From patchwork Fri Apr 21 16:27:09 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13220327 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DE550C77B61 for ; Fri, 21 Apr 2023 16:31:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229712AbjDUQbX (ORCPT ); Fri, 21 Apr 2023 12:31:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44752 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231719AbjDUQbX (ORCPT ); Fri, 21 Apr 2023 12:31:23 -0400 Received: from mail-ej1-x62a.google.com (mail-ej1-x62a.google.com [IPv6:2a00:1450:4864:20::62a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DAAA414F4F for ; Fri, 21 Apr 2023 09:31:21 -0700 (PDT) Received: by mail-ej1-x62a.google.com with SMTP id a640c23a62f3a-94f7a0818aeso254607166b.2 for ; Fri, 21 Apr 2023 09:31:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682094680; x=1684686680; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=DF2wdY0uirUnTvLTnOfvh/2+qPjtNw3YvfQUsz1mrYI=; b=gV3d9lV123bpc+iTV1V0ee+awTsgmb3rDexVrMacQahDbXeLfXr4Ktb/pArdm8yraK zqkFfzAAtgv/jIME1bEuKFjjXK5R+KknM1vXg1lwyyyXWEabeBXE7DGTMNeEZnFWq9oy cL9JjCcsC8uzcxyztLkilIVyyaaW0WG21icogXwBrzNCHS0v00tF9SS/lpww8+/LdypT V4i3eT9r9wuGqMABacuA4c92ViomzIB4Q/T6oZYc3ZVeOzTUq4g0ifmdFgLTB+eMr7eI 3mgOe1PhnJLnPPyr1mwsSdtDJrkWHy23hJTqFIR4uhLz/AmwTHoKn8Ggb2GaLOmUwoin fVVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682094680; x=1684686680; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=DF2wdY0uirUnTvLTnOfvh/2+qPjtNw3YvfQUsz1mrYI=; b=GYE0yjiY8UK+4NJE/f8+C9/jD08Tppwih+dncvEK4cpJ1ghSbh9xB+bKr5P0RwBnSp hLVkWdSh3pUl9Y80Opf4mkoQbjuXvx1O8IGDD6P2ci3dfT6X9vPYd/q2QZlYjLa01rUN omR7SS9p0pw1w3NR9vRbvGxV2L/npqoPAiMJUDwiF6jVwk+O2kL/vUXksbwU3bW2J5U4 rkMW654IISoiStH+dVO+QywfIv4ZQI/Zp8tf7IGw6Ohkfj3oAYFmuFbC59KDWlYFFdPK 5jGxLVP4RIyKDYLSmjjN8eRKokQZ1zOyke8sTbFd+MAxUwflzch5en3skwuPiV5ux2sx 4HUw== X-Gm-Message-State: AAQBX9c09Zik090pG0wIkSwZX4lsYCcapFuSvf49LTebeLuMCWb5nUuU c9nIhY2UFHRC53+OjhNw6hz46G7Kwha9tA== X-Google-Smtp-Source: AKy350ZeSk/3JDPKUDFoW4aVyR9L+V317oc2hD55kdCKYmI8hEpYOus22mLCOuxEg8F9vQS1XVO8DQ== X-Received: by 2002:a17:906:6b83:b0:94f:3d6e:f584 with SMTP id l3-20020a1709066b8300b0094f3d6ef584mr2924115ejr.5.1682094679798; Fri, 21 Apr 2023 09:31:19 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:864b:8201:e534:34f4:1c34:8de7]) by smtp.googlemail.com with ESMTPSA id k9-20020a170906970900b009534211cc97sm2248578ejx.159.2023.04.21.09.31.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Apr 2023 09:31:19 -0700 (PDT) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v3 01/10] selftests/bpf: Add missing section name tests for getpeername/getsockname Date: Fri, 21 Apr 2023 18:27:09 +0200 Message-Id: <20230421162718.440230-2-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230421162718.440230-1-daan.j.demeyer@gmail.com> References: <20230421162718.440230-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net These were missed when these hooks were first added so add them now instead to make sure every sockaddr hook has a matching section name test. Signed-off-by: Daan De Meyer --- .../selftests/bpf/prog_tests/section_names.c | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/section_names.c b/tools/testing/selftests/bpf/prog_tests/section_names.c index 8b571890c57e..fc5248e94a01 100644 --- a/tools/testing/selftests/bpf/prog_tests/section_names.c +++ b/tools/testing/selftests/bpf/prog_tests/section_names.c @@ -158,6 +158,26 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCKOPT, BPF_CGROUP_SETSOCKOPT}, {0, BPF_CGROUP_SETSOCKOPT}, }, + { + "cgroup/getpeername4", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETPEERNAME}, + {0, BPF_CGROUP_INET4_GETPEERNAME}, + }, + { + "cgroup/getpeername6", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETPEERNAME}, + {0, BPF_CGROUP_INET6_GETPEERNAME}, + }, + { + "cgroup/getsockname4", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETSOCKNAME}, + {0, BPF_CGROUP_INET4_GETSOCKNAME}, + }, + { + "cgroup/getsockname6", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETSOCKNAME}, + {0, BPF_CGROUP_INET6_GETSOCKNAME}, + }, }; static void test_prog_type_by_name(const struct sec_name_test *test) From patchwork Fri Apr 21 16:27:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13220329 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1FF63C77B7C for ; Fri, 21 Apr 2023 16:31:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231728AbjDUQb0 (ORCPT ); Fri, 21 Apr 2023 12:31:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44782 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231459AbjDUQbZ (ORCPT ); Fri, 21 Apr 2023 12:31:25 -0400 Received: from mail-ej1-x62b.google.com (mail-ej1-x62b.google.com [IPv6:2a00:1450:4864:20::62b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C081293DE for ; Fri, 21 Apr 2023 09:31:22 -0700 (PDT) Received: by mail-ej1-x62b.google.com with SMTP id a640c23a62f3a-94f4b911570so256911266b.0 for ; Fri, 21 Apr 2023 09:31:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682094681; x=1684686681; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=5IDMfFvqa0HfGea3cDrMluz4M37S8ZiFE/sCKg2zqVQ=; b=OdST6DKi51HFRb/oBMLVBFuU1BhsJvwJcLoGLqy5qQwIMrnxEQfkq/bQ3TJW0nanv4 BJVuObZsXmNebAHHr/cZnSCEWcgEkBXOQD0iL+9/yXC/cIFrTQJR7BF6UdokvEP7Snst TgT2g4+i8Y/7/wpTkcOJeqphMORmCsCKnOLjfctDNSZPjSdQRIpsKE99LaVwppxSQ7DF JGCZidn4ZHnFAe8WEniJjDh9SvmAqWKNQOKQrsOJ5xQEbFaPRDhAs1023jHvXAFsCDxs 9z1wR9FLWBjmwrXo5NGcdlv0Z/y9dq+ii1dyPGB7dZBgXjRTSzTjLugE+esbPIuM2PVJ 5CRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682094681; x=1684686681; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=5IDMfFvqa0HfGea3cDrMluz4M37S8ZiFE/sCKg2zqVQ=; b=QvjSxia8W18busCmK+iiB4MF3W9ZmfwlcSGuK+Oh5C+HHcts651BgNOVCBwyxw2AWl IGdCiPvH7BAvOiKjF+QqfozoUc9ZyTHtNU5o4b4OlmPNkPmJrYd5ocXcxYKAJ2QLpchi cuUrqdeyhCMC8zx+qaqHKt51itI0LeaH/ciZaMV90B37gp3KUtCA3ID6Vvd3WS1x8tHi Bmu+yWEMWc750l2Wot4GTSIr0uK57AWIUhOnQSpFWAqiOy0QIoIrp+Ho+l6VeGZw4ItX 9WL1hNqJiHITsKQNwVWDnJKs3rIgf/JaqGJgqITBBD5t8VOV7uZS7zCWe7hKL5Hc47mL wzXw== X-Gm-Message-State: AAQBX9frK9l/AYNK3K2Tu1rpG/EMRtuenjBtNbDkmPu1geRN5ZSO/uUA GumLU0nuiWmzoLZr5H+5KCdVoNKaosBUaA== X-Google-Smtp-Source: AKy350Zc8a4YbJnEcRx2ildgOiklBq7xps6UC4WEewrt57V657y7uPAFxl1LlEHpo7V+aCFAs+RrpA== X-Received: by 2002:a17:907:2982:b0:8b8:c06e:52d8 with SMTP id eu2-20020a170907298200b008b8c06e52d8mr2759331ejc.36.1682094680772; Fri, 21 Apr 2023 09:31:20 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:864b:8201:e534:34f4:1c34:8de7]) by smtp.googlemail.com with ESMTPSA id k9-20020a170906970900b009534211cc97sm2248578ejx.159.2023.04.21.09.31.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Apr 2023 09:31:20 -0700 (PDT) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v3 02/10] selftests/bpf: Track sockaddr length in sock addr tests Date: Fri, 21 Apr 2023 18:27:10 +0200 Message-Id: <20230421162718.440230-3-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230421162718.440230-1-daan.j.demeyer@gmail.com> References: <20230421162718.440230-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net In preparation for adding unix socket support to the bpf cgroup socket address hooks, start tracking the sockaddr length in the sockaddr tests which will be required when adding tests for unix sockets. Signed-off-by: Daan De Meyer --- tools/testing/selftests/bpf/test_sock_addr.c | 130 ++++++++++++------- 1 file changed, 85 insertions(+), 45 deletions(-) diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c index 2c89674fc62c..6a618c8f477c 100644 --- a/tools/testing/selftests/bpf/test_sock_addr.c +++ b/tools/testing/selftests/bpf/test_sock_addr.c @@ -604,7 +604,7 @@ static struct sock_addr_test tests[] = { }; static int mk_sockaddr(int domain, const char *ip, unsigned short port, - struct sockaddr *addr, socklen_t addr_len) + struct sockaddr *addr, socklen_t *addr_len) { struct sockaddr_in6 *addr6; struct sockaddr_in *addr4; @@ -614,10 +614,10 @@ static int mk_sockaddr(int domain, const char *ip, unsigned short port, return -1; } - memset(addr, 0, addr_len); + memset(addr, 0, *addr_len); if (domain == AF_INET) { - if (addr_len < sizeof(struct sockaddr_in)) + if (*addr_len < sizeof(struct sockaddr_in)) return -1; addr4 = (struct sockaddr_in *)addr; addr4->sin_family = domain; @@ -626,8 +626,9 @@ static int mk_sockaddr(int domain, const char *ip, unsigned short port, log_err("Invalid IPv4: %s", ip); return -1; } + *addr_len = sizeof(struct sockaddr_in); } else if (domain == AF_INET6) { - if (addr_len < sizeof(struct sockaddr_in6)) + if (*addr_len < sizeof(struct sockaddr_in6)) return -1; addr6 = (struct sockaddr_in6 *)addr; addr6->sin6_family = domain; @@ -636,6 +637,7 @@ static int mk_sockaddr(int domain, const char *ip, unsigned short port, log_err("Invalid IPv6: %s", ip); return -1; } + *addr_len = sizeof(struct sockaddr_in6); } return 0; @@ -749,6 +751,7 @@ static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test) { struct sockaddr_in dst4_rw_addr; struct in_addr src4_rw_ip; + socklen_t dst4_rw_addr_len = sizeof(dst4_rw_addr); if (inet_pton(AF_INET, SRC4_REWRITE_IP, (void *)&src4_rw_ip) != 1) { log_err("Invalid IPv4: %s", SRC4_REWRITE_IP); @@ -757,7 +760,7 @@ static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test) if (mk_sockaddr(AF_INET, SERV4_REWRITE_IP, SERV4_REWRITE_PORT, (struct sockaddr *)&dst4_rw_addr, - sizeof(dst4_rw_addr)) == -1) + &dst4_rw_addr_len) == -1) return -1; struct bpf_insn insns[] = { @@ -812,6 +815,7 @@ static int sendmsg6_rw_dst_asm_prog_load(const struct sock_addr_test *test, { struct sockaddr_in6 dst6_rw_addr; struct in6_addr src6_rw_ip; + socklen_t dst6_rw_addr_len = sizeof(dst6_rw_addr); if (inet_pton(AF_INET6, SRC6_REWRITE_IP, (void *)&src6_rw_ip) != 1) { log_err("Invalid IPv6: %s", SRC6_REWRITE_IP); @@ -820,7 +824,7 @@ static int sendmsg6_rw_dst_asm_prog_load(const struct sock_addr_test *test, if (mk_sockaddr(AF_INET6, rw_dst_ip, SERV6_REWRITE_PORT, (struct sockaddr *)&dst6_rw_addr, - sizeof(dst6_rw_addr)) == -1) + &dst6_rw_addr_len) == -1) return -1; struct bpf_insn insns[] = { @@ -885,8 +889,9 @@ static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test) return load_path(test, SENDMSG6_PROG_PATH); } -static int cmp_addr(const struct sockaddr_storage *addr1, - const struct sockaddr_storage *addr2, int cmp_port) +static int cmp_addr(const struct sockaddr_storage *addr1, socklen_t addr1_len, + const struct sockaddr_storage *addr2, socklen_t addr2_len, + int cmp_port) { const struct sockaddr_in *four1, *four2; const struct sockaddr_in6 *six1, *six2; @@ -894,6 +899,9 @@ static int cmp_addr(const struct sockaddr_storage *addr1, if (addr1->ss_family != addr2->ss_family) return -1; + if (addr1_len != addr2_len) + return -1; + if (addr1->ss_family == AF_INET) { four1 = (const struct sockaddr_in *)addr1; four2 = (const struct sockaddr_in *)addr2; @@ -911,7 +919,8 @@ static int cmp_addr(const struct sockaddr_storage *addr1, } static