Commit 9fed9000 authored by Jakub Sitnicki's avatar Jakub Sitnicki Committed by Daniel Borkmann
Browse files

bpf: Allow selecting reuseport socket from a SOCKMAP/SOCKHASH 



SOCKMAP & SOCKHASH now support storing references to listening
sockets. Nothing keeps us from using these map types a collection of
sockets to select from in BPF reuseport programs. Whitelist the map types
with the bpf_sk_select_reuseport helper.

The restriction that the socket has to be a member of a reuseport group
still applies. Sockets in SOCKMAP/SOCKHASH that don't have sk_reuseport_cb
set are not a valid target and we signal it with -EINVAL.

The main benefit from this change is that, in contrast to
REUSEPORT_SOCKARRAY, SOCK{MAP,HASH} don't impose a restriction that a
listening socket can be just one BPF map at the same time.

Signed-off-by: default avatarJakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20200218171023.844439-9-jakub@cloudflare.com
parent 1d59f3bc

kernel/bpf/verifier.c

+7 −3
Original line number Original line Diff line number Diff line
@@ -3693,14 +3693,16 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env, 
		if (func_id != BPF_FUNC_sk_redirect_map &&

		if (func_id != BPF_FUNC_sk_redirect_map &&

		    func_id != BPF_FUNC_sock_map_update &&

		    func_id != BPF_FUNC_sock_map_update &&

		    func_id != BPF_FUNC_map_delete_elem &&

		    func_id != BPF_FUNC_map_delete_elem &&

		    func_id != BPF_FUNC_msg_redirect_map)

		    func_id != BPF_FUNC_msg_redirect_map &&

		    func_id != BPF_FUNC_sk_select_reuseport)

			goto error;

			goto error;

		break;

		break;

	case BPF_MAP_TYPE_SOCKHASH:

	case BPF_MAP_TYPE_SOCKHASH:

		if (func_id != BPF_FUNC_sk_redirect_hash &&

		if (func_id != BPF_FUNC_sk_redirect_hash &&

		    func_id != BPF_FUNC_sock_hash_update &&

		    func_id != BPF_FUNC_sock_hash_update &&

		    func_id != BPF_FUNC_map_delete_elem &&

		    func_id != BPF_FUNC_map_delete_elem &&

		    func_id != BPF_FUNC_msg_redirect_hash)

		    func_id != BPF_FUNC_msg_redirect_hash &&

		    func_id != BPF_FUNC_sk_select_reuseport)

			goto error;

			goto error;

		break;

		break;

	case BPF_MAP_TYPE_REUSEPORT_SOCKARRAY:

	case BPF_MAP_TYPE_REUSEPORT_SOCKARRAY:
@@ -3774,7 +3776,9 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env, 
			goto error;

			goto error;

		break;

		break;

	case BPF_FUNC_sk_select_reuseport:

	case BPF_FUNC_sk_select_reuseport:

		if (map->map_type != BPF_MAP_TYPE_REUSEPORT_SOCKARRAY)

		if (map->map_type != BPF_MAP_TYPE_REUSEPORT_SOCKARRAY &&

		    map->map_type != BPF_MAP_TYPE_SOCKMAP &&

		    map->map_type != BPF_MAP_TYPE_SOCKHASH)

			goto error;

			goto error;

		break;

		break;

	case BPF_FUNC_map_peek_elem:

	case BPF_FUNC_map_peek_elem:

net/core/filter.c

+10 −5
Original line number Original line Diff line number Diff line
@@ -8620,6 +8620,7 @@ struct sock *bpf_run_sk_reuseport(struct sock_reuseport *reuse, struct sock *sk, 
BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern,

BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern,

	   struct bpf_map *, map, void *, key, u32, flags)

	   struct bpf_map *, map, void *, key, u32, flags)

{

{

	bool is_sockarray = map->map_type == BPF_MAP_TYPE_REUSEPORT_SOCKARRAY;

	struct sock_reuseport *reuse;

	struct sock_reuseport *reuse;

	struct sock *selected_sk;

	struct sock *selected_sk;
@@ -8628,12 +8629,16 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern, 
		return -ENOENT;

		return -ENOENT;





	reuse = rcu_dereference(selected_sk->sk_reuseport_cb);

	reuse = rcu_dereference(selected_sk->sk_reuseport_cb);

	if (!reuse)

	if (!reuse) {

		/* selected_sk is unhashed (e.g. by close()) after the

		/* reuseport_array has only sk with non NULL sk_reuseport_cb.

		 * above map_lookup_elem().  Treat selected_sk has already

		 * The only (!reuse) case here is - the sk has already been

		 * been removed from the map.

		 * unhashed (e.g. by close()), so treat it as -ENOENT.

		 *

		 * Other maps (e.g. sock_map) do not provide this guarantee and

		 * the sk may never be in the reuseport group to begin with.

		 */

		 */

		return -ENOENT;

		return is_sockarray ? -ENOENT : -EINVAL;

	}





	if (unlikely(reuse->reuseport_id != reuse_kern->reuseport_id)) {

	if (unlikely(reuse->reuseport_id != reuse_kern->reuseport_id)) {

		struct sock *sk;

		struct sock *sk;

CRA Git | Maintained and supported by SUSTech CRA and CCSE