From patchwork Sat Dec 10 19:35:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13070409 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B436C4332F for ; Sat, 10 Dec 2022 19:36:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229798AbiLJTge (ORCPT ); Sat, 10 Dec 2022 14:36:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36464 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229683AbiLJTgd (ORCPT ); Sat, 10 Dec 2022 14:36:33 -0500 Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4F1FC167CD for ; Sat, 10 Dec 2022 11:36:32 -0800 (PST) Received: by mail-wm1-x32b.google.com with SMTP id 204-20020a1c02d5000000b003d21f02fbaaso352261wmc.4 for ; Sat, 10 Dec 2022 11:36:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=HaoYPTAQOA25MweamW5K0tNS7T2q3wT7z4sSwJiVyYw=; b=RwJBCXFyUjQk+C4Y/5q7CEycCvc/GnzqaKSWpuDdvyzEU21w22EArmYNnIP+2s4wTZ kZzWxdbqdpkSI535miwtlOeilp/5pgcJApi5mY+H437CMIAgsV6i3TI5TUHtva8WYnsH KU0jYsLMu2lfyK3E48CcYBVhxmgG9ifJd9XvvUvHGPY4yntwtuwBZ7xwDqHguOUz3SLC qR6oZcXXxthYeU9JIUVK5TjN6w0fENqGCQycRBtb30t13tE3UYI8gOG8rnvpOGvNLd1R L4Ce7Ukn8U2gqjZzx01K71rcRyCf2zOgjWUwzmo+NaaYZPlxxIHROTdVwThRS8o/Tn/X KMOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=HaoYPTAQOA25MweamW5K0tNS7T2q3wT7z4sSwJiVyYw=; b=RaTDgY8ZzfArHYz8otqpvbePhaCFcXT+DBgBl0MTyqw5COHc+7OL1scgZCfhkFOuyl 297YN+qDynutJiCNUJEfi3TR3h+qTgmv69YLm7jfUYVYj3zb3E+OXt6SmqzPKGsC66zq X1bjkbGUB4+apG/Cid756OcO8rImW0kpom3FU39gPeu9ybW3Iau/1bcekTpTcXyNBroo 1QASn+qlV2IzSgKA6i5HzR6P9ihoUKKI3BIh1yqXHzhtqKyexHBu4TZ/H//APF8LdrJc XCoJxSq4jleABfeW3eb5rEh61qOJ4Z0rW9qPROmSRXLpp2vdUcbJQj8Abb3/VehyRIhI 9+hA== X-Gm-Message-State: ANoB5pkH9DgV0pr6RM4cZXRvNW63+D0Ct7TmH3BGYU/bBbuD8itwsNRh AiwATnj3nrskx1+nhCRQjYgPJapPESrl2g== X-Google-Smtp-Source: AA0mqf7idvLfydq5lGWgGwACLD3hu0xgq7UQMjlVGmt7uBWfUG+SUsFQlIq+n7iQbtjejYaLivQL+Q== X-Received: by 2002:a05:600c:3d8f:b0:3c6:e62e:2e74 with SMTP id bi15-20020a05600c3d8f00b003c6e62e2e74mr8502061wmb.15.1670700990570; Sat, 10 Dec 2022 11:36:30 -0800 (PST) Received: from daandemeyer-fedora-PC1EV17T.thefacebook.com ([2620:10d:c092:400::5:366e]) by smtp.googlemail.com with ESMTPSA id az18-20020adfe192000000b002423a5d7cb1sm4584676wrb.113.2022.12.10.11.36.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 11:36:30 -0800 (PST) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v2 1/9] selftests/bpf: Add missing section name tests for getpeername/getsockname Date: Sat, 10 Dec 2022 20:35:51 +0100 Message-Id: <20221210193559.371515-2-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221210193559.371515-1-daan.j.demeyer@gmail.com> References: <20221210193559.371515-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net --- .../selftests/bpf/prog_tests/section_names.c | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/section_names.c b/tools/testing/selftests/bpf/prog_tests/section_names.c index 8b571890c57e..fc5248e94a01 100644 --- a/tools/testing/selftests/bpf/prog_tests/section_names.c +++ b/tools/testing/selftests/bpf/prog_tests/section_names.c @@ -158,6 +158,26 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCKOPT, BPF_CGROUP_SETSOCKOPT}, {0, BPF_CGROUP_SETSOCKOPT}, }, + { + "cgroup/getpeername4", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETPEERNAME}, + {0, BPF_CGROUP_INET4_GETPEERNAME}, + }, + { + "cgroup/getpeername6", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETPEERNAME}, + {0, BPF_CGROUP_INET6_GETPEERNAME}, + }, + { + "cgroup/getsockname4", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETSOCKNAME}, + {0, BPF_CGROUP_INET4_GETSOCKNAME}, + }, + { + "cgroup/getsockname6", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETSOCKNAME}, + {0, BPF_CGROUP_INET6_GETSOCKNAME}, + }, }; static void test_prog_type_by_name(const struct sec_name_test *test) From patchwork Sat Dec 10 19:35:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13070411 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8EC20C4332F for ; Sat, 10 Dec 2022 19:36:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229683AbiLJTgh (ORCPT ); Sat, 10 Dec 2022 14:36:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36502 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229703AbiLJTgf (ORCPT ); Sat, 10 Dec 2022 14:36:35 -0500 Received: from mail-wr1-x435.google.com (mail-wr1-x435.google.com [IPv6:2a00:1450:4864:20::435]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BCE2F17070 for ; Sat, 10 Dec 2022 11:36:33 -0800 (PST) Received: by mail-wr1-x435.google.com with SMTP id u12so8285324wrr.11 for ; Sat, 10 Dec 2022 11:36:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=8+cgziiizzukldzfvHhhKU5n4vWX6w+fQ9+PnrQBORQ=; b=b8FxEZP9W3gkcYhN2slNCnZy5E/2RXLXoxn7sQ4uS9AoJu8q5KfRGUi8jRSdv9tHGS 0qqJSgCjlE87x84GyXGG60vqws/qFAsFktX4icjT+x1y28gxnU/v+iedceUmnFzvEoNi SMyCwrZrVljoInZw+fVXlKxBitUHuSMGwutvcDNz4DnEaK3mj9Ct4NxAAZgTQC/AJzoT iGxkkzYvtQev62VI5yH5UmMoBR55F3baUNzx1T296srZE3knC5lklsy5YBWnxnvE8Peg yQK5Ya8pE1gDoPAmR9S2XmIJdFM6OMCFk9I3Aru91YcOc2GaCi485TllTW29Hr3+8hT3 WvSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=8+cgziiizzukldzfvHhhKU5n4vWX6w+fQ9+PnrQBORQ=; b=RJ+Y7HvLl8206GIDniHP1CmmF4kh+tz4hfB3NEWyOQBgM6T65l03P2/RXqpeSv/voS yZKOz3JEoq+Jeav44mxk32fSDuGzHqrvE1yO1m/R0MVr3Qpv7PSODi/hkXXrErbwxG/F TGefSiXUght5Gr1MLfh9LeMwO+ZjPlwrAE8EytpHUEWbWp+d1Y14ucE521WNRZ5PwK3r MQyRiZiH770cm2UoLhw8yL3YrVJ0JCba4lYEorj6yebAtKCAZtrMuozm+zZKFjtStk9G tjnhRXmvg0R78VMcp85gnZPBHpHDqgZGAqG1JSLtaVTQaWEciyyRMakJ4Y7UqCDyff/i Iezg== X-Gm-Message-State: ANoB5plJmnJoCITwLBF+j3e+AXvGksdP8e/WRwDo3X68e1YEn+OwHN2R +SgNe8S1sxyI2HLVVvEowHKw/PB8/pr3eg== X-Google-Smtp-Source: AA0mqf6DbWtPQJOSDiwoQKvUpzjD8GcRPivVYmU0JSsggiXMcWeG89JQAJZpDmmDhQOyvOPy1p6Kjg== X-Received: by 2002:adf:edc6:0:b0:242:43d1:6d8a with SMTP id v6-20020adfedc6000000b0024243d16d8amr7845211wro.59.1670700991894; Sat, 10 Dec 2022 11:36:31 -0800 (PST) Received: from daandemeyer-fedora-PC1EV17T.thefacebook.com ([2620:10d:c092:400::5:366e]) by smtp.googlemail.com with ESMTPSA id az18-20020adfe192000000b002423a5d7cb1sm4584676wrb.113.2022.12.10.11.36.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 11:36:31 -0800 (PST) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v2 2/9] bpf: Allow read access to addr_len from cgroup sockaddr programs Date: Sat, 10 Dec 2022 20:35:52 +0100 Message-Id: <20221210193559.371515-3-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221210193559.371515-1-daan.j.demeyer@gmail.com> References: <20221210193559.371515-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net --- include/linux/bpf-cgroup.h | 124 +++++++++++++++++---------------- include/linux/filter.h | 1 + include/uapi/linux/bpf.h | 1 + kernel/bpf/cgroup.c | 3 + net/core/filter.c | 51 ++++++++++++++ net/ipv4/af_inet.c | 9 +-- net/ipv4/ping.c | 2 +- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/udp.c | 11 +-- net/ipv6/af_inet6.c | 9 +-- net/ipv6/ping.c | 2 +- net/ipv6/tcp_ipv6.c | 2 +- net/ipv6/udp.c | 12 ++-- tools/include/uapi/linux/bpf.h | 1 + 14 files changed, 146 insertions(+), 84 deletions(-) diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h index 57e9e109257e..3ab2f06ddc8a 100644 --- a/include/linux/bpf-cgroup.h +++ b/include/linux/bpf-cgroup.h @@ -120,6 +120,7 @@ int __cgroup_bpf_run_filter_sk(struct sock *sk, int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, struct sockaddr *uaddr, + int *uaddrlen, enum cgroup_bpf_attach_type atype, void *t_ctx, u32 *flags); @@ -230,75 +231,76 @@ static inline bool cgroup_bpf_sock_enabled(struct sock *sk, #define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) \ BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET6_POST_BIND) -#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype) \ -({ \ - int __ret = 0; \ - if (cgroup_bpf_enabled(atype)) \ - __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \ - NULL, NULL); \ - __ret; \ -}) - -#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx) \ -({ \ - int __ret = 0; \ - if (cgroup_bpf_enabled(atype)) { \ - lock_sock(sk); \ - __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \ - t_ctx, NULL); \ - release_sock(sk); \ - } \ - __ret; \ -}) +#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, atype) \ + ({ \ + int __ret = 0; \ + if (cgroup_bpf_enabled(atype)) \ + __ret = __cgroup_bpf_run_filter_sock_addr( \ + sk, uaddr, uaddrlen, atype, NULL, NULL); \ + __ret; \ + }) + +#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, atype, t_ctx) \ + ({ \ + int __ret = 0; \ + if (cgroup_bpf_enabled(atype)) { \ + lock_sock(sk); \ + __ret = __cgroup_bpf_run_filter_sock_addr( \ + sk, uaddr, uaddrlen, atype, t_ctx, NULL); \ + release_sock(sk); \ + } \ + __ret; \ + }) /* BPF_CGROUP_INET4_BIND and BPF_CGROUP_INET6_BIND can return extra flags * via upper bits of return code. The only flag that is supported * (at bit position 0) is to indicate CAP_NET_BIND_SERVICE capability check * should be bypassed (BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE). */ -#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, bind_flags) \ -({ \ - u32 __flags = 0; \ - int __ret = 0; \ - if (cgroup_bpf_enabled(atype)) { \ - lock_sock(sk); \ - __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \ - NULL, &__flags); \ - release_sock(sk); \ - if (__flags & BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE) \ - *bind_flags |= BIND_NO_CAP_NET_BIND_SERVICE; \ - } \ - __ret; \ -}) +#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, uaddrlen, atype, \ + bind_flags) \ + ({ \ + u32 __flags = 0; \ + int __ret = 0; \ + if (cgroup_bpf_enabled(atype)) { \ + lock_sock(sk); \ + __ret = __cgroup_bpf_run_filter_sock_addr( \ + sk, uaddr, uaddrlen, atype, NULL, &__flags); \ + release_sock(sk); \ + if (__flags & BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE) \ + *bind_flags |= BIND_NO_CAP_NET_BIND_SERVICE; \ + } \ + __ret; \ + }) #define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) \ ((cgroup_bpf_enabled(CGROUP_INET4_CONNECT) || \ cgroup_bpf_enabled(CGROUP_INET6_CONNECT)) && \ (sk)->sk_prot->pre_connect) -#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET4_CONNECT) +#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, CGROUP_INET4_CONNECT) -#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET6_CONNECT) +#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, CGROUP_INET6_CONNECT) -#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET4_CONNECT, NULL) +#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_INET4_CONNECT, NULL) -#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET6_CONNECT, NULL) +#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_INET6_CONNECT, NULL) -#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_SENDMSG, t_ctx) +#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP4_SENDMSG, t_ctx) -#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_SENDMSG, t_ctx) +#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP6_SENDMSG, t_ctx) -#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_RECVMSG, NULL) +#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP4_RECVMSG, NULL) -#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_RECVMSG, NULL) +#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP6_RECVMSG, NULL) /* The SOCK_OPS"_SK" macro should be used when sock_ops->sk is not a * fullsock and its parent fullsock cannot be traced by @@ -477,24 +479,24 @@ static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map, } #define cgroup_bpf_enabled(atype) (0) -#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx) ({ 0; }) -#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype) ({ 0; }) +#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, atype, t_ctx) ({ 0; }) +#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, atype) ({ 0; }) #define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0) #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, flags) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, uaddrlen, atype, flags) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; }) #define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) ({ 0; }) #define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; }) diff --git a/include/linux/filter.h b/include/linux/filter.h index bf701976056e..510cf4042f8b 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -1294,6 +1294,7 @@ struct bpf_sock_addr_kern { */ u64 tmp_reg; void *t_ctx; /* Attach type specific context. */ + int *uaddrlen; }; struct bpf_sock_ops_kern { diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index f89de51a45db..7cafcfdbb9b2 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -6366,6 +6366,7 @@ struct bpf_sock_addr { * Stored in network byte order. */ __bpf_md_ptr(struct bpf_sock *, sk); + __u32 user_addrlen; /* Allows 4 byte read and write. */ }; /* User bpf_sock_ops struct to access socket values and specify request ops diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index bf2fdb33fb31..f97afed8a115 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -1449,6 +1449,7 @@ EXPORT_SYMBOL(__cgroup_bpf_run_filter_sk); * provided by user sockaddr * @sk: sock struct that will use sockaddr * @uaddr: sockaddr struct provided by user + * @uaddrlen: Pointer to length of sockaddr struct provided by user * @type: The type of program to be executed * @t_ctx: Pointer to attach type specific context * @flags: Pointer to u32 which contains higher bits of BPF program @@ -1461,6 +1462,7 @@ EXPORT_SYMBOL(__cgroup_bpf_run_filter_sk); */ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, struct sockaddr *uaddr, + int *uaddrlen, enum cgroup_bpf_attach_type atype, void *t_ctx, u32 *flags) @@ -1468,6 +1470,7 @@ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, struct bpf_sock_addr_kern ctx = { .sk = sk, .uaddr = uaddr, + .uaddrlen = uaddrlen, .t_ctx = t_ctx, }; struct sockaddr_storage unspec; diff --git a/net/core/filter.c b/net/core/filter.c index 8607136b6e2c..d0620927dbca 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -8876,6 +8876,13 @@ static bool sock_addr_is_valid_access(int off, int size, return false; info->reg_type = PTR_TO_SOCKET; break; + case bpf_ctx_range(struct bpf_sock_addr, user_addrlen): + if (type != BPF_READ) + return false; + + if (size != sizeof(__u32)) + return false; + break; default: if (type == BPF_READ) { if (size != size_default) @@ -9909,6 +9916,7 @@ static u32 sock_addr_convert_ctx_access(enum bpf_access_type type, { int off, port_size = sizeof_field(struct sockaddr_in6, sin6_port); struct bpf_insn *insn = insn_buf; + u32 read_size; switch (si->off) { case offsetof(struct bpf_sock_addr, user_family): @@ -9986,6 +9994,49 @@ static u32 sock_addr_convert_ctx_access(enum bpf_access_type type, si->dst_reg, si->src_reg, offsetof(struct bpf_sock_addr_kern, sk)); break; + + case offsetof(struct bpf_sock_addr, user_addrlen): + /* uaddrlen is a pointer so it should be accessed via indirect + * loads and stores. Also for stores additional temporary + * register is used since neither src_reg nor dst_reg can be + * overridden. + */ + if (type == BPF_WRITE) { + int treg = BPF_REG_9; + + if (si->src_reg == treg || si->dst_reg == treg) + --treg; + if (si->src_reg == treg || si->dst_reg == treg) + --treg; + *insn++ = BPF_STX_MEM( + BPF_DW, si->dst_reg, treg, + offsetof(struct bpf_sock_addr_kern, tmp_reg)); + *insn++ = BPF_LDX_MEM( + BPF_FIELD_SIZEOF(struct bpf_sock_addr_kern, + uaddrlen), + treg, si->dst_reg, + offsetof(struct bpf_sock_addr_kern, uaddrlen)); + *insn++ = BPF_STX_MEM( + BPF_SIZEOF(u32), treg, si->src_reg, + bpf_ctx_narrow_access_offset(0, sizeof(u32), + sizeof(int))); + *insn++ = BPF_LDX_MEM( + BPF_DW, treg, si->dst_reg, + offsetof(struct bpf_sock_addr_kern, tmp_reg)); + } else { + *insn++ = BPF_LDX_MEM( + BPF_FIELD_SIZEOF(struct bpf_sock_addr_kern, + uaddrlen), + si->dst_reg, si->src_reg, + offsetof(struct bpf_sock_addr_kern, uaddrlen)); + read_size = bpf_size_to_bytes(BPF_SIZE(si->code)); + *insn++ = BPF_LDX_MEM( + BPF_SIZE(si->code), si->dst_reg, si->dst_reg, + bpf_ctx_narrow_access_offset(0, read_size, + sizeof(int))); + } + *target_size = sizeof(u32); + break; } return insn - insn_buf; diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index ab4a06be489b..3024837b57e7 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -448,7 +448,7 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) /* BPF prog is run before any checks are done so that if the prog * changes context in a wrong way it will be caught. */ - err = BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, + err = BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, &addr_len, CGROUP_INET4_BIND, &flags); if (err) return err; @@ -775,6 +775,7 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr, struct sock *sk = sock->sk; struct inet_sock *inet = inet_sk(sk); DECLARE_SOCKADDR(struct sockaddr_in *, sin, uaddr); + int addrlen = sizeof(*sin); sin->sin_family = AF_INET; lock_sock(sk); @@ -787,7 +788,7 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr, } sin->sin_port = inet->inet_dport; sin->sin_addr.s_addr = inet->inet_daddr; - BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, + BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, &addrlen, CGROUP_INET4_GETPEERNAME); } else { __be32 addr = inet->inet_rcv_saddr; @@ -795,12 +796,12 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr, addr = inet->inet_saddr; sin->sin_port = inet->inet_sport; sin->sin_addr.s_addr = addr; - BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, + BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, &addrlen, CGROUP_INET4_GETSOCKNAME); } release_sock(sk); memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); - return sizeof(*sin); + return addrlen; } EXPORT_SYMBOL(inet_getname); diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c index bb9854c2b7a1..9b82798e5542 100644 --- a/net/ipv4/ping.c +++ b/net/ipv4/ping.c @@ -306,7 +306,7 @@ static int ping_pre_connect(struct sock *sk, struct sockaddr *uaddr, if (addr_len < sizeof(struct sockaddr_in)) return -EINVAL; - return BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr); + return BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, &addr_len); } /* Checks the bind address and possibly modifies sk->sk_bound_dev_if. */ diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 1215fa4c1b9f..e4d1903239b9 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -193,7 +193,7 @@ static int tcp_v4_pre_connect(struct sock *sk, struct sockaddr *uaddr, sock_owned_by_me(sk); - return BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr); + return BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr, &addr_len); } /* This will initiate an outgoing connection. */ diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 9592fe3e444a..ff4b4513d0fb 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1156,8 +1156,9 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) } if (cgroup_bpf_enabled(CGROUP_UDP4_SENDMSG) && !connected) { - err = BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, - (struct sockaddr *)usin, &ipc.addr); + err = BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK( + sk, (struct sockaddr *)usin, &msg->msg_namelen, + &ipc.addr); if (err) goto out_free; if (usin) { @@ -1921,8 +1922,8 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags, memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); *addr_len = sizeof(*sin); - BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, - (struct sockaddr *)sin); + BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK( + sk, (struct sockaddr *)sin, addr_len); } if (udp_sk(sk)->gro_enabled) @@ -1961,7 +1962,7 @@ int udp_pre_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) if (addr_len < sizeof(struct sockaddr_in)) return -EINVAL; - return BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr); + return BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, &addr_len); } EXPORT_SYMBOL(udp_pre_connect); diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index fee9163382c2..ac3671e48710 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -464,7 +464,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) /* BPF prog is run before any checks are done so that if the prog * changes context in a wrong way it will be caught. */ - err = BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, + err = BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, &addr_len, CGROUP_INET6_BIND, &flags); if (err) return err; @@ -527,6 +527,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr, struct sock *sk = sock->sk; struct inet_sock *inet = inet_sk(sk); struct ipv6_pinfo *np = inet6_sk(sk); + int addrlen = sizeof(*sin); sin->sin6_family = AF_INET6; sin->sin6_flowinfo = 0; @@ -543,7 +544,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr, sin->sin6_addr = sk->sk_v6_daddr; if (np->sndflow) sin->sin6_flowinfo = np->flow_label; - BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, + BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, &addrlen, CGROUP_INET6_GETPEERNAME); } else { if (ipv6_addr_any(&sk->sk_v6_rcv_saddr)) @@ -551,13 +552,13 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr, else sin->sin6_addr = sk->sk_v6_rcv_saddr; sin->sin6_port = inet->inet_sport; - BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, + BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, &addrlen, CGROUP_INET6_GETSOCKNAME); } sin->sin6_scope_id = ipv6_iface_scope_id(&sin->sin6_addr, sk->sk_bound_dev_if); release_sock(sk); - return sizeof(*sin); + return addrlen; } EXPORT_SYMBOL(inet6_getname); diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c index 808983bc2ec9..a46c1eec72e6 100644 --- a/net/ipv6/ping.c +++ b/net/ipv6/ping.c @@ -56,7 +56,7 @@ static int ping_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr, if (addr_len < SIN6_LEN_RFC2133) return -EINVAL; - return BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr); + return BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, &addr_len); } static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index f52b6f271a24..22213641bb3c 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -139,7 +139,7 @@ static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr, sock_owned_by_me(sk); - return BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr); + return BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, &addr_len); } static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 9fb2f33ee3a7..2ac73446dcdc 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -428,8 +428,8 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, } *addr_len = sizeof(*sin6); - BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, - (struct sockaddr *)sin6); + BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK( + sk, (struct sockaddr *)sin6, addr_len); } if (udp_sk(sk)->gro_enabled) @@ -1167,7 +1167,7 @@ static int udpv6_pre_connect(struct sock *sk, struct sockaddr *uaddr, if (addr_len < SIN6_LEN_RFC2133) return -EINVAL; - return BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr); + return BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, &addr_len); } /** @@ -1516,9 +1516,9 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) fl6->fl6_sport = inet->inet_sport; if (cgroup_bpf_enabled(CGROUP_UDP6_SENDMSG) && !connected) { - err = BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, - (struct sockaddr *)sin6, - &fl6->saddr); + err = BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK( + sk, (struct sockaddr *)sin6, &msg->msg_namelen, + &fl6->saddr); if (err) goto out_no_dst; if (sin6) { diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index f89de51a45db..7cafcfdbb9b2 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -6366,6 +6366,7 @@ struct bpf_sock_addr { * Stored in network byte order. */ __bpf_md_ptr(struct bpf_sock *, sk); + __u32 user_addrlen; /* Allows 4 byte read and write. */ }; /* User bpf_sock_ops struct to access socket values and specify request ops From patchwork Sat Dec 10 19:35:53 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13070410 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AA52EC10F1B for ; Sat, 10 Dec 2022 19:36:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229475AbiLJTgg (ORCPT ); Sat, 10 Dec 2022 14:36:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36504 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229683AbiLJTgf (ORCPT ); Sat, 10 Dec 2022 14:36:35 -0500 Received: from mail-wr1-x42e.google.com (mail-wr1-x42e.google.com [IPv6:2a00:1450:4864:20::42e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CBD9517041 for ; Sat, 10 Dec 2022 11:36:34 -0800 (PST) Received: by mail-wr1-x42e.google.com with SMTP id h7so8299170wrs.6 for ; Sat, 10 Dec 2022 11:36:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=8SBSj3VXVNzuIFcZAmzvJzu3WlWJZi+xQVEXNS8j/FM=; b=M0Gxma9x9tpJDc+WOL4OHy77hKvgyy8Rd1dwaw79luEEP2OasGKShpUzjGyg5ov5hO 4tzpveIRiAdHXlTcivzY3g4nn2A6hS3v1E/UE8AvA5yJMvC9A5y9RaezzwRBRBNZhxni lP+0ZzP4yOg3SmMnyIg6Bo+a6BZF7PkHv9HxK8radEG08rceGXOzLZrT9/Pb4k0DSwT6 Y8MRjzCxs7JMQkES30L+Yagr4i+pgp+G6Wa7/VVG6dZRZABkItvgL9/EpNyYG8dTDNWB nAAGD7qFrDinp7OobyTfHzcJYxvMeBwD5cDFX9OCTuRL0Vd7SsXFs8hJzOLp/HQ4QEw4 f12Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=8SBSj3VXVNzuIFcZAmzvJzu3WlWJZi+xQVEXNS8j/FM=; b=2YaCh8pE6yeguMeL1fswJOutNWPqOSF5ZQAJsIy5Ms13IK0oIRtWnmE5NbOHLeC6QO 8dG8cdvDSg8AcQmLsIDO3smqgZee4jNUFbmGyxf4JYUd8sqp3ijBPec/Rh1dOxlzLibu y3bOa2CkUs4gdvmywldTzGV8XTu54317/3iHQTSBHSucOTgUVHGmWkNz2Zdab9CCTgOx eDyAsD/mnK0EJcCUU5XC8UNTg7gaoCelYGn6bK/gyViJFGQxQumx69IKH6cOYl3Bm1M5 77a1vYYcWwSB5a8qx/Dzz+oB5n4PSD+M7B3lyuLFDtgW4adrFqaH+YiEhUFOLl6j1vP5 L7NQ== X-Gm-Message-State: ANoB5pllCe0dFqt/d07Ju94LaT/3GnlKs2rn521al/qal5x67XbXFfT1 TvuMMSL2+Pzqi5aIt/gEmIqnRLvPHWqj6Q== X-Google-Smtp-Source: AA0mqf4m4eciSEjgUfhMhPrGpSkhNdlyrGDCYN1JsrJLYv1z2mtjB6b5SNLmsNJmGLREbQTbRPvX+Q== X-Received: by 2002:a5d:43cb:0:b0:242:22e4:998f with SMTP id v11-20020a5d43cb000000b0024222e4998fmr7024589wrr.55.1670700993102; Sat, 10 Dec 2022 11:36:33 -0800 (PST) Received: from daandemeyer-fedora-PC1EV17T.thefacebook.com ([2620:10d:c092:400::5:366e]) by smtp.googlemail.com with ESMTPSA id az18-20020adfe192000000b002423a5d7cb1sm4584676wrb.113.2022.12.10.11.36.