Commit f198222f authored by Daniel Borkmann's avatar Daniel Borkmann
Browse files

Merge branch 'bpf-sendmsg-hook' 



Andrey Ignatov says:

====================
v3 -> v4:
* handle static key correctly for CONFIG_CGROUP_BPF=n.

v2 -> v3:
* place BPF logic under static key in udp_sendmsg, udpv6_sendmsg;
* rebase.

v1 -> v2:
* return ENOTSUPP if bpf_prog rewrote IPv6-only with IPv4-mapped IPv6;
* add test for IPv4-mapped IPv6 use-case;
* fix build for CONFIG_CGROUP_BPF=n;
* rebase.

This path set adds BPF hooks for sys_sendmsg similar to existing hooks for
sys_bind and sys_connect.

Hooks allow to override source IP (including the case when it's set via
cmsg(3)) and destination IP:port for unconnected UDP (slow path). TCP and
connected UDP (fast path) are not affected. This makes UDP support
complete: connected UDP is handled by sys_connect hooks, unconnected by
sys_sendmsg ones.

Similar to sys_connect hooks, sys_sendmsg ones can be used to make system
calls such as sendmsg(2) and sendto(2) return EPERM.

Please see patch 0002 for more details.
====================

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parents 3b296633 04b6ab73

include/linux/bpf-cgroup.h

+18 −6
Original line number Diff line number Diff line
@@ -66,7 +66,8 @@ int __cgroup_bpf_run_filter_sk(struct sock *sk, 


int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,

				      struct sockaddr *uaddr,

				      enum bpf_attach_type type);

				      enum bpf_attach_type type,

				      void *t_ctx);



int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,

				     struct bpf_sock_ops_kern *sock_ops,
@@ -120,16 +121,18 @@ int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor, 
({									       \

	int __ret = 0;							       \

	if (cgroup_bpf_enabled)						       \

		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type);    \

		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type,     \

							  NULL);	       \

	__ret;								       \

})



#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type)			       \

#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type, t_ctx)		       \

({									       \

	int __ret = 0;							       \

	if (cgroup_bpf_enabled)	{					       \

		lock_sock(sk);						       \

		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type);    \

		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type,     \

							  t_ctx);	       \

		release_sock(sk);					       \

	}								       \

	__ret;								       \
@@ -151,10 +154,16 @@ int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor, 
	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_CONNECT)



#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr)		       \

	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_CONNECT)

	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_CONNECT, NULL)



#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr)		       \

	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_CONNECT)

	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_CONNECT, NULL)



#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \

	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_SENDMSG, t_ctx)



#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \

	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_SENDMSG, t_ctx)



#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops)				       \

({									       \
@@ -185,6 +194,7 @@ struct cgroup_bpf {}; 
static inline void cgroup_bpf_put(struct cgroup *cgrp) {}

static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }



#define cgroup_bpf_enabled (0)

#define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0)

#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })

#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
@@ -197,6 +207,8 @@ static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; } 
#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })

#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })

#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })

#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })

#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })

#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })

#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; })

include/linux/filter.h

+1 −0
Original line number Diff line number Diff line
@@ -1010,6 +1010,7 @@ struct bpf_sock_addr_kern { 
	 * only two (src and dst) are available at convert_ctx_access time

	 */

	u64 tmp_reg;

	void *t_ctx;	/* Attach type specific context. */

};



struct bpf_sock_ops_kern {

include/uapi/linux/bpf.h

+8 −0
Original line number Diff line number Diff line
@@ -160,6 +160,8 @@ enum bpf_attach_type { 
	BPF_CGROUP_INET6_CONNECT,

	BPF_CGROUP_INET4_POST_BIND,

	BPF_CGROUP_INET6_POST_BIND,

	BPF_CGROUP_UDP4_SENDMSG,

	BPF_CGROUP_UDP6_SENDMSG,

	__MAX_BPF_ATTACH_TYPE

};
@@ -2363,6 +2365,12 @@ struct bpf_sock_addr { 
	__u32 family;		/* Allows 4-byte read, but no write */

	__u32 type;		/* Allows 4-byte read, but no write */

	__u32 protocol;		/* Allows 4-byte read, but no write */

	__u32 msg_src_ip4;	/* Allows 1,2,4-byte read an 4-byte write.

				 * Stored in network byte order.