int cmp_sock_addr(info_fn fn, int sock1, - const struct sockaddr_storage *addr2, int cmp_port) + const struct sockaddr_storage *addr2, + socklen_t addr2_len, int cmp_port) { struct sockaddr_storage addr1; socklen_t len1 = sizeof(addr1); @@ -920,22 +929,28 @@ static int cmp_sock_addr(info_fn fn, int sock1, if (fn(sock1, (struct sockaddr *)&addr1, (socklen_t *)&len1) != 0) return -1; - return cmp_addr(&addr1, addr2, cmp_port); + return cmp_addr(&addr1, len1, addr2, addr2_len, cmp_port); } -static int cmp_local_ip(int sock1, const struct sockaddr_storage *addr2) +static int cmp_local_ip(int sock1, const struct sockaddr_storage *addr2, + socklen_t addr2_len) { - return cmp_sock_addr(getsockname, sock1, addr2, /*cmp_port*/ 0); + return cmp_sock_addr(getsockname, sock1, addr2, addr2_len, + /*cmp_port*/ 0); } -static int cmp_local_addr(int sock1, const struct sockaddr_storage *addr2) +static int cmp_local_addr(int sock1, const struct sockaddr_storage *addr2, + socklen_t addr2_len) { - return cmp_sock_addr(getsockname, sock1, addr2, /*cmp_port*/ 1); + return cmp_sock_addr(getsockname, sock1, addr2, addr2_len, + /*cmp_port*/ 1); } -static int cmp_peer_addr(int sock1, const struct sockaddr_storage *addr2) +static int cmp_peer_addr(int sock1, const struct sockaddr_storage *addr2, + socklen_t addr2_len) { - return cmp_sock_addr(getpeername, sock1, addr2, /*cmp_port*/ 1); + return cmp_sock_addr(getpeername, sock1, addr2, addr2_len, + /*cmp_port*/ 1); } static int start_server(int type, const struct sockaddr_storage *addr, @@ -1109,7 +1124,8 @@ static int fastconnect_to_server(const struct sockaddr_storage *addr, MSG_FASTOPEN, &sendmsg_err); } -static int recvmsg_from_client(int sockfd, struct sockaddr_storage *src_addr) +static int recvmsg_from_client(int sockfd, struct sockaddr_storage *src_addr, + socklen_t *src_addr_len) { struct timeval tv; struct msghdr hdr; @@ -1133,31 +1149,39 @@ static int recvmsg_from_client(int sockfd, struct sockaddr_storage *src_addr) memset(&hdr, 0, sizeof(hdr)); hdr.msg_name = src_addr; - hdr.msg_namelen = sizeof(struct sockaddr_storage); + hdr.msg_namelen = *src_addr_len; hdr.msg_iov = &iov; hdr.msg_iovlen = 1; - return recvmsg(sockfd, &hdr, 0); + if (recvmsg(sockfd, &hdr, 0) < 0) + return -1; + + *src_addr_len = hdr.msg_namelen; + return 0; } static int init_addrs(const struct sock_addr_test *test, struct sockaddr_storage *requested_addr, + socklen_t *requested_addr_len, struct sockaddr_storage *expected_addr, - struct sockaddr_storage *expected_src_addr) + socklen_t *expected_addr_len, + struct sockaddr_storage *expected_src_addr, + socklen_t *expected_src_addr_len) { - socklen_t addr_len = sizeof(struct sockaddr_storage); - if (mk_sockaddr(test->domain, test->expected_ip, test->expected_port, - (struct sockaddr *)expected_addr, addr_len) == -1) + (struct sockaddr *)expected_addr, + expected_addr_len) == -1) goto err; if (mk_sockaddr(test->domain, test->requested_ip, test->requested_port, - (struct sockaddr *)requested_addr, addr_len) == -1) + (struct sockaddr *)requested_addr, + requested_addr_len) == -1) goto err; if (test->expected_src_ip && mk_sockaddr(test->domain, test->expected_src_ip, 0, - (struct sockaddr *)expected_src_addr, addr_len) == -1) + (struct sockaddr *)expected_src_addr, + expected_src_addr_len) == -1) goto err; return 0; @@ -1167,25 +1191,28 @@ static int init_addrs(const struct sock_addr_test *test, static int run_bind_test_case(const struct sock_addr_test *test) { - socklen_t addr_len = sizeof(struct sockaddr_storage); struct sockaddr_storage requested_addr; struct sockaddr_storage expected_addr; + socklen_t requested_addr_len = sizeof(struct sockaddr_storage); + socklen_t expected_addr_len = sizeof(struct sockaddr_storage); int clientfd = -1; int servfd = -1; int err = 0; - if (init_addrs(test, &requested_addr, &expected_addr, NULL)) + if (init_addrs(test, &requested_addr, &requested_addr_len, + &expected_addr, &expected_addr_len, NULL, NULL)) goto err; - servfd = start_server(test->type, &requested_addr, addr_len); + servfd = start_server(test->type, &requested_addr, requested_addr_len); if (servfd == -1) goto err; - if (cmp_local_addr(servfd, &expected_addr)) + if (cmp_local_addr(servfd, &expected_addr, expected_addr_len)) goto err; /* Try to connect to server just in case */ - clientfd = connect_to_server(test->type, &expected_addr, addr_len); + clientfd = connect_to_server(test->type, &expected_addr, + expected_addr_len); if (clientfd == -1) goto err; @@ -1204,28 +1231,33 @@ static int run_connect_test_case(const struct sock_addr_test *test) struct sockaddr_storage expected_src_addr; struct sockaddr_storage requested_addr; struct sockaddr_storage expected_addr; + socklen_t expected_src_addr_len = sizeof(struct sockaddr_storage); + socklen_t requested_addr_len = sizeof(struct sockaddr_storage); + socklen_t expected_addr_len = sizeof(struct sockaddr_storage); int clientfd = -1; int servfd = -1; int err = 0; - if (init_addrs(test, &requested_addr, &expected_addr, - &expected_src_addr)) + if (init_addrs(test, &requested_addr, &requested_addr_len, + &expected_addr, &expected_addr_len, &expected_src_addr, + &expected_src_addr_len)) goto err; /* Prepare server to connect to */ - servfd = start_server(test->type, &expected_addr, addr_len); + servfd = start_server(test->type, &expected_addr, expected_addr_len); if (servfd == -1) goto err; - clientfd = connect_to_server(test->type, &requested_addr, addr_len); + clientfd = connect_to_server(test->type, &requested_addr, + requested_addr_len); if (clientfd == -1) goto err; /* Make sure src and dst addrs were overridden properly */ - if (cmp_peer_addr(clientfd, &expected_addr)) + if (cmp_peer_addr(clientfd, &expected_addr, expected_addr_len)) goto err; - if (cmp_local_ip(clientfd, &expected_src_addr)) + if (cmp_local_ip(clientfd, &expected_src_addr, expected_src_addr_len)) goto err; if (test->type == SOCK_STREAM) { @@ -1235,10 +1267,11 @@ static int run_connect_test_case(const struct sock_addr_test *test) goto err; /* Make sure src and dst addrs were overridden properly */ - if (cmp_peer_addr(clientfd, &expected_addr)) + if (cmp_peer_addr(clientfd, &expected_addr, expected_addr_len)) goto err; - if (cmp_local_ip(clientfd, &expected_src_addr)) + if (cmp_local_ip(clientfd, &expected_src_addr, + expected_src_addr_len)) goto err; } @@ -1253,11 +1286,14 @@ static int run_connect_test_case(const struct sock_addr_test *test) static int run_xmsg_test_case(const struct sock_addr_test *test, int max_cmsg) { - socklen_t addr_len = sizeof(struct sockaddr_storage); struct sockaddr_storage expected_addr; struct sockaddr_storage server_addr; struct sockaddr_storage sendmsg_addr; struct sockaddr_storage recvmsg_addr; + socklen_t expected_addr_len = sizeof(struct sockaddr_storage); + socklen_t server_addr_len = sizeof(struct sockaddr_storage); + socklen_t sendmsg_addr_len = sizeof(struct sockaddr_storage); + socklen_t recvmsg_addr_len = sizeof(struct sockaddr_storage); int clientfd = -1; int servfd = -1; int set_cmsg; @@ -1266,11 +1302,12 @@ static int run_xmsg_test_case(const struct sock_addr_test *test, int max_cmsg) if (test->type != SOCK_DGRAM) goto err; - if (init_addrs(test, &sendmsg_addr, &server_addr, &expected_addr)) + if (init_addrs(test, &sendmsg_addr, &sendmsg_addr_len, &server_addr, + &server_addr_len, &expected_addr, &expected_addr_len)) goto err; /* Prepare server to sendmsg to */ - servfd = start_server(test->type, &server_addr, addr_len); + servfd = start_server(test->type, &server_addr, server_addr_len); if (servfd == -1) goto err; @@ -1279,8 +1316,8 @@ static int run_xmsg_test_case(const struct sock_addr_test *test, int max_cmsg) close(clientfd); clientfd = sendmsg_to_server(test->type, &sendmsg_addr, - addr_len, set_cmsg, /*flags*/0, - &err); + sendmsg_addr_len, set_cmsg, + /*flags*/ 0, &err); if (err) goto out; else if (clientfd == -1) @@ -1298,10 +1335,13 @@ static int run_xmsg_test_case(const struct sock_addr_test *test, int max_cmsg) * specific packet may differ from the one used by default and * returned by getsockname(2). */ - if (recvmsg_from_client(servfd, &recvmsg_addr) == -1) + if (recvmsg_from_client(servfd, &recvmsg_addr, + &recvmsg_addr_len) == -1) goto err; - if (cmp_addr(&recvmsg_addr, &expected_addr, /*cmp_port*/0)) + if (cmp_addr(&recvmsg_addr, recvmsg_addr_len, &expected_addr, + expected_addr_len, + /*cmp_port*/ 0)) goto err; } From patchwork Fri Apr 21 16:27:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13220330 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 520E3C77B61 for ; Fri, 21 Apr 2023 16:31:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232564AbjDUQb2 (ORCPT ); Fri, 21 Apr 2023 12:31:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232487AbjDUQb1 (ORCPT ); Fri, 21 Apr 2023 12:31:27 -0400 Received: from mail-ed1-x532.google.com (mail-ed1-x532.google.com [IPv6:2a00:1450:4864:20::532]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 22DEF1444B for ; Fri, 21 Apr 2023 09:31:24 -0700 (PDT) Received: by mail-ed1-x532.google.com with SMTP id 4fb4d7f45d1cf-504e232fe47so3280917a12.2 for ; Fri, 21 Apr 2023 09:31:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682094682; x=1684686682; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=avj8itV+THmDhtv+qAhGmSpuILrhOmGyKUPrt+kFgvM=; b=eSmP7CQGAgF3spRPHvOiusJ/pbB/HjGM2biEfXmiHw06LgVoPxzEjKEnfAHuK/u4eU f3DeXbuEnZ5rpyUndEbl8AGOnb6QSWWzErdfmNFdaOw51FY0VkLml0aXE77GoyxhFJ5g HwoCmo6XcwTEHMQh90SxG+VaizEceZTmEFCDGE8668n+Ae3KLr2GAVPDVT+P+Q49wd6j B0aP+GsaF1jIewTK6klWzyOTuHl+sEpe7sCnzqZKTCxV6YJDpAMU9XA7sj3S1coUdGVr EKa8HxdDQI1EtJuE9fcAnNQmqWaGadXzQfHFkJTzveqlGr7uONHbVh5D0h3ykBgg5G7V gX6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682094682; x=1684686682; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=avj8itV+THmDhtv+qAhGmSpuILrhOmGyKUPrt+kFgvM=; b=X+UE0anQxUahMbDxM3DF6As8anEMTLr50L8VJMU3Jy2jF3g9wdB3gSrCtEkNUb4RXv csRs2q42JtfDCmc685fEgKHmmzA3iFCrED0cAGYS4k3VbT7LWVxfynt0rDBxQzh2pOlb JpEO6BVZrJUZAPyq3porFpvpdvOduZGvpbHj+qd0reXTczAq9PtdPfxhUgE6D7WzP9Qy djyV5Cicbm63zp2Bk8AJTdhprmSDHGaNtogIlLMkXEWrMlUwkSLQIbTqO90X4LmmoXsc HZKbxLjxYMKBm0/bzhtB4WydX1NaG21r5SXBYRHKr1BqeLLZSx6AFYyBKbp7X0S0icvj FuGQ== X-Gm-Message-State: AAQBX9fEF5Ygc9gH9ms7zr2otXLfgWYT6eUCUM5VehCuQjIf+sG4jCSe zcpsGn58kgPZn+raD8T7rC0g0o2mRvUXHg== X-Google-Smtp-Source: AKy350b+NTGCwsU4McyQRJJkz6WtWa+vWibrBi1h+jfflNhp75LnqRKe81MEvZrqOUYpthiS+qfhsQ== X-Received: by 2002:a17:907:765a:b0:94f:6d10:ad9f with SMTP id kj26-20020a170907765a00b0094f6d10ad9fmr2937274ejc.42.1682094681739; Fri, 21 Apr 2023 09:31:21 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:864b:8201:e534:34f4:1c34:8de7]) by smtp.googlemail.com with ESMTPSA id k9-20020a170906970900b009534211cc97sm2248578ejx.159.2023.04.21.09.31.