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 11:36:32 -0800 (PST) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v2 3/9] bpf: Support access to sun_path from cgroup sockaddr programs Date: Sat, 10 Dec 2022 20:35:53 +0100 Message-Id: <20221210193559.371515-4-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221210193559.371515-1-daan.j.demeyer@gmail.com> References: <20221210193559.371515-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net Preparation for adding unix support to cgroup sockaddr bpf programs. In this commit, no programs are allowed to access user_path. We'll open this up to the new unix program types in a later commit. --- include/uapi/linux/bpf.h | 1 + net/core/filter.c | 19 +++++++++++++++++++ tools/include/uapi/linux/bpf.h | 1 + 3 files changed, 21 insertions(+) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 7cafcfdbb9b2..9e3c33f83bba 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -6366,6 +6366,7 @@ struct bpf_sock_addr { * Stored in network byte order. */ __bpf_md_ptr(struct bpf_sock *, sk); + char user_path[108]; /* Allows 1 byte read and write. */ __u32 user_addrlen; /* Allows 4 byte read and write. */ }; diff --git a/net/core/filter.c b/net/core/filter.c index d0620927dbca..cc86b38fc764 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -26,6 +26,7 @@ #include #include #include +#include #include #include #include @@ -8830,6 +8831,8 @@ static bool sock_addr_is_valid_access(int off, int size, return false; } break; + case bpf_ctx_range_till(struct bpf_sock_addr, user_path[0], user_path[107]): + return false; } switch (off) { @@ -8876,6 +8879,10 @@ static bool sock_addr_is_valid_access(int off, int size, return false; info->reg_type = PTR_TO_SOCKET; break; + case bpf_ctx_range_till(struct bpf_sock_addr, user_path[0], user_path[107]): + if (size != sizeof(char)) + return false; + break; case bpf_ctx_range(struct bpf_sock_addr, user_addrlen): if (type != BPF_READ) return false; @@ -9995,6 +10002,18 @@ static u32 sock_addr_convert_ctx_access(enum bpf_access_type type, offsetof(struct bpf_sock_addr_kern, sk)); break; + case bpf_ctx_range_till(struct bpf_sock_addr, user_path[0], user_path[107]): + /* In kernelspace, addresses are always stored in + * sockaddr_storage so any access in the full range of + * sockaddr_un.sun_path is safe. + */ + off = si->off; + off -= offsetof(struct bpf_sock_addr, user_path[0]); + SOCK_ADDR_LOAD_OR_STORE_NESTED_FIELD_SIZE_OFF( + struct bpf_sock_addr_kern, struct sockaddr_un, uaddr, + sun_path, BPF_SIZE(si->code), off, tmp_reg); + break; + case offsetof(struct bpf_sock_addr, user_addrlen): /* uaddrlen is a pointer so it should be accessed via indirect * loads and stores. Also for stores additional temporary diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 7cafcfdbb9b2..9e3c33f83bba 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -6366,6 +6366,7 @@ struct bpf_sock_addr { * Stored in network byte order. */ __bpf_md_ptr(struct bpf_sock *, sk); + char user_path[108]; /* Allows 1 byte read and write. */ __u32 user_addrlen; /* Allows 4 byte read and write. */ }; From patchwork Sat Dec 10 19:35:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13070412 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8CB2C10F1B for ; Sat, 10 Dec 2022 19:36:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229816AbiLJTgj (ORCPT ); Sat, 10 Dec 2022 14:36:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36510 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229703AbiLJTgh (ORCPT ); Sat, 10 Dec 2022 14:36:37 -0500 Received: from mail-wr1-x42c.google.com (mail-wr1-x42c.google.com [IPv6:2a00:1450:4864:20::42c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 27AEE167CD for ; Sat, 10 Dec 2022 11:36:36 -0800 (PST) Received: by mail-wr1-x42c.google.com with SMTP id h10so8304782wrx.3 for ; Sat, 10 Dec 2022 11:36:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ziCJ3oPB670i/Ex4/hyT8q5ZYvIG8lgP9O//9AOFINo=; b=DJtw+tWPvRKEJtzzrmIpnf8FpYTkPWCKevAswNQ0X2zAJtSzP/9L/f2OarBTd3dx4J TDULy/cDZLZysasGq+aJxKk0AkuYHyONiHv1b7ogOG0Rs2sjZeH+TB5BFqRN0m69VJI2 G4jnY7vwza4mllS0FL5yk+JOfhM31vzDwMhwDIqsnceH5plNpvfDMUsNrxXo6r461dun YtduZEu43qXTGcmmvmcVRx3icf3fWlJriSfckqNLFarGf9HCuzLNC+KogjHSIOqPZqiJ Z4CsOoa9EBqEk/x5sFXn/Y11KZtEMVUOwmySKNCD4XJKHibKtSrbJSmhUj4eU2rwSNdZ EpKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ziCJ3oPB670i/Ex4/hyT8q5ZYvIG8lgP9O//9AOFINo=; b=OjvNh2GiN7yjGpYDxLIrGJy4jldQm+dUd3/nHr5mVj0iib0ZdxbNAEpj98KCkdMOES sLxBU3hutoOuEO2E1k9oZVJlZrHKlLd5SIkI5/CvKrC4luKqCN6sKYM4ldK4NvHPwVJJ 1Tuf3l2z29PU59t8dTWQmeENxhQTyQNWbJvT6eqzPtWQZfguclpXtSmYgIp1v+N7KPBW c/zUjUvcO6m8DeERIMYpYtO31xWOSovwhfH3bBSwZo7H8Xj4o0mj/LR8fEuycNIOMVw0 pIkfHEeXgIRKMdELqgdXa+s1TepOBX1wjXX9bH4c0mJIlWisMJZNF1Tl4JHPfas/4ybp CQwA== X-Gm-Message-State: ANoB5pko5Fjz6Q8tlZEoIwyzL3AIOY1CnntnygjjpdkPNbRmzP9VQ9WV xDG9XHch2AxEjaEHLiYDe3yX4icjqsy7tw== X-Google-Smtp-Source: AA0mqf7wZLzE5LP0P4aG7mS/ZmzBNlpBtt6YLyx7nrCjyUFAjk6yt+svAta3VMzzzMDVDj+cQPNvWQ== X-Received: by 2002:adf:de06:0:b0:242:1277:925b with SMTP id b6-20020adfde06000000b002421277925bmr6772286wrm.59.1670700994370; Sat, 10 Dec 2022 11:36:34 -0800 (PST) Received: from daandemeyer-fedora-PC1EV17T.thefacebook.com ([2620:10d:c092:400::5:366e]) by smtp.googlemail.com with ESMTPSA id az18-20020adfe192000000b002423a5d7cb1sm4584676wrb.113.2022.12.10.11.36.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 11:36:33 -0800 (PST) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v2 4/9] selftests/bpf: Track sockaddr length in sock addr tests Date: Sat, 10 Dec 2022 20:35:54 +0100 Message-Id: <20221210193559.371515-5-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221210193559.371515-1-daan.j.demeyer@gmail.com> References: <20221210193559.371515-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net In preparation for adding unix socket support to the bpf cgroup socket address hooks, start tracking the sockaddr length in the sockaddr tests which will be required when adding tests for unix sockets. --- tools/testing/selftests/bpf/test_sock_addr.c | 130 ++++++++++++------- 1 file changed, 85 insertions(+), 45 deletions(-) diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c index 2c89674fc62c..6a618c8f477c 100644 --- a/tools/testing/selftests/bpf/test_sock_addr.c +++ b/tools/testing/selftests/bpf/test_sock_addr.c @@ -604,7 +604,7 @@ static struct sock_addr_test tests[] = { }; static int mk_sockaddr(int domain, const char *ip, unsigned short port, - struct sockaddr *addr, socklen_t addr_len) + struct sockaddr *addr, socklen_t *addr_len) { struct sockaddr_in6 *addr6; struct sockaddr_in *addr4; @@ -614,10 +614,10 @@ static int mk_sockaddr(int domain, const char *ip, unsigned short port, return -1; } - memset(addr, 0, addr_len); + memset(addr, 0, *addr_len); if (domain == AF_INET) { - if (addr_len < sizeof(struct sockaddr_in)) + if (*addr_len < sizeof(struct sockaddr_in)) return -1; addr4 = (struct sockaddr_in *)addr; addr4->sin_family = domain; @@ -626,8 +626,9 @@ static int mk_sockaddr(int domain, const char *ip, unsigned short port, log_err("Invalid IPv4: %s", ip); return -1; } + *addr_len = sizeof(struct sockaddr_in); } else if (domain == AF_INET6) { - if (addr_len < sizeof(struct sockaddr_in6)) + if (*addr_len < sizeof(struct sockaddr_in6)) return -1; addr6 = (struct sockaddr_in6 *)addr; addr6->sin6_family = domain; @@ -636,6 +637,7 @@ static int mk_sockaddr(int domain, const char *ip, unsigned short port, log_err("Invalid IPv6: %s", ip); return -1; } + *addr_len = sizeof(struct sockaddr_in6); } return 0; @@ -749,6 +751,7 @@ static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test) { struct sockaddr_in dst4_rw_addr; struct in_addr src4_rw_ip; + socklen_t dst4_rw_addr_len = sizeof(dst4_rw_addr); if (inet_pton(AF_INET, SRC4_REWRITE_IP, (void *)&src4_rw_ip) != 1) { log_err("Invalid IPv4: %s", SRC4_REWRITE_IP); @@ -757,7 +760,7 @@ static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test) if (mk_sockaddr(AF_INET, SERV4_REWRITE_IP, SERV4_REWRITE_PORT, (struct sockaddr *)&dst4_rw_addr, - sizeof(dst4_rw_addr)) == -1) + &dst4_rw_addr_len) == -1) return -1; struct bpf_insn insns[] = { @@ -812,6 +815,7 @@ static int sendmsg6_rw_dst_asm_prog_load(const struct sock_addr_test *test, { struct sockaddr_in6 dst6_rw_addr; struct in6_addr src6_rw_ip; + socklen_t dst6_rw_addr_len = sizeof(dst6_rw_addr); if (inet_pton(AF_INET6, SRC6_REWRITE_IP, (void *)&src6_rw_ip) != 1) { log_err("Invalid IPv6: %s", SRC6_REWRITE_IP); @@ -820,7 +824,7 @@ static int sendmsg6_rw_dst_asm_prog_load(const struct sock_addr_test *test, if (mk_sockaddr(AF_INET6, rw_dst_ip, SERV6_REWRITE_PORT, (struct sockaddr *)&dst6_rw_addr, - sizeof(dst6_rw_addr)) == -1) + &dst6_rw_addr_len) == -1) return -1; struct bpf_insn insns[] = { @@ -885,8 +889,9 @@ static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test) return load_path(test, SENDMSG6_PROG_PATH); } -static int cmp_addr(const struct sockaddr_storage *addr1, - const struct sockaddr_storage *addr2, int cmp_port) +static int cmp_addr(const struct sockaddr_storage *addr1, socklen_t addr1_len, + const struct sockaddr_storage *addr2, socklen_t addr2_len, + int cmp_port) { const struct sockaddr_in *four1, *four2; const struct sockaddr_in6 *six1, *six2; @@ -894,6 +899,9 @@ static int cmp_addr(const struct sockaddr_storage *addr1, if (addr1->ss_family != addr2->ss_family) return -1; + if (addr1_len != addr2_len) + return -1; + if (addr1->ss_family == AF_INET) { four1 = (const struct sockaddr_in *)addr1; four2 = (const struct sockaddr_in *)addr2; @@ -911,7 +919,8 @@ static int cmp_addr(const struct sockaddr_storage *addr1, } static int cmp_sock_addr(info_fn fn, int sock1, - const struct sockaddr_storage *addr2, int cmp_port) + const struct sockaddr_storage *addr2, + socklen_t addr2_len, int cmp_port) { struct sockaddr_storage addr1; socklen_t len1 = sizeof(addr1); @@ -920,22 +929,28 @@ static int cmp_sock_addr(info_fn fn, int sock1, if (fn(sock1, (struct sockaddr *)&addr1, (socklen_t *)&len1) != 0) return -1; - return cmp_addr(&addr1, addr2, cmp_port); + return cmp_addr(&addr1, len1, addr2, addr2_len, cmp_port); } -static int cmp_local_ip(int sock1, const struct sockaddr_storage *addr2) +static int cmp_local_ip(int sock1, const struct sockaddr_storage *addr2, + socklen_t addr2_len) { - return cmp_sock_addr(getsockname, sock1, addr2, /*cmp_port*/ 0); + return cmp_sock_addr(getsockname, sock1, addr2, addr2_len, + /*cmp_port*/ 0); } -static int cmp_local_addr(int sock1, const struct sockaddr_storage *addr2) +static int cmp_local_addr(int sock1, const struct sockaddr_storage *addr2, + socklen_t addr2_len) { - return cmp_sock_addr(getsockname, sock1, addr2, /*cmp_port*/ 1); + return cmp_sock_addr(getsockname, sock1, addr2, addr2_len, + /*cmp_port*/ 1); } -static int cmp_peer_addr(int sock1, const struct sockaddr_storage *addr2) +static int cmp_peer_addr(int sock1, const struct sockaddr_storage *addr2, + socklen_t addr2_len) { - return cmp_sock_addr(getpeername, sock1, addr2, /*cmp_port*/ 1); + return cmp_sock_addr(getpeername, sock1, addr2, addr2_len, + /*cmp_port*/ 1); } static int start_server(int type, const struct sockaddr_storage *addr, @@ -1109,7 +1124,8 @@ static int fastconnect_to_server(const struct sockaddr_storage *addr, MSG_FASTOPEN, &sendmsg_err); } -static int recvmsg_from_client(int sockfd, struct sockaddr_storage *src_addr) +static int recvmsg_from_client(int sockfd, struct sockaddr_storage *src_addr, + socklen_t *src_addr_len) { struct timeval tv; struct msghdr hdr; @@ -1133,31 +1149,39 @@ static int recvmsg_from_client(int sockfd, struct sockaddr_storage *src_addr) memset(&hdr, 0, sizeof(hdr)); hdr.msg_name = src_addr; - hdr.msg_namelen = sizeof(struct sockaddr_storage); + hdr.msg_namelen = *src_addr_len; hdr.msg_iov = &iov; hdr.msg_iovlen = 1; - return recvmsg(sockfd, &hdr, 0); + if (recvmsg(sockfd, &hdr, 0) < 0) + return -1; + + *src_addr_len = hdr.msg_namelen; + return 0; } static int init_addrs(const struct sock_addr_test *test, struct sockaddr_storage *requested_addr, + socklen_t *requested_addr_len, struct sockaddr_storage *expected_addr, - struct sockaddr_storage *expected_src_addr) + socklen_t *expected_addr_len, + struct sockaddr_storage *expected_src_addr, + socklen_t *expected_src_addr_len) { - socklen_t addr_len = sizeof(struct sockaddr_storage); - if (mk_sockaddr(test->domain, test->expected_ip, test->expected_port, - (struct sockaddr *)expected_addr, addr_len) == -1) + (struct sockaddr *)expected_addr, + expected_addr_len) == -1) goto err; if (mk_sockaddr(test->domain, test->requested_ip, test->requested_port, - (struct sockaddr *)requested_addr, addr_len) == -1) + (struct sockaddr *)requested_addr, + requested_addr_len) == -1) goto err; if (test->expected_src_ip && mk_sockaddr(test->domain, test->expected_src_ip, 0, - (struct sockaddr *)expected_src_addr, addr_len) == -1) + (struct sockaddr *)expected_src_addr, + expected_src_addr_len) == -1) goto err; return 0; @@ -1167,25 +1191,28 @@ static int init_addrs(const struct sock_addr_test *test, static int run_bind_test_case(const struct sock_addr_test *test) { - socklen_t addr_len = sizeof(struct sockaddr_storage); struct sockaddr_storage requested_addr; struct