
from
8f1a356 to
2bf98d5
Compare
yaakov-stein
force-pushed
the
add_cgroup_sock_addr_matcher_support
branch
from
2bf98d5 to
a970627
Compare
yaakov-stein
force-pushed
the
add_cgroup_sock_addr_matcher_support
branch
2 times, most recently
from
c4fbebb to
5f658dd
Compare
Introduce a tests/e2e/hooks/ directory for tests that combine dry-run validation with behavioral sandbox testing on a per-hook basis. Each test verifies every supported matcher against actual traffic in an isolated cgroup, rather than only checking dry-run acceptance.
yaakov-stein
force-pushed
the
add_cgroup_sock_addr_matcher_support
branch
from
5f658dd to
2cb9ddc
Compare
qdeslandes
reviewed
Mar 13, 2026
Contributor
qdeslandes
left a comment
qdeslandes
left a comment
There was a problem hiding this comment.
LGTM, waiting for other PRs to be merged before approving.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked PRs:
CGROUP_SOCK_ADDRinitial chain support #459CGROUP_SOCK_ADDRmatcher support #465Completes
CGROUP_SOCK_ADDRsupport (#355) by implementing matcher codegen, per-hook matcher validation, CLI counter semantics, E2E tests, and documentation.Summary
#459 added the
CGROUP_SOCK_ADDRflavor with only default-verdict support and no working matchers. This adds matcher codegen so rules can actually match against fields available in thebpf_sock_addrcontext.Matcher codegen
The
_bf_cgroup_sock_addr_gen_inline_matcher()callback loads fields directly fromstruct bpf_sock_addr(user_ip4/user_ip6,user_port,family,protocol) and delegates to the sharedbf_cmp_*()functions from #464. No packet parsing prologue is needed.Supported matchers:
Unsupported matchers are enforced at validation time via
unsupported_hooksflags inmatcher.c, so invalid rules are rejected before codegen.CLI counter display
CGROUP_SOCK_ADDRhooks interceptconnect()syscalls, not packets. The CLI now printscallsinstead ofpacketsandbytesfor these hooks.E2E tests
New
tests/e2e/hooks/directory for per-hook behavioral tests that combine dry-run validation (supported + unsupported matchers) with sandbox testing in an isolated cgroup. Each supported matcher is verified by attaching a chain and confirming that matching traffic is dropped and, where possible, non-matching traffic passes through. Also addsCGROUP_SOCK_ADDRcoverage tochain_attach.sh.Documentation
Updates
bfcli.rstanddaemon.rst: new hooks in the hooks list, cgpath option, counter semantics,REDIRECTincompatibility, and a connection-level note formeta.probability.Testing
e2e.hooksfor bothCONNECT4andCONNECT6e2e.cli.chain_attachwith newCGROUP_SOCK_ADDRsectione2e.rulesetswith new .bf files for bothCONNECT4andCONNECT6