Commit 303def35 authored by John Fastabend's avatar John Fastabend Committed by Daniel Borkmann
Browse files

bpf: allow sk_msg programs to read sock fields 



Currently sk_msg programs only have access to the raw data. However,
it is often useful when building policies to have the policies specific
to the socket endpoint. This allows using the socket tuple as input
into filters, etc.

This patch adds ctx access to the sock fields.

Signed-off-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 1cb61381

include/linux/filter.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -517,6 +517,7 @@ struct sk_msg_buff { 
	bool sg_copy[MAX_SKB_FRAGS];

	bool sg_copy[MAX_SKB_FRAGS];

	__u32 flags;

	__u32 flags;

	struct sock *sk_redir;

	struct sock *sk_redir;

	struct sock *sk;

	struct sk_buff *skb;

	struct sk_buff *skb;

	struct list_head list;

	struct list_head list;

};

};

include/uapi/linux/bpf.h

+8 −0
Original line number Original line Diff line number Diff line
@@ -2176,6 +2176,14 @@ enum sk_action { 
struct sk_msg_md {

struct sk_msg_md {

	void *data;

	void *data;

	void *data_end;

	void *data_end;



	__u32 family;

	__u32 remote_ip4;	/* Stored in network byte order */

	__u32 local_ip4;	/* Stored in network byte order */

	__u32 remote_ip6[4];	/* Stored in network byte order */

	__u32 local_ip6[4];	/* Stored in network byte order */

	__u32 remote_port;	/* Stored in network byte order */

	__u32 local_port;	/* stored in host byte order */

};

};





#define BPF_TAG_SIZE	8

#define BPF_TAG_SIZE	8

kernel/bpf/sockmap.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -523,6 +523,7 @@ static unsigned int smap_do_tx_msg(struct sock *sk, 
	}

	}





	bpf_compute_data_pointers_sg(md);

	bpf_compute_data_pointers_sg(md);

	md->sk = sk;

	rc = (*prog->bpf_func)(md, prog->insnsi);

	rc = (*prog->bpf_func)(md, prog->insnsi);

	psock->apply_bytes = md->apply_bytes;

	psock->apply_bytes = md->apply_bytes;

net/core/filter.c

+111 −3
Original line number Original line Diff line number Diff line
@@ -5148,18 +5148,23 @@ static bool sk_msg_is_valid_access(int off, int size, 
	switch (off) {

	switch (off) {

	case offsetof(struct sk_msg_md, data):

	case offsetof(struct sk_msg_md, data):

		info->reg_type = PTR_TO_PACKET;

		info->reg_type = PTR_TO_PACKET;

		if (size != sizeof(__u64))

			return false;

		break;

		break;

	case offsetof(struct sk_msg_md, data_end):

	case offsetof(struct sk_msg_md, data_end):

		info->reg_type = PTR_TO_PACKET_END;

		info->reg_type = PTR_TO_PACKET_END;

		if (size != sizeof(__u64))

			return false;

		break;

		break;

	default:

		if (size != sizeof(__u32))

			return false;

	}

	}





	if (off < 0 || off >= sizeof(struct sk_msg_md))

	if (off < 0 || off >= sizeof(struct sk_msg_md))

		return false;

		return false;

	if (off % size != 0)

	if (off % size != 0)

		return false;

		return false;

	if (size != sizeof(__u64))

		return false;





	return true;

	return true;

}

}
@@ -5835,7 +5840,8 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type, 
		break;

		break;





	case offsetof(struct bpf_sock_ops, local_ip4):

	case offsetof(struct bpf_sock_ops, local_ip4):

		BUILD_BUG_ON(FIELD_SIZEOF(struct sock_common, skc_rcv_saddr) != 4);

		BUILD_BUG_ON(FIELD_SIZEOF(struct sock_common,

					  skc_rcv_saddr) != 4);





		*insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(

		*insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(

					      struct bpf_sock_ops_kern, sk),

					      struct bpf_sock_ops_kern, sk),
@@ -6152,6 +6158,7 @@ static u32 sk_msg_convert_ctx_access(enum bpf_access_type type, 
				     struct bpf_prog *prog, u32 *target_size)

				     struct bpf_prog *prog, u32 *target_size)

{

{

	struct bpf_insn *insn = insn_buf;

	struct bpf_insn *insn = insn_buf;

	int off;





	switch (si->off) {

	switch (si->off) {

	case offsetof(struct sk_msg_md, data):

	case offsetof(struct sk_msg_md, data):
@@ -6164,6 +6171,107 @@ static u32 sk_msg_convert_ctx_access(enum bpf_access_type type, 
				      si->dst_reg, si->src_reg,

				      si->dst_reg, si->src_reg,

				      offsetof(struct sk_msg_buff, data_end));

				      offsetof(struct sk_msg_buff, data_end));

		break;

		break;

	case offsetof(struct sk_msg_md, family):