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Apr 2023 09:31:21 -0700 (PDT) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v3 03/10] bpf: Allow read access to addr_len from cgroup sockaddr programs Date: Fri, 21 Apr 2023 18:27:11 +0200 Message-Id: <20230421162718.440230-4-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230421162718.440230-1-daan.j.demeyer@gmail.com> References: <20230421162718.440230-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net As prep for adding unix socket support to the cgroup sockaddr hooks, let's expose the sockaddr addrlen in bpf_sock_addr_kern. While not important for AF_INET or AF_INET6, the sockaddr length is important when working with AF_UNIX sockaddrs as the size of the sockaddr cannot be determined just from the address family or the sockaddr's contents. __cgroup_bpf_run_filter_sock_addr() is modified to return the addr_len in preparation for adding unix socket support for which we'll need to return the modified address length. Signed-off-by: Daan De Meyer --- include/linux/bpf-cgroup.h | 73 +++++++++++++++++++------------------- include/linux/filter.h | 1 + kernel/bpf/cgroup.c | 16 +++++++-- net/ipv4/af_inet.c | 8 ++--- net/ipv4/ping.c | 8 ++++- net/ipv4/tcp_ipv4.c | 8 ++++- net/ipv4/udp.c | 17 ++++++--- net/ipv6/af_inet6.c | 8 ++--- net/ipv6/ping.c | 8 ++++- net/ipv6/tcp_ipv6.c | 8 ++++- net/ipv6/udp.c | 14 ++++++-- 11 files changed, 111 insertions(+), 58 deletions(-) diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h index 57e9e109257e..f3f5adf3881f 100644 --- a/include/linux/bpf-cgroup.h +++ b/include/linux/bpf-cgroup.h @@ -120,6 +120,7 @@ int __cgroup_bpf_run_filter_sk(struct sock *sk, int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, struct sockaddr *uaddr, + u32 uaddrlen, enum cgroup_bpf_attach_type atype, void *t_ctx, u32 *flags); @@ -230,22 +231,22 @@ static inline bool cgroup_bpf_sock_enabled(struct sock *sk, #define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) \ BPF_CGROUP_RUN_SK_PROG(sk, CGROUP_INET6_POST_BIND) -#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype) \ +#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, atype) \ ({ \ int __ret = 0; \ if (cgroup_bpf_enabled(atype)) \ - __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \ - NULL, NULL); \ + __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, uaddrlen, \ + atype, NULL, NULL); \ __ret; \ }) -#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx) \ +#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, atype, t_ctx) \ ({ \ int __ret = 0; \ if (cgroup_bpf_enabled(atype)) { \ lock_sock(sk); \ - __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \ - t_ctx, NULL); \ + __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, uaddrlen, \ + atype, t_ctx, NULL); \ release_sock(sk); \ } \ __ret; \ @@ -256,14 +257,14 @@ static inline bool cgroup_bpf_sock_enabled(struct sock *sk, * (at bit position 0) is to indicate CAP_NET_BIND_SERVICE capability check * should be bypassed (BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE). */ -#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, bind_flags) \ +#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, uaddrlen, atype, bind_flags) \ ({ \ u32 __flags = 0; \ int __ret = 0; \ if (cgroup_bpf_enabled(atype)) { \ lock_sock(sk); \ - __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, atype, \ - NULL, &__flags); \ + __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, uaddrlen, \ + atype, NULL, &__flags); \ release_sock(sk); \ if (__flags & BPF_RET_BIND_NO_CAP_NET_BIND_SERVICE) \ *bind_flags |= BIND_NO_CAP_NET_BIND_SERVICE; \ @@ -276,29 +277,29 @@ static inline bool cgroup_bpf_sock_enabled(struct sock *sk, cgroup_bpf_enabled(CGROUP_INET6_CONNECT)) && \ (sk)->sk_prot->pre_connect) -#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET4_CONNECT) +#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, CGROUP_INET4_CONNECT) -#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG(sk, uaddr, CGROUP_INET6_CONNECT) +#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, CGROUP_INET6_CONNECT) -#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET4_CONNECT, NULL) +#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_INET4_CONNECT, NULL) -#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_INET6_CONNECT, NULL) +#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_INET6_CONNECT, NULL) -#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_SENDMSG, t_ctx) +#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP4_SENDMSG, t_ctx) -#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_SENDMSG, t_ctx) +#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP6_SENDMSG, t_ctx) -#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP4_RECVMSG, NULL) +#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP4_RECVMSG, NULL) -#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) \ - BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, CGROUP_UDP6_RECVMSG, NULL) +#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP6_RECVMSG, NULL) /* The SOCK_OPS"_SK" macro should be used when sock_ops->sk is not a * fullsock and its parent fullsock cannot be traced by @@ -477,24 +478,24 @@ static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map, } #define cgroup_bpf_enabled(atype) (0) -#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, atype, t_ctx) ({ 0; }) -#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, atype) ({ 0; }) +#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, atype, t_ctx) ({ 0; }) +#define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, atype) ({ 0; }) #define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0) #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, atype, flags) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, uaddrlen, atype, flags) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; }) -#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; }) #define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) ({ 0; }) #define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; }) diff --git a/include/linux/filter.h b/include/linux/filter.h index bbce89937fde..89e891003c03 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -1294,6 +1294,7 @@ struct bpf_sock_addr_kern { */ u64 tmp_reg; void *t_ctx; /* Attach type specific context. */ + u32 uaddrlen; }; struct bpf_sock_ops_kern { diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 53edb8ad2471..c2191f0e138e 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -1449,6 +1449,7 @@ EXPORT_SYMBOL(__cgroup_bpf_run_filter_sk); * provided by user sockaddr * @sk: sock struct that will use sockaddr * @uaddr: sockaddr struct provided by user + * @uaddrlen: Size of the sockaddr struct provided by user * @type: The type of program to be executed * @t_ctx: Pointer to attach type specific context * @flags: Pointer to u32 which contains higher bits of BPF program @@ -1457,10 +1458,12 @@ EXPORT_SYMBOL(__cgroup_bpf_run_filter_sk); * socket is expected to be of type INET or INET6. * * This function will return %-EPERM if an attached program is found and - * returned value != 1 during execution. In all other cases, 0 is returned. + * returned value != 1 during execution. In all other cases, the new address + * length of the sockaddr is returned. */ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, struct sockaddr *uaddr, + u32 uaddrlen, enum cgroup_bpf_attach_type atype, void *t_ctx, u32 *flags) @@ -1469,9 +1472,11 @@ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, .sk = sk, .uaddr = uaddr, .t_ctx = t_ctx, + .uaddrlen = uaddrlen, }; struct sockaddr_storage unspec; struct cgroup *cgrp; + int ret; /* Check socket family since not all sockets represent network * endpoint (e.g. AF_UNIX). @@ -1482,11 +1487,16 @@ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, if (!ctx.uaddr) { memset(&unspec, 0, sizeof(unspec)); ctx.uaddr = (struct sockaddr *)&unspec; + ctx.uaddrlen = sizeof(unspec); } cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data); - return bpf_prog_run_array_cg(&cgrp->bpf, atype, &ctx, bpf_prog_run, - 0, flags); + ret = bpf_prog_run_array_cg(&cgrp->bpf, atype, &ctx, bpf_prog_run, + 0, flags); + if (ret) + return ret; + + return (int) ctx.uaddrlen; } EXPORT_SYMBOL(__cgroup_bpf_run_filter_sock_addr); diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 940062e08f57..6b3e5d77d354 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -446,9 +446,9 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) /* BPF prog is run before any checks are done so that if the prog * changes context in a wrong way it will be caught. */ - err = BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, + err = BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, addr_len, CGROUP_INET4_BIND, &flags); - if (err) + if (err < 0) return err; return __inet_bind(sk, uaddr, addr_len, flags); @@ -785,7 +785,7 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr, } sin->sin_port = inet->inet_dport; sin->sin_addr.s_addr = inet->inet_daddr; - BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, + BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, sizeof(*sin), CGROUP_INET4_GETPEERNAME); } else { __be32 addr = inet->inet_rcv_saddr; @@ -793,7 +793,7 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr, addr = inet->inet_saddr; sin->sin_port = inet->inet_sport; sin->sin_addr.s_addr = addr; - BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, + BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, sizeof(*sin), CGROUP_INET4_GETSOCKNAME); } release_sock(sk); diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c index 5178a3f3cb53..9192cf5cd3ef 100644 --- a/net/ipv4/ping.c +++ b/net/ipv4/ping.c @@ -304,6 +304,8 @@ EXPORT_SYMBOL_GPL(ping_close); static int ping_pre_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) { + int err; + /* This check is replicated from __ip4_datagram_connect() and * intended to prevent BPF program called below from accessing bytes * that are out of the bound specified by user in addr_len. @@ -311,7 +313,11 @@ static int ping_pre_connect(struct sock *sk, struct sockaddr *uaddr, if (addr_len < sizeof(struct sockaddr_in)) return -EINVAL; - return BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr); + err = BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, addr_len); + if (err < 0) + return err; + + return 0; } /* Checks the bind address and possibly modifies sk->sk_bound_dev_if. */ diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 39bda2b1066e..50fed4e1820d 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -184,6 +184,8 @@ EXPORT_SYMBOL_GPL(tcp_twsk_unique); static int tcp_v4_pre_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) { + int err; + /* This check is replicated from tcp_v4_connect() and intended to * prevent BPF program called below from accessing bytes that are out * of the bound specified by user in addr_len. @@ -193,7 +195,11 @@ static int tcp_v4_pre_connect(struct sock *sk, struct sockaddr *uaddr, sock_owned_by_me(sk); - return BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr); + err = BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr, addr_len); + if (err < 0) + return err; + + return 0; } /* This will initiate an outgoing connection. */ diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index aa32afd871ee..8f4b64252b51 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1157,8 +1157,10 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) if (cgroup_bpf_enabled(CGROUP_UDP4_SENDMSG) && !connected) { err = BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, - (struct sockaddr *)usin, &ipc.addr); - if (err) + (struct sockaddr *)usin, + msg->msg_namelen, + &ipc.addr); + if (err < 0) goto out_free; if (usin) { if (usin->sin_port == 0) { @@ -1927,7 +1929,8 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags, *addr_len = sizeof(*sin); BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, - (struct sockaddr *)sin); + (struct sockaddr *)sin, + *addr_len); } if (udp_sk(sk)->gro_enabled) @@ -1959,6 +1962,8 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags, int udp_pre_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) { + int err; + /* This check is replicated from __ip4_datagram_connect() and * intended to prevent BPF program called below from accessing bytes * that are out of the bound specified by user in addr_len. @@ -1966,7 +1971,11 @@ int udp_pre_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) if (addr_len < sizeof(struct sockaddr_in)) return -EINVAL; - return BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr); + err = BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, addr_len); + if (err < 0) + return err; + + return 0; } EXPORT_SYMBOL(udp_pre_connect); diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index e1b679a590c9..acba6a47ae44 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -455,9 +455,9 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) /* BPF prog is run before any checks are done so that if the prog * changes context in a wrong way it will be caught. */ - err = BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, + err = BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, addr_len, CGROUP_INET6_BIND, &flags); - if (err) + if (err < 0) return err; return __inet6_bind(sk, uaddr, addr_len, flags); @@ -534,7 +534,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr, sin->sin6_addr = sk->sk_v6_daddr; if (np->sndflow) sin->sin6_flowinfo = np->flow_label; - BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, + BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, sizeof(*sin), CGROUP_INET6_GETPEERNAME); } else { if (ipv6_addr_any(&sk->sk_v6_rcv_saddr)) @@ -542,7 +542,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr, else sin->sin6_addr = sk->sk_v6_rcv_saddr; sin->sin6_port = inet->inet_sport; - BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, + BPF_CGROUP_RUN_SA_PROG(sk, (struct sockaddr *)sin, sizeof(*sin), CGROUP_INET6_GETSOCKNAME); } sin->sin6_scope_id = ipv6_iface_scope_id(&sin->sin6_addr, diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c index c4835dbdfcff..d3630cad2c21 100644 --- a/net/ipv6/ping.c +++ b/net/ipv6/ping.c @@ -48,6 +48,8 @@ static int dummy_ipv6_chk_addr(struct net *net, const struct in6_addr *addr, static int ping_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) { + int err; + /* This check is replicated from __ip6_datagram_connect() and * intended to prevent BPF program called below from accessing * bytes that are out of the bound specified by user in addr_len. @@ -56,7 +58,11 @@ static int ping_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr, if (addr_len < SIN6_LEN_RFC2133) return -EINVAL; - return BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr); + err = BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, addr_len); + if (err < 0) + return err; + + return 0; } static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 244cf86c4cbb..a59db6b3e41f 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -130,6 +130,8 @@ static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb) static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) { + int err; + /* This check is replicated from tcp_v6_connect() and intended to * prevent BPF program called below from accessing bytes that are out * of the bound specified by user in addr_len. @@ -139,7 +141,11 @@ static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr, sock_owned_by_me(sk); - return BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr); + err = BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, addr_len); + if (err < 0) + return err; + + return 0; } static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index e5a337e6b970..bc6c9a5586bf 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -429,7 +429,8 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, *addr_len = sizeof(*sin6); BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, - (struct sockaddr *)sin6); + (struct sockaddr *)sin6, + *addr_len); } if (udp_sk(sk)->gro_enabled) @@ -1154,6 +1155,8 @@ static void udp_v6_flush_pending_frames(struct sock *sk) static int udpv6_pre_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) { + int err; + if (addr_len < offsetofend(struct sockaddr, sa_family)) return -EINVAL; /* The following checks are replicated from __ip6_datagram_connect() @@ -1169,7 +1172,11 @@ static int udpv6_pre_connect(struct sock *sk, struct sockaddr *uaddr, if (addr_len < SIN6_LEN_RFC2133) return -EINVAL; - return BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr); + err = BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, addr_len); + if (err < 0) + return err; + + return 0; } /** @@ -1522,8 +1529,9 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) if (cgroup_bpf_enabled(CGROUP_UDP6_SENDMSG) && !connected) { err = BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, (struct sockaddr *)sin6, + msg->msg_namelen, &fl6->saddr); - if (err) + if (err < 0) goto out_no_dst; if (sin6) { if (ipv6_addr_v4mapped(&sin6->sin6_addr)) { From patchwork Fri Apr 21 16:27:12 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13220331 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA7B4C7618E for ; Fri, 21 Apr 2023 16:31:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232850AbjDUQb3 (ORCPT ); Fri, 21 Apr 2023 12:31:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44860 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232690AbjDUQb2 (ORCPT ); Fri, 21 Apr 2023 12:31:28 -0400 Received: from mail-ej1-x62f.google.com (mail-ej1-x62f.google.com [IPv6:2a00:1450:4864:20::62f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A010D146D3 for ; Fri, 21 Apr 2023 09:31:24 -0700 (PDT) Received: by mail-ej1-x62f.google.com with SMTP id a640c23a62f3a-94f1d0d2e03so250914066b.0 for ; Fri, 21 Apr 2023 09:31:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682094683; x=1684686683; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=QawXbYm2BNNDAqvsFceWXopDWXSa/LpW2aGecG4oFF8=; b=VQSSMPB31S5PwRLjZaK4macUK4s0XdqmAT04f0dsnVQ4fe2sjtWwFjyjsHDfJYzGqS +eydFllMm4gxWFg48Yei8kfLV0ym/POAGOyOH1oCgDSwwo7HXAmVC5k+HZs+E+nNrAJf zJ4Qb2S/4LJ5b6F34tQwt6Dyrc78t2GYMoFJp0JHVP5HfbiFcBktq/12pU5O/G4U9vtS U8L9P8qrrTymIkXcadRypnjt5eu6OV2jkJOsDqWmm4ncaMnCh+PyF7Zh9SP68bZ/91Rv YeTlsv8JfVQiAGk6xJt6fIe9644vbhM/X7VyjU404heIvr7IGDe1H5HmTVdYCARmbtBi vTFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682094683; x=1684686683; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=QawXbYm2BNNDAqvsFceWXopDWXSa/LpW2aGecG4oFF8=; b=UYZb8vczLQ2hXhxb7qnR9Udtq8D46+ZPpxizWoSmTNpA2S/auuOc8hXILU7T40SqPK HTNmLzOpB0lM0ne1CknPdhfPjen37ln0DeWGXcTg9F9SkfjuRUQVUzDrNygUayvWG/+8 IDw6ZVgrkflU/nVFUs60tkOTj6hqqtwgN02jTGL6/epZNtjcfpjKY7h79oTenzeOkI1O sr/komHIgcT1WBAlG1cZVOSI0+X8N6kP3q/7rcyDZN6K9SDwT0A3lluRilkJS705rHSl ubsLcyVTwKKYJ0rDXSabzV7FARjMquvnOrbdb6B0AxQXWtPKY79ttAP8ZIjc5pH4RJLH UDuA== X-Gm-Message-State: AAQBX9cEtfYtHuchdkHG2/OxlYTjvlgKlpQTdQi9ZspsGKdRJDEIT4Bh LEBFkCgMgBLpRc0noOYopdBw3rDJQs0R0g== X-Google-Smtp-Source: AKy350YOwFR7vgRr+oX0r8KrBLyYWUIR+HLZ0MMMYa6Ue/kGSd2KHJ8jnMGaIK/mqoXR0GFW2IEITw== X-Received: by 2002:a17:906:3fc4:b0:94e:be0:97 with SMTP id k4-20020a1709063fc400b0094e0be00097mr2788263ejj.26.1682094682683; Fri, 21 Apr 2023 09:31:22 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:864b:8201:e534:34f4:1c34:8de7]) by smtp.googlemail.com with ESMTPSA id k9-20020a170906970900b009534211cc97sm2248578ejx.159.2023.04.21.09.31.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Apr 2023 09:31:22 -0700 (PDT) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v3 04/10] bpf: Add BTF_KFUNC_HOOK_SOCK_ADDR Date: Fri, 21 Apr 2023 18:27:12 +0200 Message-Id: <20230421162718.440230-5-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230421162718.440230-1-daan.j.demeyer@gmail.com> References: <20230421162718.440230-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net In preparation for adding a sock addr specific kfunc, let's add the necessary hook for it. Signed-off-by: Daan De Meyer --- kernel/bpf/btf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index a0887ee44e89..1ec9a8590c72 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -212,6 +212,7 @@ enum btf_kfunc_hook { BTF_KFUNC_HOOK_SK_SKB, BTF_KFUNC_HOOK_SOCKET_FILTER, BTF_KFUNC_HOOK_LWT, + BTF_KFUNC_HOOK_SOCK_ADDR, BTF_KFUNC_HOOK_MAX, }; @@ -7802,6 +7803,8 @@ static int bpf_prog_type_to_kfunc_hook(enum bpf_prog_type prog_type) case BPF_PROG_TYPE_LWT_XMIT: case BPF_PROG_TYPE_LWT_SEG6LOCAL: return BTF_KFUNC_HOOK_LWT; + case BPF_PROG_TYPE_CGROUP_SOCK_ADDR: + return BTF_KFUNC_HOOK_SOCK_ADDR; default: return BTF_KFUNC_HOOK_MAX; } From patchwork Fri Apr 21 16:27:13 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13220332 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6AC40C77B7C for ; Fri, 21 Apr 2023 16:31:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232815AbjDUQba (ORCPT ); Fri, 21 Apr 2023 12:31:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44864 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232725AbjDUQb2 (ORCPT ); Fri, 21 Apr 2023 12:31:28 -0400 Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [IPv6:2a00:1450:4864:20::631]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 16D1114F7F for ; Fri, 21 Apr 2023 09:31:26 -0700 (PDT) Received: by mail-ej1-x631.google.com with SMTP id a640c23a62f3a-94f910ea993so254918766b.3 for ; Fri, 21 Apr 2023 09:31:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682094684; x=1684686684; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=x1qUV/dG7+NVZv2qTukaomjnuJgvKWINudlvDAwyBJo=; b=ShukEpYuRPJ5Kkcal7f1iEvzl1xCyv5J+qWKZpHJGZhx4+bSYQF5QPdBJkf0BvwUQa C9+PwWTLhOcKJVD1c/+TM4HKdGXJfkpColpm13ldpMa5R98ZtOC7QuP4PJUXLsEU/jmf 7LmA0+gy6Vjo6fM+595jQu+c4gZnxZFrNn0wwgO7TwnH/n35db7dZyeKWVVNNHZwLlYP XzcU9HUYD4/2jlpGMdEZZc3Lv1I52VZ7nTHOG0wEPmbJAqkG/NPqqU1k+D+Bx2DnmWqm m4yeg2pw9LMnR0MVKaZp9dn3XSuwPC1o2nK0+VkdPMaYI5PPhPx/oBIMFsEVEjKIUaez FVCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682094684; x=1684686684; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=x1qUV/dG7+NVZv2qTukaomjnuJgvKWINudlvDAwyBJo=; b=S+AOB+xca4D4p9cKo+g4dwLpb2ZDrSq+xi2WA0x0TyEnKPaPqEQXVkcGWx5TrgI9eW z3zAsklkdkuwslADKAke4/1zLpjrFYvO1ZbZqaJ6+O5Na8tFEaiI+EFJn/u/lmz9l7+I voAptfd084L1h6reaBYDZwB51aFLTwXmdmzeibN5353qo0l+vOaaibvyDKLdB8fyM6zn WlTF/zC2PYqVkVFoQpaINCex2UC3Lyzb9KZjLBpsMtXgmW9MRxHztvEibHYzkTv1kf4+ 8x/tutweFal4Pj3ctJ37AbEg0o++bIhatuQ44Xm1fYfhXx2G396SyKHx1LMNSpLJYt6X azVQ== X-Gm-Message-State: AAQBX9csZTeoCCIgbXpx0KADhdkyAJsD0M1QwmUJ7/QvmNWwBRNQMCfr J4MCB+WAnCBLDag5IJbf/W59ZROzAA8iVw== X-Google-Smtp-Source: AKy350ZnkscX6I/5OtlHNMkQkESwbIdP9n0uAPnyDeeqAjhI8mrGqU8A7D6f/xppgBDKTcsAqG3Srw== X-Received: by 2002:a17:906:300b:b0:951:756d:6542 with SMTP id 11-20020a170906300b00b00951756d6542mr2835934ejz.32.1682094683527; Fri, 21 Apr 2023 09:31:23 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:864b:8201:e534:34f4:1c34:8de7]) by smtp.googlemail.com with ESMTPSA id k9-20020a170906970900b009534211cc97sm2248578ejx.159.2023.04.21.09.31.