				 */

	__u32 msg_src_ip6[4];	/* Allows 1,2,4-byte read an 4-byte write.

				 * Stored in network byte order.

				 */

};



/* User bpf_sock_ops struct to access socket values and specify request ops

kernel/bpf/cgroup.c

+10 −1
Original line number Diff line number Diff line
@@ -500,6 +500,7 @@ EXPORT_SYMBOL(__cgroup_bpf_run_filter_sk); 
 * @sk: sock struct that will use sockaddr

 * @uaddr: sockaddr struct provided by user

 * @type: The type of program to be exectuted

 * @t_ctx: Pointer to attach type specific context

 *

 * socket is expected to be of type INET or INET6.

 *
@@ -508,12 +509,15 @@ EXPORT_SYMBOL(__cgroup_bpf_run_filter_sk); 
 */

int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,

				      struct sockaddr *uaddr,

				      enum bpf_attach_type type)

				      enum bpf_attach_type type,

				      void *t_ctx)

{

	struct bpf_sock_addr_kern ctx = {

		.sk = sk,

		.uaddr = uaddr,

		.t_ctx = t_ctx,

	};

	struct sockaddr_storage unspec;

	struct cgroup *cgrp;

	int ret;
@@ -523,6 +527,11 @@ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, 
	if (sk->sk_family != AF_INET && sk->sk_family != AF_INET6)

		return 0;



	if (!ctx.uaddr) {

		memset(&unspec, 0, sizeof(unspec));

		ctx.uaddr = (struct sockaddr *)&unspec;

	}



	cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);

	ret = BPF_PROG_RUN_ARRAY(cgrp->bpf.effective[type], &ctx, BPF_PROG_RUN);

kernel/bpf/syscall.c

+8 −0
Original line number Diff line number Diff line
@@ -1249,6 +1249,8 @@ bpf_prog_load_check_attach_type(enum bpf_prog_type prog_type, 
		case BPF_CGROUP_INET6_BIND:

		case BPF_CGROUP_INET4_CONNECT:

		case BPF_CGROUP_INET6_CONNECT:

		case BPF_CGROUP_UDP4_SENDMSG:

		case BPF_CGROUP_UDP6_SENDMSG:

			return 0;

		default:

			return -EINVAL;
@@ -1565,6 +1567,8 @@ static int bpf_prog_attach(const union bpf_attr *attr) 
	case BPF_CGROUP_INET6_BIND:

	case BPF_CGROUP_INET4_CONNECT:

	case BPF_CGROUP_INET6_CONNECT:

	case BPF_CGROUP_UDP4_SENDMSG:

	case BPF_CGROUP_UDP6_SENDMSG:

		ptype = BPF_PROG_TYPE_CGROUP_SOCK_ADDR;

		break;

	case BPF_CGROUP_SOCK_OPS:
@@ -1635,6 +1639,8 @@ static int bpf_prog_detach(const union bpf_attr *attr) 
	case BPF_CGROUP_INET6_BIND:

	case BPF_CGROUP_INET4_CONNECT:

	case BPF_CGROUP_INET6_CONNECT:

	case BPF_CGROUP_UDP4_SENDMSG:

	case BPF_CGROUP_UDP6_SENDMSG:

		ptype = BPF_PROG_TYPE_CGROUP_SOCK_ADDR;

		break;

	case BPF_CGROUP_SOCK_OPS:
@@ -1692,6 +1698,8 @@ static int bpf_prog_query(const union bpf_attr *attr, 
	case BPF_CGROUP_INET6_POST_BIND:

	case BPF_CGROUP_INET4_CONNECT:

	case BPF_CGROUP_INET6_CONNECT:

	case BPF_CGROUP_UDP4_SENDMSG:

	case BPF_CGROUP_UDP6_SENDMSG:

	case BPF_CGROUP_SOCK_OPS:

	case BPF_CGROUP_DEVICE:

		break;

CRA Git | Maintained and supported by SUSTech CRA and CCSE