		BUILD_BUG_ON(FIELD_SIZEOF(struct sock_common, skc_family) != 2);



		*insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(

					      struct sk_msg_buff, sk),

				      si->dst_reg, si->src_reg,

				      offsetof(struct sk_msg_buff, sk));

		*insn++ = BPF_LDX_MEM(BPF_H, si->dst_reg, si->dst_reg,

				      offsetof(struct sock_common, skc_family));

		break;



	case offsetof(struct sk_msg_md, remote_ip4):

		BUILD_BUG_ON(FIELD_SIZEOF(struct sock_common, skc_daddr) != 4);



		*insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(

						struct sk_msg_buff, sk),

				      si->dst_reg, si->src_reg,

				      offsetof(struct sk_msg_buff, sk));

		*insn++ = BPF_LDX_MEM(BPF_W, si->dst_reg, si->dst_reg,

				      offsetof(struct sock_common, skc_daddr));

		break;



	case offsetof(struct sk_msg_md, local_ip4):

		BUILD_BUG_ON(FIELD_SIZEOF(struct sock_common,

					  skc_rcv_saddr) != 4);



		*insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(

					      struct sk_msg_buff, sk),

				      si->dst_reg, si->src_reg,

				      offsetof(struct sk_msg_buff, sk));

		*insn++ = BPF_LDX_MEM(BPF_W, si->dst_reg, si->dst_reg,

				      offsetof(struct sock_common,

					       skc_rcv_saddr));

		break;



	case offsetof(struct sk_msg_md, remote_ip6[0]) ...

	     offsetof(struct sk_msg_md, remote_ip6[3]):

#if IS_ENABLED(CONFIG_IPV6)

		BUILD_BUG_ON(FIELD_SIZEOF(struct sock_common,

					  skc_v6_daddr.s6_addr32[0]) != 4);



		off = si->off;

		off -= offsetof(struct sk_msg_md, remote_ip6[0]);

		*insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(

						struct sk_msg_buff, sk),

				      si->dst_reg, si->src_reg,

				      offsetof(struct sk_msg_buff, sk));

		*insn++ = BPF_LDX_MEM(BPF_W, si->dst_reg, si->dst_reg,

				      offsetof(struct sock_common,

					       skc_v6_daddr.s6_addr32[0]) +

				      off);

#else

		*insn++ = BPF_MOV32_IMM(si->dst_reg, 0);

#endif

		break;



	case offsetof(struct sk_msg_md, local_ip6[0]) ...

	     offsetof(struct sk_msg_md, local_ip6[3]):

#if IS_ENABLED(CONFIG_IPV6)

		BUILD_BUG_ON(FIELD_SIZEOF(struct sock_common,

					  skc_v6_rcv_saddr.s6_addr32[0]) != 4);



		off = si->off;

		off -= offsetof(struct sk_msg_md, local_ip6[0]);

		*insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(

						struct sk_msg_buff, sk),

				      si->dst_reg, si->src_reg,

				      offsetof(struct sk_msg_buff, sk));

		*insn++ = BPF_LDX_MEM(BPF_W, si->dst_reg, si->dst_reg,

				      offsetof(struct sock_common,

					       skc_v6_rcv_saddr.s6_addr32[0]) +

				      off);

#else

		*insn++ = BPF_MOV32_IMM(si->dst_reg, 0);

#endif

		break;



	case offsetof(struct sk_msg_md, remote_port):

		BUILD_BUG_ON(FIELD_SIZEOF(struct sock_common, skc_dport) != 2);



		*insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(

						struct sk_msg_buff, sk),

				      si->dst_reg, si->src_reg,

				      offsetof(struct sk_msg_buff, sk));

		*insn++ = BPF_LDX_MEM(BPF_H, si->dst_reg, si->dst_reg,

				      offsetof(struct sock_common, skc_dport));

#ifndef __BIG_ENDIAN_BITFIELD

		*insn++ = BPF_ALU32_IMM(BPF_LSH, si->dst_reg, 16);

#endif

		break;



	case offsetof(struct sk_msg_md, local_port):

		BUILD_BUG_ON(FIELD_SIZEOF(struct sock_common, skc_num) != 2);



		*insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(

						struct sk_msg_buff, sk),

				      si->dst_reg, si->src_reg,

				      offsetof(struct sk_msg_buff, sk));

		*insn++ = BPF_LDX_MEM(BPF_H, si->dst_reg, si->dst_reg,

				      offsetof(struct sock_common, skc_num));

		break;

	}

	}





	return insn - insn_buf;

	return insn - insn_buf;

CRA Git | Maintained and supported by SUSTech CRA and CCSE