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Apr 2023 09:31:23 -0700 (PDT) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v3 05/10] bpf: Add bpf_sock_addr_set() to allow writing sockaddr len from bpf Date: Fri, 21 Apr 2023 18:27:13 +0200 Message-Id: <20230421162718.440230-6-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230421162718.440230-1-daan.j.demeyer@gmail.com> References: <20230421162718.440230-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net As prep for adding unix socket support to the cgroup sockaddr hooks, let's add a kfunc bpf_sock_addr_set() that allows modifying the sockaddr length from bpf. This is required to allow modifying AF_UNIX sockaddrs correctly. Signed-off-by: Daan De Meyer --- net/core/filter.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 51 insertions(+), 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 44fb997434ad..1c656e2d7b58 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -81,6 +81,7 @@ #include #include #include +#include static const struct bpf_func_proto * bpf_sk_base_func_proto(enum bpf_func_id func_id); @@ -11670,6 +11671,44 @@ __bpf_kfunc int bpf_dynptr_from_xdp(struct xdp_buff *xdp, u64 flags, return 0; } + +__bpf_kfunc int bpf_sock_addr_set(struct bpf_sock_addr_kern *sa_kern, + const void *addr, u32 addrlen__sz) +{ + const struct sockaddr *sa = addr; + + if (addrlen__sz <= offsetof(struct sockaddr, sa_family)) + return -EINVAL; + + if (addrlen__sz > sizeof(struct sockaddr_storage)) + return -EINVAL; + + if (sa->sa_family != sa_kern->uaddr->sa_family) + return -EINVAL; + + switch (sa->sa_family) { + case AF_INET: + if (addrlen__sz < sizeof(struct sockaddr_in)) + return -EINVAL; + break; + case AF_INET6: + if (addrlen__sz < SIN6_LEN_RFC2133) + return -EINVAL; + break; + case AF_UNIX: + if (addrlen__sz <= offsetof(struct sockaddr_un, sun_path) || + addrlen__sz > sizeof(struct sockaddr_un)) + return -EINVAL; + break; + default: + return -EINVAL; + } + + memcpy(sa_kern->uaddr, sa, addrlen__sz); + sa_kern->uaddrlen = addrlen__sz; + + return 0; +} __diag_pop(); int bpf_dynptr_from_skb_rdonly(struct sk_buff *skb, u64 flags, @@ -11694,6 +11733,10 @@ BTF_SET8_START(bpf_kfunc_check_set_xdp) BTF_ID_FLAGS(func, bpf_dynptr_from_xdp) BTF_SET8_END(bpf_kfunc_check_set_xdp) +BTF_SET8_START(bpf_kfunc_check_set_sock_addr) +BTF_ID_FLAGS(func, bpf_sock_addr_set) +BTF_SET8_END(bpf_kfunc_check_set_sock_addr) + static const struct btf_kfunc_id_set bpf_kfunc_set_skb = { .owner = THIS_MODULE, .set = &bpf_kfunc_check_set_skb, @@ -11704,6 +11747,11 @@ static const struct btf_kfunc_id_set bpf_kfunc_set_xdp = { .set = &bpf_kfunc_check_set_xdp, }; +static const struct btf_kfunc_id_set bpf_kfunc_set_sock_addr = { + .owner = THIS_MODULE, + .set = &bpf_kfunc_check_set_sock_addr, +}; + static int __init bpf_kfunc_init(void) { int ret; @@ -11717,6 +11765,8 @@ static int __init bpf_kfunc_init(void) ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_IN, &bpf_kfunc_set_skb); ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_XMIT, &bpf_kfunc_set_skb); ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_SEG6LOCAL, &bpf_kfunc_set_skb); - return ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &bpf_kfunc_set_xdp); + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &bpf_kfunc_set_xdp); + return ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCK_ADDR, + &bpf_kfunc_set_sock_addr); } late_initcall(bpf_kfunc_init); From patchwork Fri Apr 21 16:27:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13220333 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4590FC7EE21 for ; Fri, 21 Apr 2023 16:31:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232882AbjDUQba (ORCPT ); Fri, 21 Apr 2023 12:31:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44902 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232690AbjDUQba (ORCPT ); Fri, 21 Apr 2023 12:31:30 -0400 Received: from mail-ej1-x635.google.com (mail-ej1-x635.google.com [IPv6:2a00:1450:4864:20::635]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 87E5813F89 for ; Fri, 21 Apr 2023 09:31:26 -0700 (PDT) Received: by mail-ej1-x635.google.com with SMTP id a640c23a62f3a-94eff00bcdaso313559166b.1 for ; Fri, 21 Apr 2023 09:31:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682094684; x=1684686684; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=1sla2xczs23esDZEG15Lv7nBusGLAuw/Jt8Jt6OQEXI=; b=MGl5lBQBMjiKmnGerILzG3v7Dui7n8+fuqm4u/nK9zoaY0BJfQCiu1XXKouTLQl7i7 lUvYFrBu34RI52ERmBkTViHke/Rjh0VJ0SdBP7FzMsyzglg/ydeWAk5kAzobRvy0Is0O fjOC48mZMCqMT2CCOegD/G72FasD3rJHRYmAkPzaedRJI6N5MEshsCgsXTpyQNTJ1/8t t8VaUGqai14HQ0cASlkmiIQmXox3YpjYdDgLvKml6KygyC5wGWczoQNGub8/3baNAP+H LcF7YpsDWynqtjCbsf29XjwZJw+VgScHlcB5RUXBnI9lhWT3mZlkWe5jVE9suMzNhj2a T6SQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682094684; x=1684686684; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=1sla2xczs23esDZEG15Lv7nBusGLAuw/Jt8Jt6OQEXI=; b=EureGCzNjgt2vyY7yznLO3iGW5By2JatDUHC0gldMs0GKvOGoJWTSI5tXW/x+HgRT7 AIPJ2LV4pqrvv2nWeIw69FiNYcwsfUUO3LHetNrnUzeW8EFTQ2+VZckqZUBMyQwttiC9 DUDIQe8g8VyQrkMrepGcTx7wz0RGyt4OyCl+YGqIbjGHyxK54bc0j+dOhohnFLXf4QTC hWr7RRWyzHgyF2NC1cimlMNs4oNjwKHXht8sic1FCUd1IcJz2uDE+S0yoxWBheGASiBm SS+6YyEYu/tkHs15Fsb5yiAE5kRU9JlPN5z3tTxpKf6qBVz35OHPn8njSb5OpJZjKnLd L4+Q== X-Gm-Message-State: AAQBX9fKei7TzWxzvkKfwYslzmD8k27Um5sAQ8GhbOAxou2tMiMzxdNu IsRlAMEFBbA3vdFZ98Jt8r6LXpbM2NJ8jg== X-Google-Smtp-Source: AKy350bQ+wLenOQSL4k7/pBtkthZF4ye0Zt6yl+v3l4ie2DkSwP6xJr1QcOFxCNfIQf5NOg0JUfQLg== X-Received: by 2002:a17:906:1814:b0:957:1292:6726 with SMTP id v20-20020a170906181400b0095712926726mr3349064eje.55.1682094684555; Fri, 21 Apr 2023 09:31:24 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:864b:8201:e534:34f4:1c34:8de7]) by smtp.googlemail.com with ESMTPSA id k9-20020a170906970900b009534211cc97sm2248578ejx.159.2023.04.21.09.31.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Apr 2023 09:31:24 -0700 (PDT) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v3 06/10] bpf: Implement cgroup sockaddr hooks for unix sockets Date: Fri, 21 Apr 2023 18:27:14 +0200 Message-Id: <20230421162718.440230-7-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230421162718.440230-1-daan.j.demeyer@gmail.com> References: <20230421162718.440230-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net These hooks allows intercepting bind(), connect(), getsockname(), getpeername(), sendmsg() and recvmsg() for unix sockets. The unix socket hooks get write access to the address length because the address length is not fixed when dealing with unix sockets and needs to be modified when a unix socket address is modified by the hook. Because abstract socket unix addresses start with a NUL byte, we cannot recalculate the socket address in kernelspace after running the hook by calculating the length of the unix socket path using strlen(). Write support is added for uaddrlen to allow the unix socket hooks to modify the sockaddr length from the bpf program. This hook can be used when users want to multiplex syscall to a single unix socket to multiple different processes behind the scenes by redirecting the connect() and other syscalls to process specific sockets. Signed-off-by: Daan De Meyer --- include/linux/bpf-cgroup-defs.h | 6 ++ include/linux/bpf-cgroup.h | 29 ++++++++- include/uapi/linux/bpf.h | 14 +++-- kernel/bpf/cgroup.c | 11 +++- kernel/bpf/syscall.c | 18 ++++++ kernel/bpf/verifier.c | 7 ++- net/core/filter.c | 17 +++++- net/unix/af_unix.c | 102 +++++++++++++++++++++++++++++--- tools/include/uapi/linux/bpf.h | 14 +++-- 9 files changed, 196 insertions(+), 22 deletions(-) diff --git a/include/linux/bpf-cgroup-defs.h b/include/linux/bpf-cgroup-defs.h index 7b121bd780eb..8196ccb81915 100644 --- a/include/linux/bpf-cgroup-defs.h +++ b/include/linux/bpf-cgroup-defs.h @@ -26,21 +26,27 @@ enum cgroup_bpf_attach_type { CGROUP_DEVICE, CGROUP_INET4_BIND, CGROUP_INET6_BIND, + CGROUP_UNIX_BIND, CGROUP_INET4_CONNECT, CGROUP_INET6_CONNECT, + CGROUP_UNIX_CONNECT, CGROUP_INET4_POST_BIND, CGROUP_INET6_POST_BIND, CGROUP_UDP4_SENDMSG, CGROUP_UDP6_SENDMSG, + CGROUP_UNIX_SENDMSG, CGROUP_SYSCTL, CGROUP_UDP4_RECVMSG, CGROUP_UDP6_RECVMSG, + CGROUP_UNIX_RECVMSG, CGROUP_GETSOCKOPT, CGROUP_SETSOCKOPT, CGROUP_INET4_GETPEERNAME, CGROUP_INET6_GETPEERNAME, + CGROUP_UNIX_GETPEERNAME, CGROUP_INET4_GETSOCKNAME, CGROUP_INET6_GETSOCKNAME, + CGROUP_UNIX_GETSOCKNAME, CGROUP_INET_SOCK_RELEASE, CGROUP_LSM_START, CGROUP_LSM_END = CGROUP_LSM_START + CGROUP_LSM_NUM - 1, diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h index f3f5adf3881f..91138371f476 100644 --- a/include/linux/bpf-cgroup.h +++ b/include/linux/bpf-cgroup.h @@ -46,21 +46,27 @@ to_cgroup_bpf_attach_type(enum bpf_attach_type attach_type) CGROUP_ATYPE(CGROUP_DEVICE); CGROUP_ATYPE(CGROUP_INET4_BIND); CGROUP_ATYPE(CGROUP_INET6_BIND); + CGROUP_ATYPE(CGROUP_UNIX_BIND); CGROUP_ATYPE(CGROUP_INET4_CONNECT); CGROUP_ATYPE(CGROUP_INET6_CONNECT); + CGROUP_ATYPE(CGROUP_UNIX_CONNECT); CGROUP_ATYPE(CGROUP_INET4_POST_BIND); CGROUP_ATYPE(CGROUP_INET6_POST_BIND); CGROUP_ATYPE(CGROUP_UDP4_SENDMSG); CGROUP_ATYPE(CGROUP_UDP6_SENDMSG); + CGROUP_ATYPE(CGROUP_UNIX_SENDMSG); CGROUP_ATYPE(CGROUP_SYSCTL); CGROUP_ATYPE(CGROUP_UDP4_RECVMSG); CGROUP_ATYPE(CGROUP_UDP6_RECVMSG); + CGROUP_ATYPE(CGROUP_UNIX_RECVMSG); CGROUP_ATYPE(CGROUP_GETSOCKOPT); CGROUP_ATYPE(CGROUP_SETSOCKOPT); CGROUP_ATYPE(CGROUP_INET4_GETPEERNAME); CGROUP_ATYPE(CGROUP_INET6_GETPEERNAME); + CGROUP_ATYPE(CGROUP_UNIX_GETPEERNAME); CGROUP_ATYPE(CGROUP_INET4_GETSOCKNAME); CGROUP_ATYPE(CGROUP_INET6_GETSOCKNAME); + CGROUP_ATYPE(CGROUP_UNIX_GETSOCKNAME); CGROUP_ATYPE(CGROUP_INET_SOCK_RELEASE); default: return CGROUP_BPF_ATTACH_TYPE_INVALID; @@ -272,9 +278,13 @@ static