sockaddr_storage expected_addr; + socklen_t requested_addr_len = sizeof(struct sockaddr_storage); + socklen_t expected_addr_len = sizeof(struct sockaddr_storage); int clientfd = -1; int servfd = -1; int err = 0; - if (init_addrs(test, &requested_addr, &expected_addr, NULL)) + if (init_addrs(test, &requested_addr, &requested_addr_len, + &expected_addr, &expected_addr_len, NULL, NULL)) goto err; - servfd = start_server(test->type, &requested_addr, addr_len); + servfd = start_server(test->type, &requested_addr, requested_addr_len); if (servfd == -1) goto err; - if (cmp_local_addr(servfd, &expected_addr)) + if (cmp_local_addr(servfd, &expected_addr, expected_addr_len)) goto err; /* Try to connect to server just in case */ - clientfd = connect_to_server(test->type, &expected_addr, addr_len); + clientfd = connect_to_server(test->type, &expected_addr, + expected_addr_len); if (clientfd == -1) goto err; @@ -1204,28 +1231,33 @@ static int run_connect_test_case(const struct sock_addr_test *test) struct sockaddr_storage expected_src_addr; struct sockaddr_storage requested_addr; struct sockaddr_storage expected_addr; + socklen_t expected_src_addr_len = sizeof(struct sockaddr_storage); + socklen_t requested_addr_len = sizeof(struct sockaddr_storage); + socklen_t expected_addr_len = sizeof(struct sockaddr_storage); int clientfd = -1; int servfd = -1; int err = 0; - if (init_addrs(test, &requested_addr, &expected_addr, - &expected_src_addr)) + if (init_addrs(test, &requested_addr, &requested_addr_len, + &expected_addr, &expected_addr_len, &expected_src_addr, + &expected_src_addr_len)) goto err; /* Prepare server to connect to */ - servfd = start_server(test->type, &expected_addr, addr_len); + servfd = start_server(test->type, &expected_addr, expected_addr_len); if (servfd == -1) goto err; - clientfd = connect_to_server(test->type, &requested_addr, addr_len); + clientfd = connect_to_server(test->type, &requested_addr, + requested_addr_len); if (clientfd == -1) goto err; /* Make sure src and dst addrs were overridden properly */ - if (cmp_peer_addr(clientfd, &expected_addr)) + if (cmp_peer_addr(clientfd, &expected_addr, expected_addr_len)) goto err; - if (cmp_local_ip(clientfd, &expected_src_addr)) + if (cmp_local_ip(clientfd, &expected_src_addr, expected_src_addr_len)) goto err; if (test->type == SOCK_STREAM) { @@ -1235,10 +1267,11 @@ static int run_connect_test_case(const struct sock_addr_test *test) goto err; /* Make sure src and dst addrs were overridden properly */ - if (cmp_peer_addr(clientfd, &expected_addr)) + if (cmp_peer_addr(clientfd, &expected_addr, expected_addr_len)) goto err; - if (cmp_local_ip(clientfd, &expected_src_addr)) + if (cmp_local_ip(clientfd, &expected_src_addr, + expected_src_addr_len)) goto err; } @@ -1253,11 +1286,14 @@ static int run_connect_test_case(const struct sock_addr_test *test) static int run_xmsg_test_case(const struct sock_addr_test *test, int max_cmsg) { - socklen_t addr_len = sizeof(struct sockaddr_storage); struct sockaddr_storage expected_addr; struct sockaddr_storage server_addr; struct sockaddr_storage sendmsg_addr; struct sockaddr_storage recvmsg_addr; + socklen_t expected_addr_len = sizeof(struct sockaddr_storage); + socklen_t server_addr_len = sizeof(struct sockaddr_storage); + socklen_t sendmsg_addr_len = sizeof(struct sockaddr_storage); + socklen_t recvmsg_addr_len = sizeof(struct sockaddr_storage); int clientfd = -1; int servfd = -1; int set_cmsg; @@ -1266,11 +1302,12 @@ static int run_xmsg_test_case(const struct sock_addr_test *test, int max_cmsg) if (test->type != SOCK_DGRAM) goto err; - if (init_addrs(test, &sendmsg_addr, &server_addr, &expected_addr)) + if (init_addrs(test, &sendmsg_addr, &sendmsg_addr_len, &server_addr, + &server_addr_len, &expected_addr, &expected_addr_len)) goto err; /* Prepare server to sendmsg to */ - servfd = start_server(test->type, &server_addr, addr_len); + servfd = start_server(test->type, &server_addr, server_addr_len); if (servfd == -1) goto err; @@ -1279,8 +1316,8 @@ static int run_xmsg_test_case(const struct sock_addr_test *test, int max_cmsg) close(clientfd); clientfd = sendmsg_to_server(test->type, &sendmsg_addr, - addr_len, set_cmsg, /*flags*/0, - &err); + sendmsg_addr_len, set_cmsg, + /*flags*/ 0, &err); if (err) goto out; else if (clientfd == -1) @@ -1298,10 +1335,13 @@ static int run_xmsg_test_case(const struct sock_addr_test *test, int max_cmsg) * specific packet may differ from the one used by default and * returned by getsockname(2). */ - if (recvmsg_from_client(servfd, &recvmsg_addr) == -1) + if (recvmsg_from_client(servfd, &recvmsg_addr, + &recvmsg_addr_len) == -1) goto err; - if (cmp_addr(&recvmsg_addr, &expected_addr, /*cmp_port*/0)) + if (cmp_addr(&recvmsg_addr, recvmsg_addr_len, &expected_addr, + expected_addr_len, + /*cmp_port*/ 0)) goto err; } From patchwork Sat Dec 10 19:35:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13070413 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F5C0C4332F for ; Sat, 10 Dec 2022 19:36:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229703AbiLJTgl (ORCPT ); Sat, 10 Dec 2022 14:36:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36554 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229905AbiLJTgk (ORCPT ); Sat, 10 Dec 2022 14:36:40 -0500 Received: from mail-wr1-x42d.google.com (mail-wr1-x42d.google.com [IPv6:2a00:1450:4864:20::42d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 879191704B for ; Sat, 10 Dec 2022 11:36:37 -0800 (PST) Received: by mail-wr1-x42d.google.com with SMTP id h10so8304805wrx.3 for ; Sat, 10 Dec 2022 11:36:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NYFtlhevempsitNucpOW3HxnZYURsvx0aCs6Hg0ZXF4=; b=CIHlJUYFTqimKwta/7hnyzzblCKzMct7WLepqLefb6RooNA+hbCj+9yQ/0WYOcpO/v Z2wHC4xdjm/bGvc4aCtoLPLTGqrqQt7EM4xSK+p43MvDMJjSm44je1hdW5j3UbegJQE1 HBsIsz06zqWYp90vW7ftWM3J+1FM3ZOOCiEDK8sW+7Jz8Wm6T/iW+m/feLdkHffdDS4w 6TUiLzv/TRRDhDGb3S2Cz6O97byLCz5/G83DjDvQ2Lrii5TLBLDeAqnUGaiIb9gZ/676 GAzMsj66p4t4t4ruLKS2+TvdG0mjbfL4EktnaaeDmpmjiAcNVx6yum/PnKnyGdfvdfGw sUfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=NYFtlhevempsitNucpOW3HxnZYURsvx0aCs6Hg0ZXF4=; b=MWywuoT9mC4aHqnvd6Y/lvKUl4s5cBp+v/zEa8r6ZozkNQN1bHHzU6c/SZK2bzziD2 h38gv/yjcxWN299ySUi3MS3KkGPoTcrKuFKkG1VkC3Cnwnrfnqb/Kis4pr99DI1ZtiSY ywI1FACdhA9TJxNPVJiLUPHkY23arMK2Ztr6E//V5UhHgPGbq+VMt+opCjvk3hrcICi+ 2ZqjBUijv0pYACm9P6tDsa9083vfWl1XU7x9CxA9nzCFDCV6qjgOXlLrNlwXbuxHHEIO QFemZthjZ0mBerDcsOJG8tS1n9Upe5L7NoqokS2SIp4j63KNg8HGWbN0apQNg4dt8rTC 2UiA== X-Gm-Message-State: ANoB5pnoFj7vfVnL1SDoug49AnC0RzQN4xAQaxcTFyhVxXT0z8djekAn cisFnwOrMrT4mTJomSNa3qZySVeaN29XeA== X-Google-Smtp-Source: AA0mqf4ws2GVlc3/CKIcuxSUASev7SyOPXU35zKOa4le26Vz9/jObs+9gkpysWW7ewZMDnBuWR6x8Q== X-Received: by 2002:a5d:58d2:0:b0:242:4697:d826 with SMTP id o18-20020a5d58d2000000b002424697d826mr6169389wrf.29.1670700995628; Sat, 10 Dec 2022 11:36:35 -0800 (PST) Received: from daandemeyer-fedora-PC1EV17T.thefacebook.com ([2620:10d:c092:400::5:366e]) by smtp.googlemail.com with ESMTPSA id az18-20020adfe192000000b002423a5d7cb1sm4584676wrb.113.2022.12.10.11.36.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 11:36:35 -0800 (PST) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v2 5/9] bpf: Implement cgroup sockaddr hooks for unix sockets Date: Sat, 10 Dec 2022 20:35:55 +0100 Message-Id: <20221210193559.371515-6-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221210193559.371515-1-daan.j.demeyer@gmail.com> References: <20221210193559.371515-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net These hooks allows intercepting bind(), connect(), getsockname(), getpeername(), sendmsg() and recvmsg() for unix sockets. The unix socket hooks get write access to the address length because the address length is not fixed when dealing with unix sockets and needs to be modified when a unix socket address is modified by the hook. Because abstract socket unix addresses start with a NUL byte, we cannot recalculate the socket address in kernelspace after running the hook by calculating the length of the unix socket path using strlen(). This hook can be used when users want to multiplex syscall to a single unix socket to multiple different processes behind the scenes by redirecting the connect() and other syscalls to process specific sockets. --- include/linux/bpf-cgroup-defs.h | 6 +++ include/linux/bpf-cgroup.h | 29 ++++++++++- include/uapi/linux/bpf.h | 14 ++++-- kernel/bpf/cgroup.c | 11 ++++- kernel/bpf/syscall.c | 18 +++++++ kernel/bpf/verifier.c | 7 ++- net/core/filter.c | 45 +++++++++++++++-- net/unix/af_unix.c | 85 +++++++++++++++++++++++++++++---- tools/include/uapi/linux/bpf.h | 14 ++++-- 9 files changed, 204 insertions(+), 25 deletions(-) diff --git a/include/linux/bpf-cgroup-defs.h b/include/linux/bpf-cgroup-defs.h index 7b121bd780eb..8196ccb81915 100644 --- a/include/linux/bpf-cgroup-defs.h +++ b/include/linux/bpf-cgroup-defs.h @@ -26,21 +26,27 @@ enum cgroup_bpf_attach_type { CGROUP_DEVICE, CGROUP_INET4_BIND, CGROUP_INET6_BIND, + CGROUP_UNIX_BIND, CGROUP_INET4_CONNECT, CGROUP_INET6_CONNECT, + CGROUP_UNIX_CONNECT, CGROUP_INET4_POST_BIND, CGROUP_INET6_POST_BIND, CGROUP_UDP4_SENDMSG, CGROUP_UDP6_SENDMSG, + CGROUP_UNIX_SENDMSG, CGROUP_SYSCTL, CGROUP_UDP4_RECVMSG, CGROUP_UDP6_RECVMSG, + CGROUP_UNIX_RECVMSG, CGROUP_GETSOCKOPT, CGROUP_SETSOCKOPT, CGROUP_INET4_GETPEERNAME, CGROUP_INET6_GETPEERNAME, + CGROUP_UNIX_GETPEERNAME, CGROUP_INET4_GETSOCKNAME, CGROUP_INET6_GETSOCKNAME, + CGROUP_UNIX_GETSOCKNAME, CGROUP_INET_SOCK_RELEASE, CGROUP_LSM_START, CGROUP_LSM_END = CGROUP_LSM_START + CGROUP_LSM_NUM - 1, diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h index 3ab2f06ddc8a..4de3016f01e4 100644 --- a/include/linux/bpf-cgroup.h +++ b/include/linux/bpf-cgroup.h @@ -46,21 +46,27 @@ to_cgroup_bpf_attach_type(enum bpf_attach_type attach_type) CGROUP_ATYPE(CGROUP_DEVICE); CGROUP_ATYPE(CGROUP_INET4_BIND); CGROUP_ATYPE(CGROUP_INET6_BIND); + CGROUP_ATYPE(CGROUP_UNIX_BIND); CGROUP_ATYPE(CGROUP_INET4_CONNECT); CGROUP_ATYPE(CGROUP_INET6_CONNECT); + CGROUP_ATYPE(CGROUP_UNIX_CONNECT); CGROUP_ATYPE(CGROUP_INET4_POST_BIND); CGROUP_ATYPE(CGROUP_INET6_POST_BIND); CGROUP_ATYPE(CGROUP_UDP4_SENDMSG); CGROUP_ATYPE(CGROUP_UDP6_SENDMSG); + CGROUP_ATYPE(CGROUP_UNIX_SENDMSG); CGROUP_ATYPE(CGROUP_SYSCTL); CGROUP_ATYPE(CGROUP_UDP4_RECVMSG); CGROUP_ATYPE(CGROUP_UDP6_RECVMSG); + CGROUP_ATYPE(CGROUP_UNIX_RECVMSG); CGROUP_ATYPE(CGROUP_GETSOCKOPT); CGROUP_ATYPE(CGROUP_SETSOCKOPT); CGROUP_ATYPE(CGROUP_INET4_GETPEERNAME); CGROUP_ATYPE(CGROUP_INET6_GETPEERNAME); + CGROUP_ATYPE(CGROUP_UNIX_GETPEERNAME); CGROUP_ATYPE(CGROUP_INET4_GETSOCKNAME); CGROUP_ATYPE(CGROUP_INET6_GETSOCKNAME); + CGROUP_ATYPE(CGROUP_UNIX_GETSOCKNAME); CGROUP_ATYPE(CGROUP_INET_SOCK_RELEASE); default: return CGROUP_BPF_ATTACH_TYPE_INVALID; @@ -273,9 +279,13 @@ static inline bool cgroup_bpf_sock_enabled(struct sock *sk, __ret; \ }) +#define BPF_CGROUP_RUN_PROG_UNIX_BIND_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UNIX_BIND, NULL) + #define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) \ ((cgroup_bpf_enabled(CGROUP_INET4_CONNECT) || \ - cgroup_bpf_enabled(CGROUP_INET6_CONNECT)) && \ + cgroup_bpf_enabled(CGROUP_INET6_CONNECT) || \ + cgroup_bpf_enabled(CGROUP_UNIX_CONNECT)) && \ (sk)->sk_prot->pre_connect) #define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr, uaddrlen) \ @@ -284,24 +294,36 @@ static inline bool cgroup_bpf_sock_enabled(struct sock *sk, #define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, uaddrlen) \ BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, CGROUP_INET6_CONNECT) +#define BPF_CGROUP_RUN_PROG_UNIX_CONNECT(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, CGROUP_UNIX_CONNECT) + #define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, uaddrlen) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_INET4_CONNECT, NULL) #define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, uaddrlen) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_INET6_CONNECT, NULL) +#define BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UNIX_CONNECT, NULL) + #define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP4_SENDMSG, t_ctx) #define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP6_SENDMSG, t_ctx) +#define BPF_CGROUP_RUN_PROG_UNIX_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UNIX_SENDMSG, t_ctx) + #define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr, uaddrlen) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP4_RECVMSG, NULL) #define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr, uaddrlen) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP6_RECVMSG, NULL) +#define BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UNIX_RECVMSG, NULL) + /* The SOCK_OPS"_SK" macro should be used when sock_ops->sk is not a * fullsock and its parent fullsock cannot be traced by * sk_to_full_sk(). @@ -487,16 +509,21 @@ static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map, #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, uaddrlen, atype, flags) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UNIX_BIND_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UNIX_CONNECT(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; }) #define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UNIX_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; }) #define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; }) #define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) ({ 0; }) #define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; }) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 9e3c33f83bba..b73e4da458fd 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -999,17 +999,21 @@ enum bpf_attach_type { BPF_SK_MSG_VERDICT, BPF_CGROUP_INET4_BIND, BPF_CGROUP_INET6_BIND, + BPF_CGROUP_UNIX_BIND, BPF_CGROUP_INET4_CONNECT, BPF_CGROUP_INET6_CONNECT, + BPF_CGROUP_UNIX_CONNECT, BPF_CGROUP_INET4_POST_BIND, BPF_CGROUP_INET6_POST_BIND, BPF_CGROUP_UDP4_SENDMSG, BPF_CGROUP_UDP6_SENDMSG, + BPF_CGROUP_UNIX_SENDMSG, BPF_LIRC_MODE2, BPF_FLOW_DISSECTOR, BPF_CGROUP_SYSCTL, BPF_CGROUP_UDP4_RECVMSG, BPF_CGROUP_UDP6_RECVMSG, + BPF_CGROUP_UNIX_RECVMSG, BPF_CGROUP_GETSOCKOPT, BPF_CGROUP_SETSOCKOPT, BPF_TRACE_RAW_TP, @@ -1020,8 +1024,10 @@ enum bpf_attach_type { BPF_TRACE_ITER, BPF_CGROUP_INET4_GETPEERNAME, BPF_CGROUP_INET6_GETPEERNAME, + BPF_CGROUP_UNIX_GETPEERNAME, BPF_CGROUP_INET4_GETSOCKNAME, BPF_CGROUP_INET6_GETSOCKNAME, + BPF_CGROUP_UNIX_GETSOCKNAME, BPF_XDP_DEVMAP, BPF_CGROUP_INET_SOCK_RELEASE, BPF_XDP_CPUMAP, @@ -2575,8 +2581,8 @@ union bpf_attr { * *bpf_socket* should be one of the following: * * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. - * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** - * and **BPF_CGROUP_INET6_CONNECT**. + * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**, + * **BPF_CGROUP_INET6_CONNECT** and **BPF_CGROUP_UNIX_CONNECT**. * * This helper actually implements a subset of **setsockopt()**. * It supports the following *level*\ s: @@ -2809,8 +2815,8 @@ union bpf_attr { * *bpf_socket* should be one of the following: * * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. - * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** - * and **BPF_CGROUP_INET6_CONNECT**. + * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**, + * **BPF_CGROUP_INET6_CONNECT** and **BPF_CGROUP_UNIX_CONNECT**. * * This helper actually implements a subset of **getsockopt()**. * It supports the same set of *optname*\ s that is supported by diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index f97afed8a115..eeb349cef624 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -1455,7 +1455,7 @@ EXPORT_SYMBOL(__cgroup_bpf_run_filter_sk); * @flags: Pointer to u32 which contains higher bits of BPF program * return value (OR'ed together). * - * socket is expected to be of type INET or INET6. + * socket is expected to be of type INET, INET6 or UNIX. * * This function will return %-EPERM if an attached program is found and * returned value != 1 during execution. In all other cases, 0 is returned. @@ -1479,7 +1479,8 @@ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, /* Check socket family since not all sockets represent network * endpoint (e.g. AF_UNIX). */ - if (sk->sk_family != AF_INET && sk->sk_family != AF_INET6) + if (sk->sk_family != AF_INET && sk->sk_family != AF_INET6 && + sk->sk_family != AF_UNIX) return 0; if (!ctx.uaddr) { @@ -2493,10 +2494,13 @@ cgroup_common_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_CGROUP_SOCK_OPS: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: return NULL; default: return &bpf_get_retval_proto; @@ -2508,10 +2512,13 @@ cgroup_common_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_CGROUP_SOCK_OPS: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: return NULL; default: return &bpf_set_retval_proto; diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 35972afb6850..142b5ece735f 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2370,16 +2370,22 @@ bpf_prog_load_check_attach(enum bpf_prog_type prog_type, switch (expected_attach_type) { case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: return 0; default: return -EINVAL; @@ -3418,16 +3424,22 @@ attach_type_to_prog_type(enum bpf_attach_type attach_type) return BPF_PROG_TYPE_CGROUP_SOCK; case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: return BPF_PROG_TYPE_CGROUP_SOCK_ADDR; case BPF_CGROUP_SOCK_OPS: return BPF_PROG_TYPE_SOCK_OPS; @@ -3583,18 +3595,24 @@ static int bpf_prog_query(const union bpf_attr *attr, case BPF_CGROUP_INET_SOCK_RELEASE: case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: case BPF_CGROUP_INET4_POST_BIND: case BPF_CGROUP_INET6_POST_BIND: case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: case BPF_CGROUP_SOCK_OPS: case BPF_CGROUP_DEVICE: case BPF_CGROUP_SYSCTL: diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1d51bd9596da..c06a6e43676c 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11991,14 +11991,19 @@ static int check_return_code(struct bpf_verifier_env *env) case BPF_PROG_TYPE_CGROUP_SOCK_ADDR: if (env->prog->expected_attach_type == BPF_CGROUP_UDP4_RECVMSG || env->prog->expected_attach_type == BPF_CGROUP_UDP6_RECVMSG || + env->prog->expected_attach_type == BPF_CGROUP_UNIX_RECVMSG || env->prog->expected_attach_type == BPF_CGROUP_INET4_GETPEERNAME || env->prog->expected_attach_type == BPF_CGROUP_INET6_GETPEERNAME || + env->prog->expected_attach_type == BPF_CGROUP_UNIX_GETPEERNAME || env->prog->expected_attach_type == BPF_CGROUP_INET4_GETSOCKNAME || - env->prog->expected_attach_type == BPF_CGROUP_INET6_GETSOCKNAME) + env->prog->expected_attach_type == BPF_CGROUP_INET6_GETSOCKNAME || + env->prog->expected_attach_type == BPF_CGROUP_UNIX_GETSOCKNAME) range = tnum_range(1, 1); if (env->prog->expected_attach_type == BPF_CGROUP_INET4_BIND || env->prog->expected_attach_type == BPF_CGROUP_INET6_BIND) range = tnum_range(0, 3); + if (env->prog->expected_attach_type == BPF_CGROUP_UNIX_BIND) + range = tnum_range(0, 1); break; case BPF_PROG_TYPE_CGROUP_SKB: if (env->prog->expected_attach_type == BPF_CGROUP_INET_EGRESS) { diff --git a/net/core/filter.c b/net/core/filter.c index cc86b38fc764..0c8427305009 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7666,6 +7666,7 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) switch (prog->expected_attach_type) { case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: return &bpf_bind_proto; default: return NULL; @@ -7694,16 +7695,22 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) switch (prog->expected_attach_type) { case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: return &bpf_sock_addr_setsockopt_proto; default: return NULL; @@ -7712,16 +7719,22 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) switch (prog->expected_attach_type) { case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: return &bpf_sock_addr_getsockopt_proto; default: return NULL; @@ -8784,8 +8797,8 @@ static bool sock_addr_is_valid_access(int off, int size, if (off % size != 0) return false; - /* Disallow access to IPv6 fields from IPv4 contex and vise - * versa. + /* Disallow access to fields not belonging to the attach type's address + * family. */ switch (off) { case bpf_ctx_range(struct bpf_sock_addr, user_ip4): @@ -8832,7 +8845,18 @@ static bool sock_addr_is_valid_access(int off, int size, } break; case bpf_ctx_range_till(struct bpf_sock_addr, user_path[0], user_path[107]): - return false; + switch (prog->expected_attach_type) { + case BPF_CGROUP_UNIX_BIND: + case BPF_CGROUP_UNIX_CONNECT: + case BPF_CGROUP_UNIX_SENDMSG: + case BPF_CGROUP_UNIX_RECVMSG: + case BPF_CGROUP_UNIX_GETPEERNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: + break; + default: + return false; + } + break; } switch (off) { @@ -8884,8 +8908,19 @@ static bool sock_addr_is_valid_access(int off, int size, return false; break; case bpf_ctx_range(struct bpf_sock_addr, user_addrlen): - if (type != BPF_READ) - return false; + if (type != BPF_READ) { + switch (prog->expected_attach_type) { + case BPF_CGROUP_UNIX_BIND: + case BPF_CGROUP_UNIX_CONNECT: + case BPF_CGROUP_UNIX_SENDMSG: + case BPF_CGROUP_UNIX_RECVMSG: + case BPF_CGROUP_UNIX_GETPEERNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: + break; + default: + return false; + } + } if (size != sizeof(__u32)) return false; diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index b3545fc68097..8d250cb75636 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -115,6 +115,7 @@ #include #include #include +#include #include "scm.h" @@ -1302,6 +1303,12 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) struct sock *sk = sock->sk; int err; + if (cgroup_bpf_enabled(CGROUP_UNIX_BIND)) { + err = BPF_CGROUP_RUN_PROG_UNIX_BIND_LOCK(sk, uaddr, &addr_len); + if (err) + return err; + } + if (addr_len == offsetof(struct sockaddr_un, sun_path) && sunaddr->sun_family == AF_UNIX) return unix_autobind(sk); @@ -1356,6 +1363,13 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr, goto out; if (addr->sa_family != AF_UNSPEC) { + if (cgroup_bpf_enabled(CGROUP_UNIX_CONNECT)) { + err = BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, addr, + &alen); + if (err) + goto out; + } + err = unix_validate_addr(sunaddr, alen); if (err) goto out; @@ -1464,6 +1478,13 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr, int err; int st; + if (cgroup_bpf_enabled(CGROUP_UNIX_CONNECT)) { + err = BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, uaddr, + &addr_len); + if (err) + goto out; + } + err = unix_validate_addr(sunaddr, addr_len); if (err) goto out; @@ -1724,7 +1745,7 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer) struct sock *sk = sock->sk; struct unix_address *addr; DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr); - int err = 0; + int addr_len = 0, err = 0; if (peer) { sk = unix_peer_get(sk); @@ -1741,14 +1762,35 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer) if (!addr) { sunaddr->sun_family = AF_UNIX; sunaddr->sun_path[0] = 0; - err = offsetof(struct sockaddr_un, sun_path); + addr_len = offsetof(struct sockaddr_un, sun_path); } else { - err = addr->len; + addr_len = addr->len; memcpy(sunaddr, addr->name, addr->len); } + + if (peer && cgroup_bpf_enabled(CGROUP_UNIX_GETPEERNAME)) { + err = BPF_CGROUP_RUN_SA_PROG(sk, uaddr, &addr_len, + CGROUP_UNIX_GETPEERNAME); + if (err) + goto out; + + err = unix_validate_addr(sunaddr, addr_len); + if (err) + goto out; + } else if (cgroup_bpf_enabled(CGROUP_UNIX_GETSOCKNAME)) { + err = BPF_CGROUP_RUN_SA_PROG(sk, uaddr, &addr_len, + CGROUP_UNIX_GETSOCKNAME); + if (err) + goto out; + + err = unix_validate_addr(sunaddr, addr_len); + if (err) + goto out; + } + sock_put(sk); out: - return err; + return err ?: addr_len; } static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb) @@ -1910,6 +1952,13 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg, goto out; if (msg->msg_namelen) { + if (cgroup_bpf_enabled(CGROUP_UNIX_SENDMSG)) { + err = BPF_CGROUP_RUN_PROG_UNIX_SENDMSG_LOCK( + sk, msg->msg_name, &msg->msg_namelen, NULL); + if (err) + goto out; + } + err = unix_validate_addr(sunaddr, msg->msg_namelen); if (err) goto out; @@ -2404,14 +2453,29 @@ static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg, return unix_dgram_recvmsg(sock, msg, size, flags); } -static void unix_copy_addr(struct msghdr *msg, struct sock *sk) +static int unix_recvmsg_copy_addr(struct msghdr *msg, struct sock *sk) { struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr); + int err; if (addr) { msg->msg_namelen = addr->len; memcpy(msg->msg_name, addr->name, addr->len); + + if (cgroup_bpf_enabled(CGROUP_UNIX_RECVMSG)) { + err = BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK( + sk, msg->msg_name, &msg->msg_namelen); + if (err) + return err; + + err = unix_validate_addr(msg->msg_name, + msg->msg_namelen); + if (err) + return err; + } } + + return 0; } int __unix_dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t size, @@ -2466,8 +2530,11 @@ int __unix_dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t size, EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND); - if (msg->msg_name) - unix_copy_addr(msg, skb->sk); + if (msg->msg_name) { + err = unix_recvmsg_copy_addr(msg, skb->sk); + if (err) + goto out_free; + } if (size > skb->len - skip) size = skb->len - skip; @@ -2821,7 +2888,9 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, if (state->msg && state->msg->msg_name) { DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, state->msg->msg_name); - unix_copy_addr(state->msg, skb->sk); + err = unix_recvmsg_copy_addr(state->msg, skb->sk); + if (err) + break; sunaddr = NULL; } diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 9e3c33f83bba..b73e4da458fd 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -999,17 +999,21 @@ enum bpf_attach_type { BPF_SK_MSG_VERDICT, BPF_CGROUP_INET4_BIND, BPF_CGROUP_INET6_BIND, + BPF_CGROUP_UNIX_BIND, BPF_CGROUP_INET4_CONNECT, BPF_CGROUP_INET6_CONNECT, + BPF_CGROUP_UNIX_CONNECT, BPF_CGROUP_INET4_POST_BIND, BPF_CGROUP_INET6_POST_BIND, BPF_CGROUP_UDP4_SENDMSG, BPF_CGROUP_UDP6_SENDMSG, + BPF_CGROUP_UNIX_SENDMSG, BPF_LIRC_MODE2, BPF_FLOW_DISSECTOR, BPF_CGROUP_SYSCTL, BPF_CGROUP_UDP4_RECVMSG, BPF_CGROUP_UDP6_RECVMSG, + BPF_CGROUP_UNIX_RECVMSG, BPF_CGROUP_GETSOCKOPT, BPF_CGROUP_SETSOCKOPT, BPF_TRACE_RAW_TP, @@ -1020,8 +1024,10 @@ enum bpf_attach_type { BPF_TRACE_ITER, BPF_CGROUP_INET4_GETPEERNAME, BPF_CGROUP_INET6_GETPEERNAME, + BPF_CGROUP_UNIX_GETPEERNAME, BPF_CGROUP_INET4_GETSOCKNAME, BPF_CGROUP_INET6_GETSOCKNAME, + BPF_CGROUP_UNIX_GETSOCKNAME, BPF_XDP_DEVMAP, BPF_CGROUP_INET_SOCK_RELEASE, BPF_XDP_CPUMAP, @@ -2575,8 +2581,8 @@ union bpf_attr { * *bpf_socket* should be one of the following: * * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. - * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** - * and **BPF_CGROUP_INET6_CONNECT**. + * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**, + * **BPF_CGROUP_INET6_CONNECT** and **BPF_CGROUP_UNIX_CONNECT**. * * This helper actually implements a subset of **setsockopt()**. * It supports the following *level*\ s: @@ -2809,8 +2815,8 @@ union bpf_attr { * *bpf_socket* should be one of the following: * * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. - * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** - * and **BPF_CGROUP_INET6_CONNECT**. + * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**, + * **BPF_CGROUP_INET6_CONNECT** and **BPF_CGROUP_UNIX_CONNECT**. * * This helper actually implements a subset of **getsockopt()**. * It supports the same set of *optname*\ s that is supported by From patchwork Sat Dec 10 19:35:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13070415 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F6DAC4708E for ; Sat, 10 Dec 2022 19:36:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229908AbiLJTgm (ORCPT ); Sat, 10 Dec 2022 14:36:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36552 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229902AbiLJTgl (ORCPT ); Sat, 10 Dec 2022 14:36:41 -0500 Received: from mail-wm1-x32e.google.com (mail-wm1-x32e.google.com [IPv6:2a00:1450:4864:20::32e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A74BF1740B for ; Sat, 10 Dec 2022 11:36:38 -0800 (PST) Received: by mail-wm1-x32e.google.com with SMTP id n7so2201779wms.3 for ; Sat, 10 Dec 2022 11:36:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=9guGLAv71C+0I5Ij6Uvknh/h+f0s2xjehD6bVfW1DY0=; b=md7+xDdmPfGtprC9V33fheVA1Cn5xtZgRGvn6ggz7zYTD9CpL26ggSS4KTEnBmPSWf sYmxMjgOeTBRQ4aTMgOeC3UDcmx2z51XrEhfLpEqnpK6cA7afWTRRnJfDs1FMaMQ/Q0O KDOZflRLFMGUwIHQ5pAtp3YDxYEE6PNKMzxEse8hSgI+X43vdv3wMb1vbN2H7hdmHon1 uFo+rC8FYL+3MvG3zxKqhNXtp2+vRjiRi07S0WBMhEWR0sFdfVTo2G88h9N//We9DVkD 2jBjv2eRdSo269yJA9/7A2/H5652gEf1ZruL5l/l71yBXzvS8QBhjVApEqSvt2VtFSF0 OA7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=9guGLAv71C+0I5Ij6Uvknh/h+f0s2xjehD6bVfW1DY0=; b=RDrOsVsibm6YrDDv5S7ZglXQ52AHuKQqNGdKvDkm7Clrw1QMY6HI8fgFNC/i6PDrag xwnGgfTc7IYHkqcLeHE8YWg8+ZXnOHntmndbRxl7i/v6K9kyOCw+lYST+trFX8YKM1+X gQTOYhLWOCPNmTWzm3TUZbCcX67VV9u88ri1rOC494jC8/BwurUYdAGVmKXHWI1t/KN0 igoCxbbZmRk1c7WvHKlZqoGa366EIDgIt9hjcfJemzeoXOj1w6wHOpkULGcNdCSWDd+w rkNaYIGzpBewSygPpG5cIpdwb3WDPZjfhWiAiIc+tBK55JZ8DG5vYZneyjXT3RDsCaZM p1eA== X-Gm-Message-State: ANoB5pl1Ypkslv68LUEbcxDl7rlf/SdtWMW9n0dy56bqD700vNQV8BWv qLTPKaz8TLgceQhtTnnxoig2kMHqwUU08w== X-Google-Smtp-Source: AA0mqf55EMUXB4C5+Egl8fzAqDA07joFSd6C9JIoksHZ/PhYcil4lsbffSTPLGLnFgmZu+io6VA07g== X-Received: by 2002:a7b:c053:0:b0:3cf:7385:677f with SMTP id u19-20020a7bc053000000b003cf7385677fmr8519343wmc.35.1670700996837; Sat, 10 Dec 2022 11:36:36 -0800 (PST) Received: from daandemeyer-fedora-PC1EV17T.thefacebook.com ([2620:10d:c092:400::5:366e]) by smtp.googlemail.com with ESMTPSA id az18-20020adfe192000000b002423a5d7cb1sm4584676wrb.113.2022.12.10.11.36.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 11:36:36 -0800 (PST) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v2 6/9] libbpf: Add support for cgroup unix socket address hooks Date: Sat, 10 Dec 2022 20:35:56 +0100 Message-Id: <20221210193559.371515-7-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221210193559.371515-1-daan.j.demeyer@gmail.com> References: <20221210193559.371515-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net --- tools/lib/bpf/libbpf.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c index 2a82f49ce16f..8924404b9185 100644 --- a/tools/lib/bpf/libbpf.c +++ b/tools/lib/bpf/libbpf.c @@ -80,19 +80,25 @@ static const char * const attach_type_name[] = { [BPF_CGROUP_DEVICE] = "cgroup_device", [BPF_CGROUP_INET4_BIND] = "cgroup_inet4_bind", [BPF_CGROUP_INET6_BIND] = "cgroup_inet6_bind", + [BPF_CGROUP_UNIX_BIND] = "cgroup_unix_bind", [BPF_CGROUP_INET4_CONNECT] = "cgroup_inet4_connect", [BPF_CGROUP_INET6_CONNECT] = "cgroup_inet6_connect", + [BPF_CGROUP_UNIX_CONNECT] = "cgroup_unix_connect", [BPF_CGROUP_INET4_POST_BIND] = "cgroup_inet4_post_bind", [BPF_CGROUP_INET6_POST_BIND] = "cgroup_inet6_post_bind", [BPF_CGROUP_INET4_GETPEERNAME] = "cgroup_inet4_getpeername", [BPF_CGROUP_INET6_GETPEERNAME] = "cgroup_inet6_getpeername", + [BPF_CGROUP_UNIX_GETPEERNAME] = "cgroup_unix_getpeername", [BPF_CGROUP_INET4_GETSOCKNAME] = "cgroup_inet4_getsockname", [BPF_CGROUP_INET6_GETSOCKNAME] = "cgroup_inet6_getsockname", + [BPF_CGROUP_UNIX_GETSOCKNAME] = "cgroup_unix_getsockname", [BPF_CGROUP_UDP4_SENDMSG] = "cgroup_udp4_sendmsg", [BPF_CGROUP_UDP6_SENDMSG] = "cgroup_udp6_sendmsg", + [BPF_CGROUP_UNIX_SENDMSG] = "cgroup_unix_sendmsg", [BPF_CGROUP_SYSCTL] = "cgroup_sysctl", [BPF_CGROUP_UDP4_RECVMSG] = "cgroup_udp4_recvmsg", [BPF_CGROUP_UDP6_RECVMSG] = "cgroup_udp6_recvmsg", + [BPF_CGROUP_UNIX_RECVMSG] = "cgroup_unix_recvmsg", [BPF_CGROUP_GETSOCKOPT] = "cgroup_getsockopt", [BPF_CGROUP_SETSOCKOPT] = "cgroup_setsockopt", [BPF_SK_SKB_STREAM_PARSER] = "sk_skb_stream_parser", @@ -8590,16 +8596,22 @@ static const struct bpf_sec_def section_defs[] = { SEC_DEF("cgroup/post_bind6", CGROUP_SOCK, BPF_CGROUP_INET6_POST_BIND, SEC_ATTACHABLE), SEC_DEF("cgroup/bind4", CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_BIND, SEC_ATTACHABLE), SEC_DEF("cgroup/bind6", CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_BIND, SEC_ATTACHABLE), + SEC_DEF("cgroup/bindun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_BIND, SEC_ATTACHABLE), SEC_DEF("cgroup/connect4", CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_CONNECT, SEC_ATTACHABLE), SEC_DEF("cgroup/connect6", CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_CONNECT, SEC_ATTACHABLE), + SEC_DEF("cgroup/connectun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_CONNECT, SEC_ATTACHABLE), SEC_DEF("cgroup/sendmsg4", CGROUP_SOCK_ADDR, BPF_CGROUP_UDP4_SENDMSG, SEC_ATTACHABLE), SEC_DEF("cgroup/sendmsg6", CGROUP_SOCK_ADDR, BPF_CGROUP_UDP6_SENDMSG, SEC_ATTACHABLE), + SEC_DEF("cgroup/sendmsgun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_SENDMSG, SEC_ATTACHABLE), SEC_DEF("cgroup/recvmsg4", CGROUP_SOCK_ADDR, BPF_CGROUP_UDP4_RECVMSG, SEC_ATTACHABLE), SEC_DEF("cgroup/recvmsg6", CGROUP_SOCK_ADDR, BPF_CGROUP_UDP6_RECVMSG, SEC_ATTACHABLE), + SEC_DEF("cgroup/recvmsgun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_RECVMSG, SEC_ATTACHABLE), SEC_DEF("cgroup/getpeername4", CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETPEERNAME, SEC_ATTACHABLE), SEC_DEF("cgroup/getpeername6", CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETPEERNAME, SEC_ATTACHABLE), + SEC_DEF("cgroup/getpeernameun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_GETPEERNAME, SEC_ATTACHABLE), SEC_DEF("cgroup/getsockname4", CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETSOCKNAME, SEC_ATTACHABLE), SEC_DEF("cgroup/getsockname6", CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETSOCKNAME, SEC_ATTACHABLE), + SEC_DEF("cgroup/getsocknameun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_GETSOCKNAME, SEC_ATTACHABLE), SEC_DEF("cgroup/sysctl", CGROUP_SYSCTL, BPF_CGROUP_SYSCTL, SEC_ATTACHABLE), SEC_DEF("cgroup/getsockopt", CGROUP_SOCKOPT, BPF_CGROUP_GETSOCKOPT, SEC_ATTACHABLE), SEC_DEF("cgroup/setsockopt", CGROUP_SOCKOPT, BPF_CGROUP_SETSOCKOPT, SEC_ATTACHABLE), From patchwork Sat Dec 10 19:35:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13070414 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A757FC4167B for ; Sat, 10 Dec 2022 19:36:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229911AbiLJTgm (ORCPT ); Sat, 10 Dec 2022 14:36:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36548 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229888AbiLJTgk (ORCPT ); Sat, 10 Dec 2022 14:36:40 -0500 Received: from mail-wr1-x42c.google.com (mail-wr1-x42c.google.com [IPv6:2a00:1450:4864:20::42c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A00A017050 for ; Sat, 10 Dec 2022 11:36:39 -0800 (PST) Received: by mail-wr1-x42c.google.com with SMTP id f18so8298972wrj.5 for ; Sat, 10 Dec 2022 11:36:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=IlLqVAIfKwkNNYEYIe5HuOjNd0Gyl2+PjlkcPCojwO8=; b=ozXSq0FRayA/ZtFciPqK9TY4aXq2dcWv561apod8FesBsE/SqEACFg2kUqiWFiA5hI IgngL8+2aevJ4aAye+N1a90PsVPRmwodPrnyF2s1F24dLcLvnJl2WJusix79ZuYLE0s2 qj/HecV93zzl42hW6oFB4LbSW1ICM02vGnbMdl4+EjJkUtb4gUyQH7a/vggdfBySblwU pAGdabClatnsTVgYifD8OR0VnUGXmgOY8GniH2hx+lIkV7mlw0Ljs7681xCYYlEBXoXk lZr5dN8kzdq6dvJsJDZ6mG/ukbCJhrLA2HZP1Pk+FbD0QbegHUCJQv06SSS7aoZycSYC yg/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=IlLqVAIfKwkNNYEYIe5HuOjNd0Gyl2+PjlkcPCojwO8=; b=0VjTZEZrc9PK48Vzl2pvlYEjMQ2XtP8HFRBQWKdZar5H2uv3z/nL8l21IPCEcCvQQV 1jvLXcMwie9lCMKAsBHtElKfbv+l/OaGUe7G/wnCwk7hHkMumdWuXldZv4wI5xm3AMPM Br2PVNWN0qaLQjMDId0AbTmb0ifK7/kvFfu5KGj6g9rBZWsc/8nQ5+kTTq3TfUdxy6lg rcMddNRL1x2XrhkA+NWf+PX5ciX+njGJFXzu7QX4fnQ5I4sdAcnVxNgXdEH0EYUOX/Ih 5iMiRyzoi4JOqQN02f8hLHxImzjiPhnMsfwAhWesQxH/y1s+lnj5WjkV8c9C4LEhPRqv EeyA== X-Gm-Message-State: ANoB5pmmFuvTNvLW/ICRfCX++jXp99r/tVzgzmiAYgMKAth/OkU5/0IP btjb6MBup3hxsVK3Lzut1AOpX0NjqekRdw== X-Google-Smtp-Source: AA0mqf4rasznjrlg6WhUJTvJlb6cDOPH1fCwQhrnLohjbPkViFkwCG3MiGmhZ4eJf9gURGreRThdcg== X-Received: by 2002:a05:6000:156c:b0:241:fbef:29b5 with SMTP id 12-20020a056000156c00b00241fbef29b5mr12876442wrz.13.1670700997915; Sat, 10 Dec 2022 11:36:37 -0800 (PST) Received: from daandemeyer-fedora-PC1EV17T.thefacebook.com ([2620:10d:c092:400::5:366e]) by smtp.googlemail.com with ESMTPSA id az18-20020adfe192000000b002423a5d7cb1sm4584676wrb.113.2022.12.10.11.36.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 11:36:37 -0800 (PST) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v2 7/9] bpftool: Add support for cgroup unix socket address hooks Date: Sat, 10 Dec 2022 20:35:57 +0100 Message-Id: <20221210193559.371515-8-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221210193559.371515-1-daan.j.demeyer@gmail.com> References: <20221210193559.371515-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net --- .../bpftool/Documentation/bpftool-cgroup.rst | 21 ++++++++++++++----- tools/bpf/bpftool/cgroup.c | 17 ++++++++------- tools/bpf/bpftool/common.c | 6 ++++++ 3 files changed, 32 insertions(+), 12 deletions(-) diff --git a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst index bd015ec9847b..a2d990fa623b 100644 --- a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst +++ b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst @@ -34,13 +34,16 @@ CGROUP COMMANDS | *ATTACH_TYPE* := { **cgroup_inet_ingress** | **cgroup_inet_egress** | | **cgroup_inet_sock_create** | **cgroup_sock_ops** | | **cgroup_device** | **cgroup_inet4_bind** | **cgroup_inet6_bind** | -| **cgroup_inet4_post_bind** | **cgroup_inet6_post_bind** | -| **cgroup_inet4_connect** | **cgroup_inet6_connect** | +| **cgroup_unix_bind** | **cgroup_inet4_post_bind** | +| **cgroup_inet6_post_bind** | **cgroup_inet4_connect** | +| **cgroup_inet6_connect** | **cgroup_unix_connect** | | **cgroup_inet4_getpeername** | **cgroup_inet6_getpeername** | -| **cgroup_inet4_getsockname** | **cgroup_inet6_getsockname** | -| **cgroup_udp4_sendmsg** | **cgroup_udp6_sendmsg** | +| **cgroup_unix_getpeername** | **cgroup_inet4_getsockname** | +| **cgroup_inet6_getsockname** | **cgroup_udp4_sendmsg** | +| **cgroup_udp6_sendmsg** | **cgroup_unix_sendmsg** | | **cgroup_udp4_recvmsg** | **cgroup_udp6_recvmsg** | -| **cgroup_sysctl** | **cgroup_getsockopt** | **cgroup_setsockopt** | +| **cgroup_unix_recvmsg** | **cgroup_sysctl** | +| **cgroup_getsockopt** | **cgroup_setsockopt** | | **cgroup_inet_sock_release** } | *ATTACH_FLAGS* := { **multi** | **override** } @@ -98,25 +101,33 @@ DESCRIPTION **device** device access (since 4.15); **bind4** call to bind(2) for an inet4 socket (since 4.17); **bind6** call to bind(2) for an inet6 socket (since 4.17); + **bindun** call to bind(2) for a unix socket (since 6.3); **post_bind4** return from bind(2) for an inet4 socket (since 4.17); **post_bind6** return from bind(2) for an inet6 socket (since 4.17); **connect4** call to connect(2) for an inet4 socket (since 4.17); **connect6** call to connect(2) for an inet6 socket (since 4.17); + **connectun** call to connect(2) for a unix socket (since 6.3); **sendmsg4** call to sendto(2), sendmsg(2), sendmmsg(2) for an unconnected udp4 socket (since 4.18); **sendmsg6** call to sendto(2), sendmsg(2), sendmmsg(2) for an unconnected udp6 socket (since 4.18); + **sendmsgun** call to