iovisor / iovisor/bcc

How to use bpf_override_return() on functions NOT in kernel whitelist

Open
#2,485 14 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

We need to be able to allow/disallow tcp_v4_connect() under certain conditions (say for a specific dest port/ip). And since this fn. is not "white listed" function, we cannot use the bpf_overriede_return(). Can someone please clarify why this is the case and how we can accomplish this?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the Linux kernel handling for bpf_override_return() and the tcp_v4_connect() entry point, then review the whitelist rationale and existing BCC guidance. The issue does not define a concrete implementation or test target; done would require establishing and validating a supported approach, or documenting why the requested behavior is not possible.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
networking, operating-systems
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.