inline bool cgroup_bpf_sock_enabled(struct sock *sk, __ret; \ }) +#define BPF_CGROUP_RUN_PROG_UNIX_BIND_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UNIX_BIND, NULL) + #define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) \ ((cgroup_bpf_enabled(CGROUP_INET4_CONNECT) || \ - cgroup_bpf_enabled(CGROUP_INET6_CONNECT)) && \ + cgroup_bpf_enabled(CGROUP_INET6_CONNECT) || \ + cgroup_bpf_enabled(CGROUP_UNIX_CONNECT)) && \ (sk)->sk_prot->pre_connect) #define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr, uaddrlen) \ @@ -283,24 +293,36 @@ static inline bool cgroup_bpf_sock_enabled(struct sock *sk, #define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, uaddrlen) \ BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, CGROUP_INET6_CONNECT) +#define BPF_CGROUP_RUN_PROG_UNIX_CONNECT(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG(sk, uaddr, uaddrlen, CGROUP_UNIX_CONNECT) + #define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, uaddrlen) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_INET4_CONNECT, NULL) #define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, uaddrlen) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_INET6_CONNECT, NULL) +#define BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UNIX_CONNECT, NULL) + #define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP4_SENDMSG, t_ctx) #define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP6_SENDMSG, t_ctx) +#define BPF_CGROUP_RUN_PROG_UNIX_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UNIX_SENDMSG, t_ctx) + #define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr, uaddrlen) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP4_RECVMSG, NULL) #define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr, uaddrlen) \ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UDP6_RECVMSG, NULL) +#define BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK(sk, uaddr, uaddrlen) \ + BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, uaddrlen, CGROUP_UNIX_RECVMSG, NULL) + /* The SOCK_OPS"_SK" macro should be used when sock_ops->sk is not a * fullsock and its parent fullsock cannot be traced by * sk_to_full_sk(). @@ -486,16 +508,21 @@ static inline int bpf_percpu_cgroup_storage_update(struct bpf_map *map, #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_SOCK_RELEASE(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_BIND_LOCK(sk, uaddr, uaddrlen, atype, flags) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UNIX_BIND_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UNIX_CONNECT(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; }) #define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UNIX_SENDMSG_LOCK(sk, uaddr, uaddrlen, t_ctx) ({ 0; }) #define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK(sk, uaddr, uaddrlen) ({ 0; }) #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; }) #define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(atype, major, minor, access) ({ 0; }) #define BPF_CGROUP_RUN_PROG_SYSCTL(head,table,write,buf,count,pos) ({ 0; }) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 4b20a7269bee..58ed37ac0436 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -1034,6 +1034,12 @@ enum bpf_attach_type { BPF_TRACE_KPROBE_MULTI, BPF_LSM_CGROUP, BPF_STRUCT_OPS, + BPF_CGROUP_UNIX_BIND, + BPF_CGROUP_UNIX_CONNECT, + BPF_CGROUP_UNIX_SENDMSG, + BPF_CGROUP_UNIX_RECVMSG, + BPF_CGROUP_UNIX_GETPEERNAME, + BPF_CGROUP_UNIX_GETSOCKNAME, __MAX_BPF_ATTACH_TYPE }; @@ -2611,8 +2617,8 @@ union bpf_attr { * *bpf_socket* should be one of the following: * * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. - * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** - * and **BPF_CGROUP_INET6_CONNECT**. + * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**, + * **BPF_CGROUP_INET6_CONNECT** and **BPF_CGROUP_UNIX_CONNECT**. * * This helper actually implements a subset of **setsockopt()**. * It supports the following *level*\ s: @@ -2850,8 +2856,8 @@ union bpf_attr { * *bpf_socket* should be one of the following: * * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. - * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** - * and **BPF_CGROUP_INET6_CONNECT**. + * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**, + * **BPF_CGROUP_INET6_CONNECT** and **BPF_CGROUP_UNIX_CONNECT**. * * This helper actually implements a subset of **getsockopt()**. * It supports the same set of *optname*\ s that is supported by diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index c2191f0e138e..2cf01cbaf489 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -1455,7 +1455,7 @@ EXPORT_SYMBOL(__cgroup_bpf_run_filter_sk); * @flags: Pointer to u32 which contains higher bits of BPF program * return value (OR'ed together). * - * socket is expected to be of type INET or INET6. + * socket is expected to be of type INET, INET6 or UNIX. * * This function will return %-EPERM if an attached program is found and * returned value != 1 during execution. In all other cases, the new address @@ -1481,7 +1481,8 @@ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, /* Check socket family since not all sockets represent network * endpoint (e.g. AF_UNIX). */ - if (sk->sk_family != AF_INET && sk->sk_family != AF_INET6) + if (sk->sk_family != AF_INET && sk->sk_family != AF_INET6 && + sk->sk_family != AF_UNIX) return 0; if (!ctx.uaddr) { @@ -2511,10 +2512,13 @@ cgroup_common_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_CGROUP_SOCK_OPS: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: return NULL; default: return &bpf_get_retval_proto; @@ -2526,10 +2530,13 @@ cgroup_common_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_CGROUP_SOCK_OPS: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: return NULL; default: return &bpf_set_retval_proto; diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index bcf1a1920ddd..170ec8ad38d3 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2390,16 +2390,22 @@ bpf_prog_load_check_attach(enum bpf_prog_type prog_type, switch (expected_attach_type) { case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: return 0; default: return -EINVAL; @@ -3453,16 +3459,22 @@ attach_type_to_prog_type(enum bpf_attach_type attach_type) return BPF_PROG_TYPE_CGROUP_SOCK; case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: return BPF_PROG_TYPE_CGROUP_SOCK_ADDR; case BPF_CGROUP_SOCK_OPS: return BPF_PROG_TYPE_SOCK_OPS; @@ -3618,18 +3630,24 @@ static int bpf_prog_query(const union bpf_attr *attr, case BPF_CGROUP_INET_SOCK_RELEASE: case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: case BPF_CGROUP_INET4_POST_BIND: case BPF_CGROUP_INET6_POST_BIND: case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: case BPF_CGROUP_SOCK_OPS: case BPF_CGROUP_DEVICE: case BPF_CGROUP_SYSCTL: diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1e05355facdc..3645a693c54e 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -13756,14 +13756,19 @@ static int check_return_code(struct bpf_verifier_env *env) case BPF_PROG_TYPE_CGROUP_SOCK_ADDR: if (env->prog->expected_attach_type == BPF_CGROUP_UDP4_RECVMSG || env->prog->expected_attach_type == BPF_CGROUP_UDP6_RECVMSG || + env->prog->expected_attach_type == BPF_CGROUP_UNIX_RECVMSG || env->prog->expected_attach_type == BPF_CGROUP_INET4_GETPEERNAME || env->prog->expected_attach_type == BPF_CGROUP_INET6_GETPEERNAME || + env->prog->expected_attach_type == BPF_CGROUP_UNIX_GETPEERNAME || env->prog->expected_attach_type == BPF_CGROUP_INET4_GETSOCKNAME || - env->prog->expected_attach_type == BPF_CGROUP_INET6_GETSOCKNAME) + env->prog->expected_attach_type == BPF_CGROUP_INET6_GETSOCKNAME || + env->prog->expected_attach_type == BPF_CGROUP_UNIX_GETSOCKNAME) range = tnum_range(1, 1); if (env->prog->expected_attach_type == BPF_CGROUP_INET4_BIND || env->prog->expected_attach_type == BPF_CGROUP_INET6_BIND) range = tnum_range(0, 3); + if (env->prog->expected_attach_type == BPF_CGROUP_UNIX_BIND) + range = tnum_range(0, 1); break; case BPF_PROG_TYPE_CGROUP_SKB: if (env->prog->expected_attach_type == BPF_CGROUP_INET_EGRESS) { diff --git a/net/core/filter.c b/net/core/filter.c index 1c656e2d7b58..2f90fb3a9a64 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7747,6 +7747,7 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) switch (prog->expected_attach_type) { case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: return &bpf_bind_proto; default: return NULL; @@ -7775,16 +7776,22 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) switch (prog->expected_attach_type) { case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: return &bpf_sock_addr_setsockopt_proto; default: return NULL; @@ -7793,16 +7800,22 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) switch (prog->expected_attach_type) { case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: case BPF_CGROUP_INET4_GETPEERNAME: case BPF_CGROUP_INET6_GETPEERNAME: + case BPF_CGROUP_UNIX_GETPEERNAME: case BPF_CGROUP_INET4_GETSOCKNAME: case BPF_CGROUP_INET6_GETSOCKNAME: + case BPF_CGROUP_UNIX_GETSOCKNAME: return &bpf_sock_addr_getsockopt_proto; default: return NULL; @@ -8850,8 +8863,8 @@ static bool sock_addr_is_valid_access(int off, int size, if (off % size != 0) return false; - /* Disallow access to IPv6 fields from IPv4 contex and vise - * versa. + /* Disallow access to fields not belonging to the attach type's address + * family. */ switch (off) { case bpf_ctx_range(struct bpf_sock_addr, user_ip4): diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index fb31e8a4409e..5109596e5437 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -116,6 +116,7 @@ #include #include #include +#include #include "scm.h" @@ -1303,6 +1304,14 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) struct sock *sk = sock->sk; int err; + if (cgroup_bpf_enabled(CGROUP_UNIX_BIND)) { + err = BPF_CGROUP_RUN_PROG_UNIX_BIND_LOCK(sk, uaddr, addr_len); + if (err < 0) + return err; + + addr_len = err; + } + if (addr_len == offsetof(struct sockaddr_un, sun_path) && sunaddr->sun_family == AF_UNIX) return unix_autobind(sk); @@ -1357,6 +1366,15 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr, goto out; if (addr->sa_family != AF_UNSPEC) { + if (cgroup_bpf_enabled(CGROUP_UNIX_CONNECT)) { + err = BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, addr, + alen); + if (err < 0) + goto out; + + alen = err; + } + err = unix_validate_addr(sunaddr, alen); if (err) goto out; @@ -1465,6 +1483,15 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr, int err; int st; + if (cgroup_bpf_enabled(CGROUP_UNIX_CONNECT)) { + err = BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, uaddr, + addr_len); + if (err < 0) + goto out; + + addr_len = err; + } + err = unix_validate_addr(sunaddr, addr_len); if (err) goto out; @@ -1725,7 +1752,7 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer) struct sock *sk = sock->sk; struct