sendto(2), sendmsg(2), sendmmsg(2) for + an unconnected unix socket (since 6.3); **recvmsg4** call to recvfrom(2), recvmsg(2), recvmmsg(2) for an unconnected udp4 socket (since 5.2); **recvmsg6** call to recvfrom(2), recvmsg(2), recvmmsg(2) for an unconnected udp6 socket (since 5.2); + **recvmsgun** call to recvfrom(2), recvmsg(2), recvmmsg(2) for + an unconnected unix socket (since 6.3); **sysctl** sysctl access (since 5.2); **getsockopt** call to getsockopt (since 5.3); **setsockopt** call to setsockopt (since 5.3); **getpeername4** call to getpeername(2) for an inet4 socket (since 5.8); **getpeername6** call to getpeername(2) for an inet6 socket (since 5.8); + **getpeernameun** call to getpeername(2) for a unix socket (since 6.3); **getsockname4** call to getsockname(2) for an inet4 socket (since 5.8); **getsockname6** call to getsockname(2) for an inet6 socket (since 5.8). + **getsocknameun** call to getsockname(2) for a unix socket (since 6.3); **sock_release** closing an userspace inet socket (since 5.9). **bpftool cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG* diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c index b46a998d8f8d..3a57ca208a1c 100644 --- a/tools/bpf/bpftool/cgroup.c +++ b/tools/bpf/bpftool/cgroup.c @@ -26,13 +26,16 @@ " ATTACH_TYPE := { cgroup_inet_ingress | cgroup_inet_egress |\n" \ " cgroup_inet_sock_create | cgroup_sock_ops |\n" \ " cgroup_device | cgroup_inet4_bind |\n" \ - " cgroup_inet6_bind | cgroup_inet4_post_bind |\n" \ - " cgroup_inet6_post_bind | cgroup_inet4_connect |\n" \ - " cgroup_inet6_connect | cgroup_inet4_getpeername |\n" \ - " cgroup_inet6_getpeername | cgroup_inet4_getsockname |\n" \ - " cgroup_inet6_getsockname | cgroup_udp4_sendmsg |\n" \ - " cgroup_udp6_sendmsg | cgroup_udp4_recvmsg |\n" \ - " cgroup_udp6_recvmsg | cgroup_sysctl |\n" \ + " cgroup_inet6_bind | cgroup_unix_bind |\n" \ + " cgroup_inet4_post_bind | cgroup_inet6_post_bind |\n" \ + " cgroup_inet4_connect | cgroup_inet6_connect |\n" \ + " cgroup_unix_connect | cgroup_inet4_getpeername |\n" \ + " cgroup_inet6_getpeername | cgroup_unix_getpeername |\n" \ + " cgroup_inet4_getsockname | cgroup_inet6_getsockname |\n" \ + " cgroup_unix_getsockname | cgroup_udp4_sendmsg |\n" \ + " cgroup_udp6_sendmsg | cgroup_unix_sendmsg |\n" \ + " cgroup_udp4_recvmsg | cgroup_udp6_recvmsg |\n" \ + " cgroup_unix_recvmsg | cgroup_sysctl |\n" \ " cgroup_getsockopt | cgroup_setsockopt |\n" \ " cgroup_inet_sock_release }" diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c index c90b756945e3..94f48740fd2a 100644 --- a/tools/bpf/bpftool/common.c +++ b/tools/bpf/bpftool/common.c @@ -1065,19 +1065,25 @@ const char *bpf_attach_type_input_str(enum bpf_attach_type t) case BPF_CGROUP_DEVICE: return "device"; case BPF_CGROUP_INET4_BIND: return "bind4"; case BPF_CGROUP_INET6_BIND: return "bind6"; + case BPF_CGROUP_UNIX_BIND: return "bindun"; case BPF_CGROUP_INET4_CONNECT: return "connect4"; case BPF_CGROUP_INET6_CONNECT: return "connect6"; + case BPF_CGROUP_UNIX_CONNECT: return "connectun"; case BPF_CGROUP_INET4_POST_BIND: return "post_bind4"; case BPF_CGROUP_INET6_POST_BIND: return "post_bind6"; case BPF_CGROUP_INET4_GETPEERNAME: return "getpeername4"; case BPF_CGROUP_INET6_GETPEERNAME: return "getpeername6"; + case BPF_CGROUP_UNIX_GETPEERNAME: return "getpeernameun"; case BPF_CGROUP_INET4_GETSOCKNAME: return "getsockname4"; case BPF_CGROUP_INET6_GETSOCKNAME: return "getsockname6"; + case BPF_CGROUP_UNIX_GETSOCKNAME: return "getsocknameun"; case BPF_CGROUP_UDP4_SENDMSG: return "sendmsg4"; case BPF_CGROUP_UDP6_SENDMSG: return "sendmsg6"; + case BPF_CGROUP_UNIX_SENDMSG: return "sendmsgun"; case BPF_CGROUP_SYSCTL: return "sysctl"; case BPF_CGROUP_UDP4_RECVMSG: return "recvmsg4"; case BPF_CGROUP_UDP6_RECVMSG: return "recvmsg6"; + case BPF_CGROUP_UNIX_RECVMSG: return "recvmsgun"; case BPF_CGROUP_GETSOCKOPT: return "getsockopt"; case BPF_CGROUP_SETSOCKOPT: return "setsockopt"; case BPF_TRACE_RAW_TP: return "raw_tp"; From patchwork Sat Dec 10 19:35:58 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13070416 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7AA37C4332F for ; Sat, 10 Dec 2022 19:36:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229902AbiLJTgo (ORCPT ); Sat, 10 Dec 2022 14:36:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36552 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229913AbiLJTgm (ORCPT ); Sat, 10 Dec 2022 14:36:42 -0500 Received: from mail-wr1-x433.google.com (mail-wr1-x433.google.com [IPv6:2a00:1450:4864:20::433]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DED9F1706A for ; Sat, 10 Dec 2022 11:36:39 -0800 (PST) Received: by mail-wr1-x433.google.com with SMTP id w15so8280981wrl.9 for ; Sat, 10 Dec 2022 11:36:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ujkHO68+H2kWXGa1eSzUu+1gSiErJczAtQgFg50yd74=; b=P3P4zHIkqLdzPkpu6sWgxbxXHooQbFJ4+eM8ps27eYZ4HS62/3z+r2Qn+vKZbSewJ3 Yyg3S8Zhg8UiOAf9Ou0vrO/qSJ1MPFFjDGBi8p1tYRHw9wdLkaWgj68dgw2qrYcBQLn+ 6BfdBanNo8Pk4kGz03XLP4CRRu+Vjg2/cVQYy+sWOuk2NCijSMGxowuk6nbexH4DVfk9 FsCVkuFUCY0AVFmRTA7+oeTP8O+UdA4itcyVOJMFUCZ1fghITX7LPSKEuA1V2osY6WYX pBZcyYHiIJMlEtt5iZyKPjKT9HDeEWiFK1uGUDl68/y2Kv15IQ+UAeIOG9HkwUqlNqUK IWlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ujkHO68+H2kWXGa1eSzUu+1gSiErJczAtQgFg50yd74=; b=LyQaqaSRS5KgNvhmKrF1aluY+cG9km+y5sj8BYf7+vwP06Ndj7hXbm579/6vsR7BuD EQsaCp0h7VrI882PqvzZtogMmP3ymyGAFOZ6X996U/9IKJD3PhqkbWZS57SH4tZalLTy qN1WtKsUQDqVaBFPJq/uXzVQ4tTnofLElBXLu/8iOOtWU4EeOi2EY3agfYgpmqWzrZZz f6iPjzw6kGFV2SU/HW2HheDARmWon8yrjWZ9hqIqHXjPILKEEhDbkPNXWeSsHywrRyZB IqUqEeCFMf55tp73mHlSz2MopJ4DzYaFvqlH2TURwBd1InThCCc2zZc8G9nELkrAaQoN j5Uw== X-Gm-Message-State: ANoB5pk9c4pczmA41HzoCOi4Aq6YHtOuhvFpQx7DlHjdGM0MgqL7KFN2 hDulJx2xNvuXot7DuLLh/dNcdiMPacJdUQ== X-Google-Smtp-Source: AA0mqf5498DS6F2JxwoEY9hhatbgqm3Oaa8H82TrEAsca1t0Bx6ymAJGth3aatx6QwZv62TP6G0vjw== X-Received: by 2002:a05:6000:1111:b0:242:1b08:25ba with SMTP id z17-20020a056000111100b002421b0825bamr6324851wrw.39.1670700999069; Sat, 10 Dec 2022 11:36:39 -0800 (PST) Received: from daandemeyer-fedora-PC1EV17T.thefacebook.com ([2620:10d:c092:400::5:366e]) by smtp.googlemail.com with ESMTPSA id az18-20020adfe192000000b002423a5d7cb1sm4584676wrb.113.2022.12.10.11.36.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 11:36:38 -0800 (PST) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v2 8/9] selftests/bpf: Add tests for cgroup unix socket address hooks Date: Sat, 10 Dec 2022 20:35:58 +0100 Message-Id: <20221210193559.371515-9-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221210193559.371515-1-daan.j.demeyer@gmail.com> References: <20221210193559.371515-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net The unix socket address hooks do not support modifying the source address so we skip source address checks when we're running a unix socket address hook test. --- .../selftests/bpf/prog_tests/section_names.c | 30 ++++ .../testing/selftests/bpf/progs/bindun_prog.c | 36 +++++ .../selftests/bpf/progs/connectun_prog.c | 28 ++++ .../selftests/bpf/progs/recvmsgun_prog.c | 36 +++++ .../selftests/bpf/progs/sendmsgun_prog.c | 28 ++++ tools/testing/selftests/bpf/test_sock_addr.c | 137 +++++++++++++++++- 6 files changed, 288 insertions(+), 7 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/bindun_prog.c create mode 100644 tools/testing/selftests/bpf/progs/connectun_prog.c create mode 100644 tools/testing/selftests/bpf/progs/recvmsgun_prog.c create mode 100644 tools/testing/selftests/bpf/progs/sendmsgun_prog.c diff --git a/tools/testing/selftests/bpf/prog_tests/section_names.c b/tools/testing/selftests/bpf/prog_tests/section_names.c index fc5248e94a01..51ebc8e6065d 100644 --- a/tools/testing/selftests/bpf/prog_tests/section_names.c +++ b/tools/testing/selftests/bpf/prog_tests/section_names.c @@ -113,6 +113,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_BIND}, {0, BPF_CGROUP_INET6_BIND}, }, + { + "cgroup/bindun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_BIND}, + {0, BPF_CGROUP_UNIX_BIND}, + }, { "cgroup/connect4", {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_CONNECT}, @@ -123,6 +128,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_CONNECT}, {0, BPF_CGROUP_INET6_CONNECT}, }, + { + "cgroup/connectun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_CONNECT}, + {0, BPF_CGROUP_UNIX_CONNECT}, + }, { "cgroup/sendmsg4", {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UDP4_SENDMSG}, @@ -133,6 +143,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UDP6_SENDMSG}, {0, BPF_CGROUP_UDP6_SENDMSG}, }, + { + "cgroup/sendmsgun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_SENDMSG}, + {0, BPF_CGROUP_UNIX_SENDMSG}, + }, { "cgroup/recvmsg4", {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UDP4_RECVMSG}, @@ -143,6 +158,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UDP6_RECVMSG}, {0, BPF_CGROUP_UDP6_RECVMSG}, }, + { + "cgroup/recvmsgun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_RECVMSG}, + {0, BPF_CGROUP_UNIX_RECVMSG}, + }, { "cgroup/sysctl", {0, BPF_PROG_TYPE_CGROUP_SYSCTL, BPF_CGROUP_SYSCTL}, @@ -168,6 +188,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETPEERNAME}, {0, BPF_CGROUP_INET6_GETPEERNAME}, }, + { + "cgroup/getpeernameun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_GETPEERNAME}, + {0, BPF_CGROUP_UNIX_GETPEERNAME}, + }, { "cgroup/getsockname4", {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETSOCKNAME}, @@ -178,6 +203,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETSOCKNAME}, {0, BPF_CGROUP_INET6_GETSOCKNAME}, }, + { + "cgroup/getsocknameun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_GETSOCKNAME}, + {0, BPF_CGROUP_UNIX_GETSOCKNAME}, + }, }; static void test_prog_type_by_name(const struct sec_name_test *test) diff --git a/tools/testing/selftests/bpf/progs/bindun_prog.c b/tools/testing/selftests/bpf/progs/bindun_prog.c new file mode 100644 index 000000000000..1183063ef745 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/bindun_prog.c @@ -0,0 +1,36 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */ + +#include + +#include +#include +#include + +#include + +#define DST_REWRITE_PATH "\0bpf_cgroup_unix_test_rewrite" + +SEC("cgroup/bindun") +int bind_un_prog(struct bpf_sock_addr *ctx) +{ + struct bpf_sock *sk; + + sk = ctx->sk; + if (!sk) + return 0; + + if (sk->family != AF_UNIX) + return 0; + + if (ctx->type != SOCK_STREAM && ctx->type != SOCK_DGRAM) + return 0; + + memcpy(ctx->user_path, DST_REWRITE_PATH, sizeof(DST_REWRITE_PATH)); + ctx->user_addrlen = offsetof(struct sockaddr_un, sun_path) + + sizeof(DST_REWRITE_PATH) - 1; + + return 1; +} + +char _license[] SEC("license") = "GPL"; diff --git a/tools/testing/selftests/bpf/progs/connectun_prog.c b/tools/testing/selftests/bpf/progs/connectun_prog.c new file mode 100644 index 000000000000..f443fdb862fe --- /dev/null +++ b/tools/testing/selftests/bpf/progs/connectun_prog.c @@ -0,0 +1,28 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */ + +#include + +#include +#include +#include + +#include + +#define DST_REWRITE_PATH "\0bpf_cgroup_unix_test_rewrite" + +SEC("cgroup/connectun") +int connect_un_prog(struct bpf_sock_addr *ctx) +{ + if (ctx->type != SOCK_STREAM && ctx->type != SOCK_DGRAM) + return 0; + + /* Rewrite destination. */ + memcpy(ctx->user_path, DST_REWRITE_PATH, sizeof(DST_REWRITE_PATH)); + ctx->user_addrlen = offsetof(struct sockaddr_un, sun_path) + + sizeof(DST_REWRITE_PATH) - 1; + + return 1; +} + +char _license[] SEC("license") = "GPL"; diff --git a/tools/testing/selftests/bpf/progs/recvmsgun_prog.c b/tools/testing/selftests/bpf/progs/recvmsgun_prog.c new file mode 100644 index 000000000000..0334b9420adc --- /dev/null +++ b/tools/testing/selftests/bpf/progs/recvmsgun_prog.c @@ -0,0 +1,36 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */ + +#include + +#include +#include +#include + +#include + +#define SERVUN_PATH "\0bpf_cgroup_unix_test" + +SEC("cgroup/recvmsgun") +int recvmsgun_prog(struct bpf_sock_addr *ctx) +{ + struct bpf_sock *sk; + + sk = ctx->sk; + if (!sk) + return 1; + + if (sk->family != AF_UNIX) + return 1; + + if (ctx->type != SOCK_STREAM && ctx->type != SOCK_DGRAM) + return 1; + + memcpy(ctx->user_path, SERVUN_PATH, sizeof(SERVUN_PATH)); + ctx->user_addrlen = offsetof(struct sockaddr_un, sun_path) + + sizeof(SERVUN_PATH) - 1; + + return 1; +} + +char _license[] SEC("license") = "GPL"; diff --git a/tools/testing/selftests/bpf/progs/sendmsgun_prog.c b/tools/testing/selftests/bpf/progs/sendmsgun_prog.c new file mode 100644 index 000000000000..0f6020e5d463 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/sendmsgun_prog.c @@ -0,0 +1,28 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */ + +#include + +#include +#include +#include + +#include + +#define DST_REWRITE_PATH "\0bpf_cgroup_unix_test_rewrite" + +SEC("cgroup/sendmsgun") +int sendmsg_un_prog(struct bpf_sock_addr *ctx) +{ + if (ctx->type != SOCK_DGRAM) + return 0; + + /* Rewrite destination. */ + memcpy(ctx->user_path, DST_REWRITE_PATH, sizeof(DST_REWRITE_PATH)); + ctx->user_addrlen = offsetof(struct sockaddr_un, sun_path) + + sizeof(DST_REWRITE_PATH) - 