Skip to content

Commit 1af46af

Browse files
committed
simplify and split comment for register_native_ipv6_flow
1 parent a7cc097 commit 1af46af

1 file changed

Lines changed: 5 additions & 3 deletions

File tree

  • pkg/security/ebpf/c/include/hooks/network

pkg/security/ebpf/c/include/hooks/network/flow.h

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -695,16 +695,18 @@ __attribute__((always_inline)) int register_connected_flow(struct sock *sk, u64
695695
return 0;
696696
}
697697

698-
// Before Linux 7.0 an IPv6 socket was classified on its first transmit, once its source address and port
699-
// were known. Starting with Linux 7.0 inet6_csk_xmit only calls security_sk_classify_flow on a route miss.
698+
// Before Linux 7.0 an IPv6 socket was classified on its first transmit by security_sk_classify_flow.
699+
// Starting with Linux 7.0, security_sk_classify_flow is only called by inet6_csk_xmit on a route miss,
700+
// so IPv6 sockets need to call this helper to register the corresponding flow.
700701
__attribute__((always_inline)) int register_native_ipv6_flow(struct sock *sk, u64 pid_tgid) {
701-
// IPv4 and ipv4 mapped addresses still reach security_sk_classify_flow with a usable flow
702+
// IPv4 sockets still reach security_sk_classify_flow with a usable flow
702703
if (get_family_from_sock_common((void *)sk) != AF_INET6) {
703704
return 0;
704705
}
705706

706707
u64 addr[2] = {};
707708
bpf_probe_read(&addr, sizeof(addr), &sk->__sk_common.skc_v6_rcv_saddr);
709+
// IPv6 sockets using IPv4 mapped addresses still reach security_sk_classify_flow with a usable flow
708710
if (is_ipv4_mapped_ipv6_addr(addr)) {
709711
return 0;
710712
}

0 commit comments

Comments
 (0)