unix_address *addr; DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr); - int err = 0; + int addr_len = 0, err = 0; if (peer) { sk = unix_peer_get(sk); @@ -1742,14 +1769,39 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer) if (!addr) { sunaddr->sun_family = AF_UNIX; sunaddr->sun_path[0] = 0; - err = offsetof(struct sockaddr_un, sun_path); + addr_len = offsetof(struct sockaddr_un, sun_path); } else { - err = addr->len; + addr_len = addr->len; memcpy(sunaddr, addr->name, addr->len); } + + if (peer && cgroup_bpf_enabled(CGROUP_UNIX_GETPEERNAME)) { + err = BPF_CGROUP_RUN_SA_PROG(sk, uaddr, addr_len, + CGROUP_UNIX_GETPEERNAME); + if (err < 0) + goto out; + + addr_len = err; + + err = unix_validate_addr(sunaddr, addr_len); + if (err) + goto out; + } else if (cgroup_bpf_enabled(CGROUP_UNIX_GETSOCKNAME)) { + err = BPF_CGROUP_RUN_SA_PROG(sk, uaddr, addr_len, + CGROUP_UNIX_GETSOCKNAME); + if (err < 0) + goto out; + + addr_len = err; + + err = unix_validate_addr(sunaddr, addr_len); + if (err) + goto out; + } + sock_put(sk); out: - return err; + return err ?: addr_len; } static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb) @@ -1911,6 +1963,17 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg, goto out; if (msg->msg_namelen) { + if (cgroup_bpf_enabled(CGROUP_UNIX_SENDMSG)) { + err = BPF_CGROUP_RUN_PROG_UNIX_SENDMSG_LOCK(sk, + msg->msg_name, + msg->msg_namelen, + NULL); + if (err < 0) + goto out; + + msg->msg_namelen = err; + } + err = unix_validate_addr(sunaddr, msg->msg_namelen); if (err) goto out; @@ -2418,14 +2481,32 @@ static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg, return unix_dgram_recvmsg(sock, msg, size, flags); } -static void unix_copy_addr(struct msghdr *msg, struct sock *sk) +static int unix_recvmsg_copy_addr(struct msghdr *msg, struct sock *sk) { struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr); + int err; if (addr) { msg->msg_namelen = addr->len; memcpy(msg->msg_name, addr->name, addr->len); + + if (cgroup_bpf_enabled(CGROUP_UNIX_RECVMSG)) { + err = BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK(sk, + msg->msg_name, + msg->msg_namelen); + if (err < 0) + return err; + + msg->msg_namelen = err; + + err = unix_validate_addr(msg->msg_name, + msg->msg_namelen); + if (err) + return err; + } } + + return 0; } int __unix_dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t size, @@ -2480,8 +2561,11 @@ int __unix_dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t size, EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND); - if (msg->msg_name) - unix_copy_addr(msg, skb->sk); + if (msg->msg_name) { + err = unix_recvmsg_copy_addr(msg, skb->sk); + if (err) + goto out_free; + } if (size > skb->len - skip) size = skb->len - skip; @@ -2835,7 +2919,9 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, if (state->msg && state->msg->msg_name) { DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, state->msg->msg_name); - unix_copy_addr(state->msg, skb->sk); + err = unix_recvmsg_copy_addr(state->msg, skb->sk); + if (err) + break; sunaddr = NULL; } diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 4b20a7269bee..58ed37ac0436 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -1034,6 +1034,12 @@ enum bpf_attach_type { BPF_TRACE_KPROBE_MULTI, BPF_LSM_CGROUP, BPF_STRUCT_OPS, + BPF_CGROUP_UNIX_BIND, + BPF_CGROUP_UNIX_CONNECT, + BPF_CGROUP_UNIX_SENDMSG, + BPF_CGROUP_UNIX_RECVMSG, + BPF_CGROUP_UNIX_GETPEERNAME, + BPF_CGROUP_UNIX_GETSOCKNAME, __MAX_BPF_ATTACH_TYPE }; @@ -2611,8 +2617,8 @@ union bpf_attr { * *bpf_socket* should be one of the following: * * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. - * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** - * and **BPF_CGROUP_INET6_CONNECT**. + * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**, + * **BPF_CGROUP_INET6_CONNECT** and **BPF_CGROUP_UNIX_CONNECT**. * * This helper actually implements a subset of **setsockopt()**. * It supports the following *level*\ s: @@ -2850,8 +2856,8 @@ union bpf_attr { * *bpf_socket* should be one of the following: * * * **struct bpf_sock_ops** for **BPF_PROG_TYPE_SOCK_OPS**. - * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT** - * and **BPF_CGROUP_INET6_CONNECT**. + * * **struct bpf_sock_addr** for **BPF_CGROUP_INET4_CONNECT**, + * **BPF_CGROUP_INET6_CONNECT** and **BPF_CGROUP_UNIX_CONNECT**. * * This helper actually implements a subset of **getsockopt()**. * It supports the same set of *optname*\ s that is supported by From patchwork Fri Apr 21 16:27:15 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13220334 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0AB4CC77B61 for ; Fri, 21 Apr 2023 16:31:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232708AbjDUQbb (ORCPT ); Fri, 21 Apr 2023 12:31:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44896 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231459AbjDUQba (ORCPT ); Fri, 21 Apr 2023 12:31:30 -0400 Received: from mail-ej1-x62a.google.com (mail-ej1-x62a.google.com [IPv6:2a00:1450:4864:20::62a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 796D415444 for ; Fri, 21 Apr 2023 09:31:27 -0700 (PDT) Received: by mail-ej1-x62a.google.com with SMTP id a640c23a62f3a-95316faa3a8so315751366b.2 for ; Fri, 21 Apr 2023 09:31:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682094685; x=1684686685; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=OlmCQ1bWISwjXx8nPRcd1IaBUx7R6I6VoIO3cs8+xhQ=; b=aKGSv/FJebfkBmnCFAP3vBWGgqCA+HJHq7I2Ps6CvybyvaMeUXyXt0323zDDzvc6ze 6VcBn1HnHoQGh0FFkMVtiqCU5618/RF9Ym+Q/Zr6TM0dS0ObeLo3Yj9paEcvfVGDyEQz /ZiylFvXzMyCB8GQLTtmIoi227CcD1mhiBebKv772sD+QR3smTpatknBk3dfBxbAUUAm zk1c57J4piPu19QyRQ+yuQOaaWD7kMgWnoFFH712ueDPUN3EFKNIzImAILd29cUPNpRT x4WyD7178I9YFUlbnAn96sxPJ+C7IWHfqUwrocb5GH61l0/I8Rnau25hZU4IAeP4F4uZ SldQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682094685; x=1684686685; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=OlmCQ1bWISwjXx8nPRcd1IaBUx7R6I6VoIO3cs8+xhQ=; b=WajU4TTvIL615E5Bx8jRdv1n6EgTLeXB2M+b2EbjgaPU79igigpUnyiBAPAxJ1aiyA 1lVwN9t489jC3VWFPMk5UXEGLuU2q1nAJUx8IMcLVvzVgCxWlCz0r/Jf3PRYNmZYqLvf 0oFe7eT+SO7ttrmZ20bQHXimXop9fMiI/4QJjxQxdsQPu0Swfh1QiDkcNOTO+Y2AutBA E1gpcg3ZTNi3keWSY7r4jAz4reqdfVZ00OVd5tBGDbVXH6Fbbo+wTVaQqmXHDOKSc0RG 7i9y7lM7VseeVMeU+9KQDicBTk/709jEisNIuSZYL+/6fg24fupMltnhijKQO5k1/+2C kKiw== X-Gm-Message-State: AAQBX9eW3ns7mUth31wf97xqXCoaDliI+n1w3KXuG0zw65bXZje5HJWi YrzdGcv2shMjORetRUIy1e4T6COqBLM9KA== X-Google-Smtp-Source: AKy350bCDLRTp9WIHrJKeGNUzjyOuMeBUMHv55YxlqRv9wN3pyIhp1tWYhfA9oWQaceTxlCGp/42zw== X-Received: by 2002:a17:906:37c9:b0:930:e9ee:c474 with SMTP id o9-20020a17090637c900b00930e9eec474mr3268069ejc.54.1682094685555; Fri, 21 Apr 2023 09:31:25 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:864b:8201:e534:34f4:1c34:8de7]) by smtp.googlemail.com with ESMTPSA id k9-20020a170906970900b009534211cc97sm2248578ejx.159.2023.04.21.09.31.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Apr 2023 09:31:25 -0700 (PDT) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v3 07/10] libbpf: Add support for cgroup unix socket address hooks Date: Fri, 21 Apr 2023 18:27:15 +0200 Message-Id: <20230421162718.440230-8-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230421162718.440230-1-daan.j.demeyer@gmail.com> References: <20230421162718.440230-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net Add the necessary plumbing to hook up the new cgroup unix sockaddr hooks into libbpf. Signed-off-by: Daan De Meyer --- tools/lib/bpf/libbpf.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c index 2600d8384252..0c4f67c3d9b9 100644 --- a/tools/lib/bpf/libbpf.c +++ b/tools/lib/bpf/libbpf.c @@ -80,19 +80,25 @@ static const char * const attach_type_name[] = { [BPF_CGROUP_DEVICE] = "cgroup_device", [BPF_CGROUP_INET4_BIND] = "cgroup_inet4_bind", [BPF_CGROUP_INET6_BIND] = "cgroup_inet6_bind", + [BPF_CGROUP_UNIX_BIND] = "cgroup_unix_bind", [BPF_CGROUP_INET4_CONNECT] = "cgroup_inet4_connect", [BPF_CGROUP_INET6_CONNECT] = "cgroup_inet6_connect", + [BPF_CGROUP_UNIX_CONNECT] = "cgroup_unix_connect", [BPF_CGROUP_INET4_POST_BIND] = "cgroup_inet4_post_bind", [BPF_CGROUP_INET6_POST_BIND] = "cgroup_inet6_post_bind", [BPF_CGROUP_INET4_GETPEERNAME] = "cgroup_inet4_getpeername", [BPF_CGROUP_INET6_GETPEERNAME] = "cgroup_inet6_getpeername", + [BPF_CGROUP_UNIX_GETPEERNAME] = "cgroup_unix_getpeername", [BPF_CGROUP_INET4_GETSOCKNAME] = "cgroup_inet4_getsockname", [BPF_CGROUP_INET6_GETSOCKNAME] = "cgroup_inet6_getsockname", + [BPF_CGROUP_UNIX_GETSOCKNAME] = "cgroup_unix_getsockname", [BPF_CGROUP_UDP4_SENDMSG] = "cgroup_udp4_sendmsg", [BPF_CGROUP_UDP6_SENDMSG] = "cgroup_udp6_sendmsg", + [BPF_CGROUP_UNIX_SENDMSG] = "cgroup_unix_sendmsg", [BPF_CGROUP_SYSCTL] = "cgroup_sysctl", [BPF_CGROUP_UDP4_RECVMSG] = "cgroup_udp4_recvmsg", [BPF_CGROUP_UDP6_RECVMSG] = "cgroup_udp6_recvmsg", + [BPF_CGROUP_UNIX_RECVMSG] = "cgroup_unix_recvmsg", [BPF_CGROUP_GETSOCKOPT] = "cgroup_getsockopt", [BPF_CGROUP_SETSOCKOPT] = "cgroup_setsockopt", [BPF_SK_SKB_STREAM_PARSER] = "sk_skb_stream_parser", @@ -8693,16 +8699,22 @@ static const struct bpf_sec_def section_defs[] = { SEC_DEF("cgroup/post_bind6", CGROUP_SOCK, BPF_CGROUP_INET6_POST_BIND, SEC_ATTACHABLE), SEC_DEF("cgroup/bind4", CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_BIND, SEC_ATTACHABLE), SEC_DEF("cgroup/bind6", CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_BIND, SEC_ATTACHABLE), + SEC_DEF("cgroup/bindun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_BIND, SEC_ATTACHABLE), SEC_DEF("cgroup/connect4", CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_CONNECT, SEC_ATTACHABLE), SEC_DEF("cgroup/connect6", CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_CONNECT, SEC_ATTACHABLE), + SEC_DEF("cgroup/connectun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_CONNECT, SEC_ATTACHABLE), SEC_DEF("cgroup/sendmsg4", CGROUP_SOCK_ADDR, BPF_CGROUP_UDP4_SENDMSG, SEC_ATTACHABLE), SEC_DEF("cgroup/sendmsg6", CGROUP_SOCK_ADDR, BPF_CGROUP_UDP6_SENDMSG, SEC_ATTACHABLE), + SEC_DEF("cgroup/sendmsgun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_SENDMSG, SEC_ATTACHABLE), SEC_DEF("cgroup/recvmsg4", CGROUP_SOCK_ADDR, BPF_CGROUP_UDP4_RECVMSG, SEC_ATTACHABLE), SEC_DEF("cgroup/recvmsg6", CGROUP_SOCK_ADDR, BPF_CGROUP_UDP6_RECVMSG, SEC_ATTACHABLE), + SEC_DEF("cgroup/recvmsgun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_RECVMSG, SEC_ATTACHABLE), SEC_DEF("cgroup/getpeername4", CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETPEERNAME, SEC_ATTACHABLE), SEC_DEF("cgroup/getpeername6", CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETPEERNAME, SEC_ATTACHABLE), + SEC_DEF("cgroup/getpeernameun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_GETPEERNAME, SEC_ATTACHABLE), SEC_DEF("cgroup/getsockname4", CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETSOCKNAME, SEC_ATTACHABLE), SEC_DEF("cgroup/getsockname6", CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETSOCKNAME, SEC_ATTACHABLE), + SEC_DEF("cgroup/getsocknameun", CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_GETSOCKNAME, SEC_ATTACHABLE), SEC_DEF("cgroup/sysctl", CGROUP_SYSCTL, BPF_CGROUP_SYSCTL, SEC_ATTACHABLE), SEC_DEF("cgroup/getsockopt", CGROUP_SOCKOPT, BPF_CGROUP_GETSOCKOPT, SEC_ATTACHABLE), SEC_DEF("cgroup/setsockopt", CGROUP_SOCKOPT, BPF_CGROUP_SETSOCKOPT, SEC_ATTACHABLE), From