1; + + return 1; +} + +char _license[] SEC("license") = "GPL"; diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c index 6a618c8f477c..c96322bcc6c8 100644 --- a/tools/testing/selftests/bpf/test_sock_addr.c +++ b/tools/testing/selftests/bpf/test_sock_addr.c @@ -12,6 +12,7 @@ #include #include #include +#include #include @@ -28,12 +29,16 @@ #define CG_PATH "/foo" #define CONNECT4_PROG_PATH "./connect4_prog.bpf.o" #define CONNECT6_PROG_PATH "./connect6_prog.bpf.o" +#define CONNECTUN_PROG_PATH "./connectun_prog.bpf.o" #define SENDMSG4_PROG_PATH "./sendmsg4_prog.bpf.o" #define SENDMSG6_PROG_PATH "./sendmsg6_prog.bpf.o" +#define SENDMSGUN_PROG_PATH "./sendmsgun_prog.bpf.o" #define RECVMSG4_PROG_PATH "./recvmsg4_prog.bpf.o" #define RECVMSG6_PROG_PATH "./recvmsg6_prog.bpf.o" +#define RECVMSGUN_PROG_PATH "./recvmsgun_prog.bpf.o" #define BIND4_PROG_PATH "./bind4_prog.bpf.o" #define BIND6_PROG_PATH "./bind6_prog.bpf.o" +#define BINDUN_PROG_PATH "./bindun_prog.bpf.o" #define SERV4_IP "192.168.1.254" #define SERV4_REWRITE_IP "127.0.0.1" @@ -51,6 +56,9 @@ #define SERV6_PORT 6060 #define SERV6_REWRITE_PORT 6666 +#define SERVUN_ADDRESS "bpf_cgroup_unix_test" +#define SERVUN_REWRITE_ADDRESS "bpf_cgroup_unix_test_rewrite" + #define INET_NTOP_BUF 40 struct sock_addr_test; @@ -88,8 +96,10 @@ struct sock_addr_test { static int bind4_prog_load(const struct sock_addr_test *test); static int bind6_prog_load(const struct sock_addr_test *test); +static int bindun_prog_load(const struct sock_addr_test *test); static int connect4_prog_load(const struct sock_addr_test *test); static int connect6_prog_load(const struct sock_addr_test *test); +static int connectun_prog_load(const struct sock_addr_test *test); static int sendmsg_allow_prog_load(const struct sock_addr_test *test); static int sendmsg_deny_prog_load(const struct sock_addr_test *test); static int recvmsg_allow_prog_load(const struct sock_addr_test *test); @@ -102,6 +112,8 @@ static int recvmsg6_rw_c_prog_load(const struct sock_addr_test *test); static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test); static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test); static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test); +static int sendmsgun_prog_load(const struct sock_addr_test *test); +static int recvmsgun_prog_load(const struct sock_addr_test *test); static struct sock_addr_test tests[] = { /* bind */ @@ -217,6 +229,20 @@ static struct sock_addr_test tests[] = { NULL, SUCCESS, }, + { + "bindun: rewrite path", + bindun_prog_load, + BPF_CGROUP_UNIX_BIND, + BPF_CGROUP_UNIX_BIND, + AF_UNIX, + SOCK_STREAM, + SERVUN_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + SUCCESS, + }, /* connect */ { @@ -331,6 +357,34 @@ static struct sock_addr_test tests[] = { SRC6_REWRITE_IP, SUCCESS, }, + { + "connectun: rewrite SOCK_STREAM path", + connectun_prog_load, + BPF_CGROUP_UNIX_CONNECT, + BPF_CGROUP_UNIX_CONNECT, + AF_UNIX, + SOCK_STREAM, + SERVUN_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + SUCCESS, + }, + { + "connectun: rewrite SOCK_DGRAM path", + connectun_prog_load, + BPF_CGROUP_UNIX_CONNECT, + BPF_CGROUP_UNIX_CONNECT, + AF_UNIX, + SOCK_DGRAM, + SERVUN_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + SUCCESS, + }, /* sendmsg */ { @@ -515,6 +569,20 @@ static struct sock_addr_test tests[] = { SRC6_REWRITE_IP, SYSCALL_EPERM, }, + { + "sendmsgun: rewrite SOCK_DGRAM path", + sendmsgun_prog_load, + BPF_CGROUP_UNIX_SENDMSG, + BPF_CGROUP_UNIX_SENDMSG, + AF_UNIX, + SOCK_DGRAM, + SERVUN_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + SUCCESS, + }, /* recvmsg */ { @@ -601,6 +669,20 @@ static struct sock_addr_test tests[] = { SERV6_IP, SUCCESS, }, + { + "recvmsgun: rewrite SOCK_DGRAM path", + recvmsgun_prog_load, + BPF_CGROUP_UNIX_RECVMSG, + BPF_CGROUP_UNIX_RECVMSG, + AF_UNIX, + SOCK_DGRAM, + SERVUN_REWRITE_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + SUCCESS, + }, }; static int mk_sockaddr(int domain, const char *ip, unsigned short port, @@ -608,8 +690,9 @@ static int mk_sockaddr(int domain, const char *ip, unsigned short port, { struct sockaddr_in6 *addr6; struct sockaddr_in *addr4; + struct sockaddr_un *addrun; - if (domain != AF_INET && domain != AF_INET6) { + if (domain != AF_INET && domain != AF_INET6 && domain != AF_UNIX) { log_err("Unsupported address family"); return -1; } @@ -638,6 +721,15 @@ static int mk_sockaddr(int domain, const char *ip, unsigned short port, return -1; } *addr_len = sizeof(struct sockaddr_in6); + } else if (domain == AF_UNIX) { + if (*addr_len < sizeof(struct sockaddr_un)) + return -1; + addrun = (struct sockaddr_un *)addr; + addrun->sun_family = domain; + addrun->sun_path[0] = 0; + strcpy(addrun->sun_path + 1, ip); + *addr_len = offsetof(struct sockaddr_un, sun_path) + 1 + + strlen(ip); } return 0; @@ -706,6 +798,11 @@ static int bind6_prog_load(const struct sock_addr_test *test) return load_path(test, BIND6_PROG_PATH); } +static int bindun_prog_load(const struct sock_addr_test *test) +{ + return load_path(test, BINDUN_PROG_PATH); +} + static int connect4_prog_load(const struct sock_addr_test *test) { return load_path(test, CONNECT4_PROG_PATH); @@ -716,6 +813,11 @@ static int connect6_prog_load(const struct sock_addr_test *test) return load_path(test, CONNECT6_PROG_PATH); } +static int connectun_prog_load(const struct sock_addr_test *test) +{ + return load_path(test, CONNECTUN_PROG_PATH); +} + static int xmsg_ret_only_prog_load(const struct sock_addr_test *test, int32_t rc) { @@ -889,12 +991,23 @@ static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test) return load_path(test, SENDMSG6_PROG_PATH); } +static int sendmsgun_prog_load(const struct sock_addr_test *test) +{ + return load_path(test, SENDMSGUN_PROG_PATH); +} + +static int recvmsgun_prog_load(const struct sock_addr_test *test) +{ + return load_path(test, RECVMSGUN_PROG_PATH); +} + static int cmp_addr(const struct sockaddr_storage *addr1, socklen_t addr1_len, const struct sockaddr_storage *addr2, socklen_t addr2_len, int cmp_port) { const struct sockaddr_in *four1, *four2; const struct sockaddr_in6 *six1, *six2; + const struct sockaddr_un *un1, *un2; if (addr1->ss_family != addr2->ss_family) return -1; @@ -913,6 +1026,10 @@ static int cmp_addr(const struct sockaddr_storage *addr1, socklen_t addr1_len, return !((six1->sin6_port == six2->sin6_port || !cmp_port) && !memcmp(&six1->sin6_addr, &six2->sin6_addr, sizeof(struct in6_addr))); + } else if (addr1->ss_family == AF_UNIX) { + un1 = (const struct sockaddr_un *)addr1; + un2 = (const struct sockaddr_un *)addr2; + return memcmp(un1, un2, addr1_len); } return -1; @@ -992,7 +1109,7 @@ static int connect_to_server(int type, const struct sockaddr_storage *addr, domain = addr->ss_family; - if (domain != AF_INET && domain != AF_INET6) { + if (domain != AF_INET && domain != AF_INET6 && domain != AF_UNIX) { log_err("Unsupported address family"); goto err; } @@ -1066,7 +1183,7 @@ static int sendmsg_to_server(int type, const struct sockaddr_storage *addr, domain = addr->ss_family; - if (domain != AF_INET && domain != AF_INET6) { + if (domain != AF_INET && domain != AF_INET6 && domain != AF_UNIX) { log_err("Unsupported address family"); goto err; } @@ -1095,7 +1212,7 @@ static int sendmsg_to_server(int type, const struct sockaddr_storage *addr, hdr.msg_control = &control6; hdr.msg_controllen = sizeof(control6.buf); } - if (init_pktinfo(domain, CMSG_FIRSTHDR(&hdr))) { + if (domain != AF_UNIX && init_pktinfo(domain, CMSG_FIRSTHDR(&hdr))) { log_err("Fail to init pktinfo"); goto err; } @@ -1257,10 +1374,11 @@ static int run_connect_test_case(const struct sock_addr_test *test) if (cmp_peer_addr(clientfd, &expected_addr, expected_addr_len)) goto err; - if (cmp_local_ip(clientfd, &expected_src_addr, expected_src_addr_len)) + if (test->domain != AF_UNIX && + cmp_local_ip(clientfd, &expected_src_addr, expected_src_addr_len)) goto err; - if (test->type == SOCK_STREAM) { + if (test->domain != AF_UNIX && test->type == SOCK_STREAM) { /* Test TCP Fast Open scenario */ clientfd = fastconnect_to_server(&requested_addr, addr_len); if (clientfd == -1) @@ -1339,7 +1457,8 @@ static int run_xmsg_test_case(const struct sock_addr_test *test, int max_cmsg) &recvmsg_addr_len) == -1) goto err; - if (cmp_addr(&recvmsg_addr, recvmsg_addr_len, &expected_addr, + if (test->domain != AF_UNIX && + cmp_addr(&recvmsg_addr, recvmsg_addr_len, &expected_addr, expected_addr_len, /*cmp_port*/ 0)) goto err; @@ -1382,18 +1501,22 @@ static int run_test_case(int cgfd, const struct sock_addr_test *test) switch (test->attach_type) { case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: err = run_bind_test_case(test); break; case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: err = run_connect_test_case(test); break; case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: err = run_xmsg_test_case(test, 1); break; case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: err = run_xmsg_test_case(test, 0); break; default: From patchwork Sat Dec 10 19:35:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13070417 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32FEFC10F1B for ; Sat, 10 Dec 2022 19:36:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229901AbiLJTgq (ORCPT ); Sat, 10 Dec 2022 14:36:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36548 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229760AbiLJTgn (ORCPT ); Sat, 10 Dec 2022 14:36:43 -0500 Received: from mail-wm1-x32e.google.com (mail-wm1-x32e.google.com [IPv6:2a00:1450:4864:20::32e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1985A1740B for ; Sat, 10 Dec 2022 11:36:42 -0800 (PST) Received: by mail-wm1-x32e.google.com with SMTP id c65-20020a1c3544000000b003cfffd00fc0so2131412wma.1 for ; Sat, 10 Dec 2022 11:36:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=2LfFvmK+WGuHfkEmmrOFW05XEXlYY/ztLknoWjjqbc4=; b=UxNL5Qh+SZIJblsz0G+FXNDfghFDuNbmOK9BPcNAaDEWfuVGwDy2cm6iwRPAGFrVRT U7iXYz+u/muTkoWufii7FLGtA14rUiP1Tx+l58aucGE+F2KKcS8R6f6/sPE5PIqJwwUK pcBM736o0HUjGOWi+Dl5VGGelNhv4qFvZJhrUVxq8WFAe2KYInqri3dfUOYPu/72q89s QmkoULLBNMMzbtrHu41GNup8UbxNhgSrLAy4qGpZJ1vj5xF5ZNW9suV75HhrSRM+2L9b rMr1wKGtNlj7/UDllCx/W7hIwyr9oxoP+v/s4kGJzlYgbf7c7zM3rkmr7eQUffQmlM2c TFHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=2LfFvmK+WGuHfkEmmrOFW05XEXlYY/ztLknoWjjqbc4=; b=x5qmCbUhsD0CmuZKqQV8YIFpAoaG281XKaTnl7O26vf9Ijx43FdsHUsJyR52RgZb4H we+5mud9pUo0Lnz5l16Ss3tgx5wk0eqNTXB28uesPhTOXyGLR2rLdE75egA4teBDvU/v VtcnHHwMc4Kmxp3joHeDLpcwzkT+PunWd4HBZ3d2pwYxxh0L6uyQ03AADBOzTAbkWdXV Q3NSqLEeBleLnoMrSI4OvMfqiYD6DS2+EZLKladNNXxbIQzoNMA2ef+trSSxMdb8bTdH d2deaUGwbj1chARhoscKAFXyau6l0lGi+syRDaI4p2TWZm+e154eqpXMKkkrr5nqPd5N TKRw== X-Gm-Message-State: ANoB5plTmQ+AfBUUJBldogSgyGcviA2oFaM7XSQEAXpHbJEeD0a62vRS UCGEIrnB1n1Dw5snuHklkCj1E87epm6tmg== X-Google-Smtp-Source: AA0mqf4y+uHaSz3j9LjgNU+rgU/wNvqcxE/vsuTUoSHBlSHKtgzDrjaiCw4Yvhag4RuuEtaF6DQ6Pg== X-Received: by 2002:a05:600c:3b8e:b0:3cf:d428:21d6 with SMTP id n14-20020a05600c3b8e00b003cfd42821d6mr8827019wms.3.1670701000282; Sat, 10 Dec 2022 11:36:40 -0800 (PST) Received: from daandemeyer-fedora-PC1EV17T.thefacebook.com ([2620:10d:c092:400::5:366e]) by smtp.googlemail.com with ESMTPSA id az18-20020adfe192000000b002423a5d7cb1sm4584676wrb.113.2022.12.10.11.36.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 11:36:39 -0800 (PST) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v2 9/9] documentation/bpf: Document cgroup unix socket address hooks Date: Sat, 10 Dec 2022 20:35:59 +0100 Message-Id: <20221210193559.371515-10-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221210193559.371515-1-daan.j.demeyer@gmail.com> References: <20221210193559.371515-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net --- Documentation/bpf/libbpf/program_types.rst | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/Documentation/bpf/libbpf/program_types.rst b/Documentation/bpf/libbpf/program_types.rst index ad4d4d5eecb0..06168ad73d5e 100644 --- a/Documentation/bpf/libbpf/program_types.rst +++ b/Documentation/bpf/libbpf/program_types.rst @@ -56,6 +56,18 @@ described in more detail in the footnotes. | | ``BPF_CGROUP_UDP6_RECVMSG`` | ``cgroup/recvmsg6`` | | + +----------------------------------------+----------------------------------+-----------+ | | ``BPF_CGROUP_UDP6_SENDMSG`` | ``cgroup/sendmsg6`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_BIND`` | ``cgroup/bindun`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_CONNECT`` | ``cgroup/connectun`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_SENDMSG`` | ``cgroup/sendmsgun`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_RECVMSG`` | ``cgroup/recvmsgun`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_GETPEERNAME`` | ``cgroup/getpeernameun`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_GETSOCKNAME`` | ``cgroup/getsocknameun`` | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------+ | ``BPF_PROG_TYPE_CGROUP_SOCK`` | ``BPF_CGROUP_INET4_POST_BIND`` | ``cgroup/post_bind4`` | | + +----------------------------------------+----------------------------------+-----------+