patchwork Fri Apr 21 16:27:16 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13220335 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D52D9C7618E for ; Fri, 21 Apr 2023 16:31:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233070AbjDUQbf (ORCPT ); Fri, 21 Apr 2023 12:31:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44978 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232873AbjDUQbb (ORCPT ); Fri, 21 Apr 2023 12:31:31 -0400 Received: from mail-ej1-x62f.google.com (mail-ej1-x62f.google.com [IPv6:2a00:1450:4864:20::62f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8990E14F70 for ; Fri, 21 Apr 2023 09:31:28 -0700 (PDT) Received: by mail-ej1-x62f.google.com with SMTP id a640c23a62f3a-95678d891d6so264177166b.1 for ; Fri, 21 Apr 2023 09:31:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682094686; x=1684686686; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=tAdiYdJTmT1ElcYjcusvELkJU8uR9pERBCFvUOOPlpI=; b=m8pwg968C734fvxTj2aUvmwLdjk1H8J9WYpYTfaGKZfP+kGJBcqECt1apZ1NIhZqxm 6IFMO7KHQTTEtFzcMOK1vMe1POl1VvPsDs5T8z1k8u89sMk5QSv+El45/kqPJ/wAEsoK NAnJd8ZdZbQ/GAThSreteSWAXiL1iLeH5fw6lqyiIdz8ESD7MgtvCvFSTraKkO+J+3ZY 4C5ncBt+qsIXig6bGHcOexkna9P5EmJ2WOtSNidRhNCFUGsVaew5TkXeLleJGFk8W2eg BgkJ3UmZtj45S0gPXsm3cwigYvtb1k6FqGCLKd709z6cNjT83Kqo4nLekhqo02bSj7YY 75wQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682094686; x=1684686686; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=tAdiYdJTmT1ElcYjcusvELkJU8uR9pERBCFvUOOPlpI=; b=CU5xPZR+CQ+WSdWvAUOSjx1GJpUge7V5ebb/ADKZgNM7Q99qTaA+CqoWUDZb+iyoAL HLKebZUk8o4m+oSalFz/SmTDvfOiA+nxgXzJm3YzGB7ngJavagqaQU23AUDHyrILmdah cNbj9AGDtFNs8dhrSCWtRlvkGGGDxwskHrIj4MMRHHO8BFtAmZTxUFzK1+XmpZX1PvhY 99BfQn6W9RxR6nfD0FZ4C70Y60mCXSyzr75cmSztoYJMI2YECWdRzn2LSOudL7ZoY42X gb8yBn6VrsPl9hIsYeKqS8aOgBomZigyTdp6NZ169IRofjeVgpNXPsVeOv4Cb3SprtzK ZVXw== X-Gm-Message-State: AAQBX9ffO4ElB4GUjyhcmqIKhvJHazowrn6vLVJXW8B3PlYPIkidjB2I ZOb9FeXsSvvzI5apA4Aq9fNdJeiGQ0EChw== X-Google-Smtp-Source: AKy350bvSGU48V+LQif6D75/gYaqlrYjaSSXz7QPhQx2cvjU7zXTSHt8DBb15np4JKvLiWj7RHGv2Q== X-Received: by 2002:a17:906:5a68:b0:94e:ea07:4b87 with SMTP id my40-20020a1709065a6800b0094eea074b87mr2899729ejc.27.1682094686482; Fri, 21 Apr 2023 09:31:26 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:864b:8201:e534:34f4:1c34:8de7]) by smtp.googlemail.com with ESMTPSA id k9-20020a170906970900b009534211cc97sm2248578ejx.159.2023.04.21.09.31.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Apr 2023 09:31:26 -0700 (PDT) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v3 08/10] bpftool: Add support for cgroup unix socket address hooks Date: Fri, 21 Apr 2023 18:27:16 +0200 Message-Id: <20230421162718.440230-9-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230421162718.440230-1-daan.j.demeyer@gmail.com> References: <20230421162718.440230-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net Add the necessary plumbing to hook up the new cgroup unix sockaddr hooks into bpftool. Signed-off-by: Daan De Meyer --- .../bpftool/Documentation/bpftool-cgroup.rst | 21 ++++++++++++++----- tools/bpf/bpftool/cgroup.c | 17 ++++++++------- tools/bpf/bpftool/common.c | 6 ++++++ 3 files changed, 32 insertions(+), 12 deletions(-) diff --git a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst index bd015ec9847b..a2d990fa623b 100644 --- a/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst +++ b/tools/bpf/bpftool/Documentation/bpftool-cgroup.rst @@ -34,13 +34,16 @@ CGROUP COMMANDS | *ATTACH_TYPE* := { **cgroup_inet_ingress** | **cgroup_inet_egress** | | **cgroup_inet_sock_create** | **cgroup_sock_ops** | | **cgroup_device** | **cgroup_inet4_bind** | **cgroup_inet6_bind** | -| **cgroup_inet4_post_bind** | **cgroup_inet6_post_bind** | -| **cgroup_inet4_connect** | **cgroup_inet6_connect** | +| **cgroup_unix_bind** | **cgroup_inet4_post_bind** | +| **cgroup_inet6_post_bind** | **cgroup_inet4_connect** | +| **cgroup_inet6_connect** | **cgroup_unix_connect** | | **cgroup_inet4_getpeername** | **cgroup_inet6_getpeername** | -| **cgroup_inet4_getsockname** | **cgroup_inet6_getsockname** | -| **cgroup_udp4_sendmsg** | **cgroup_udp6_sendmsg** | +| **cgroup_unix_getpeername** | **cgroup_inet4_getsockname** | +| **cgroup_inet6_getsockname** | **cgroup_udp4_sendmsg** | +| **cgroup_udp6_sendmsg** | **cgroup_unix_sendmsg** | | **cgroup_udp4_recvmsg** | **cgroup_udp6_recvmsg** | -| **cgroup_sysctl** | **cgroup_getsockopt** | **cgroup_setsockopt** | +| **cgroup_unix_recvmsg** | **cgroup_sysctl** | +| **cgroup_getsockopt** | **cgroup_setsockopt** | | **cgroup_inet_sock_release** } | *ATTACH_FLAGS* := { **multi** | **override** } @@ -98,25 +101,33 @@ DESCRIPTION **device** device access (since 4.15); **bind4** call to bind(2) for an inet4 socket (since 4.17); **bind6** call to bind(2) for an inet6 socket (since 4.17); + **bindun** call to bind(2) for a unix socket (since 6.3); **post_bind4** return from bind(2) for an inet4 socket (since 4.17); **post_bind6** return from bind(2) for an inet6 socket (since 4.17); **connect4** call to connect(2) for an inet4 socket (since 4.17); **connect6** call to connect(2) for an inet6 socket (since 4.17); + **connectun** call to connect(2) for a unix socket (since 6.3); **sendmsg4** call to sendto(2), sendmsg(2), sendmmsg(2) for an unconnected udp4 socket (since 4.18); **sendmsg6** call to sendto(2), sendmsg(2), sendmmsg(2) for an unconnected udp6 socket (since 4.18); + **sendmsgun** call to sendto(2), sendmsg(2), sendmmsg(2) for + an unconnected unix socket (since 6.3); **recvmsg4** call to recvfrom(2), recvmsg(2), recvmmsg(2) for an unconnected udp4 socket (since 5.2); **recvmsg6** call to recvfrom(2), recvmsg(2), recvmmsg(2) for an unconnected udp6 socket (since 5.2); + **recvmsgun** call to recvfrom(2), recvmsg(2), recvmmsg(2) for + an unconnected unix socket (since 6.3); **sysctl** sysctl access (since 5.2); **getsockopt** call to getsockopt (since 5.3); **setsockopt** call to setsockopt (since 5.3); **getpeername4** call to getpeername(2) for an inet4 socket (since 5.8); **getpeername6** call to getpeername(2) for an inet6 socket (since 5.8); + **getpeernameun** call to getpeername(2) for a unix socket (since 6.3); **getsockname4** call to getsockname(2) for an inet4 socket (since 5.8); **getsockname6** call to getsockname(2) for an inet6 socket (since 5.8). + **getsocknameun** call to getsockname(2) for a unix socket (since 6.3); **sock_release** closing an userspace inet socket (since 5.9). **bpftool cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG* diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c index ac846b0805b4..a9700e00064c 100644 --- a/tools/bpf/bpftool/cgroup.c +++ b/tools/bpf/bpftool/cgroup.c @@ -26,13 +26,16 @@ " ATTACH_TYPE := { cgroup_inet_ingress | cgroup_inet_egress |\n" \ " cgroup_inet_sock_create | cgroup_sock_ops |\n" \ " cgroup_device | cgroup_inet4_bind |\n" \ - " cgroup_inet6_bind | cgroup_inet4_post_bind |\n" \ - " cgroup_inet6_post_bind | cgroup_inet4_connect |\n" \ - " cgroup_inet6_connect | cgroup_inet4_getpeername |\n" \ - " cgroup_inet6_getpeername | cgroup_inet4_getsockname |\n" \ - " cgroup_inet6_getsockname | cgroup_udp4_sendmsg |\n" \ - " cgroup_udp6_sendmsg | cgroup_udp4_recvmsg |\n" \ - " cgroup_udp6_recvmsg | cgroup_sysctl |\n" \ + " cgroup_inet6_bind | cgroup_unix_bind |\n" \ + " cgroup_inet4_post_bind | cgroup_inet6_post_bind |\n" \ + " cgroup_inet4_connect | cgroup_inet6_connect |\n" \ + " cgroup_unix_connect | cgroup_inet4_getpeername |\n" \ + " cgroup_inet6_getpeername | cgroup_unix_getpeername |\n" \ + " cgroup_inet4_getsockname | cgroup_inet6_getsockname |\n" \ + " cgroup_unix_getsockname | cgroup_udp4_sendmsg |\n" \ + " cgroup_udp6_sendmsg | cgroup_unix_sendmsg |\n" \ + " cgroup_udp4_recvmsg | cgroup_udp6_recvmsg |\n" \ + " cgroup_unix_recvmsg | cgroup_sysctl |\n" \ " cgroup_getsockopt | cgroup_setsockopt |\n" \ " cgroup_inet_sock_release }" diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c index 5a73ccf14332..71c219b186aa 100644 --- a/tools/bpf/bpftool/common.c +++ b/tools/bpf/bpftool/common.c @@ -1067,19 +1067,25 @@ const char *bpf_attach_type_input_str(enum bpf_attach_type t) case BPF_CGROUP_DEVICE: return "device"; case BPF_CGROUP_INET4_BIND: return "bind4"; case BPF_CGROUP_INET6_BIND: return "bind6"; + case BPF_CGROUP_UNIX_BIND: return "bindun"; case BPF_CGROUP_INET4_CONNECT: return "connect4"; case BPF_CGROUP_INET6_CONNECT: return "connect6"; + case BPF_CGROUP_UNIX_CONNECT: return "connectun"; case BPF_CGROUP_INET4_POST_BIND: return "post_bind4"; case BPF_CGROUP_INET6_POST_BIND: return "post_bind6"; case BPF_CGROUP_INET4_GETPEERNAME: return "getpeername4"; case BPF_CGROUP_INET6_GETPEERNAME: return "getpeername6"; + case BPF_CGROUP_UNIX_GETPEERNAME: return "getpeernameun"; case BPF_CGROUP_INET4_GETSOCKNAME: return "getsockname4"; case BPF_CGROUP_INET6_GETSOCKNAME: return "getsockname6"; + case BPF_CGROUP_UNIX_GETSOCKNAME: return "getsocknameun"; case BPF_CGROUP_UDP4_SENDMSG: return "sendmsg4"; case BPF_CGROUP_UDP6_SENDMSG: return "sendmsg6"; + case BPF_CGROUP_UNIX_SENDMSG: return "sendmsgun"; case BPF_CGROUP_SYSCTL: return "sysctl"; case BPF_CGROUP_UDP4_RECVMSG: return "recvmsg4"; case BPF_CGROUP_UDP6_RECVMSG: return "recvmsg6"; + case BPF_CGROUP_UNIX_RECVMSG: return "recvmsgun"; case BPF_CGROUP_GETSOCKOPT: return "getsockopt"; case BPF_CGROUP_SETSOCKOPT: return "setsockopt"; case BPF_TRACE_RAW_TP: return "raw_tp"; From patchwork Fri Apr 21 16:27:17 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13220336 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A3FCC77B61 for ; Fri, 21 Apr 2023 16:31:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232725AbjDUQbg (ORCPT ); Fri, 21 Apr 2023 12:31:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45046 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232933AbjDUQbd (ORCPT ); Fri, 21 Apr 2023 12:31:33 -0400 Received: from mail-ej1-x633.google.com (mail-ej1-x633.google.com [IPv6:2a00:1450:4864:20::633]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7357814F72 for ; Fri, 21 Apr 2023 09:31:29 -0700 (PDT) Received: by mail-ej1-x633.google.com with SMTP id a640c23a62f3a-94ed7e49541so256565166b.1 for ; Fri, 21 Apr 2023 09:31:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682094687; x=1684686687; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=FWulsIzALwMd9wYNJRNZRarwLcG9Zsb0Jk1OKBFMIm0=; b=Mu5BMbKDO4d56DDv8K49az0JtUA0OnpOdrVYuykwDygmfmbUJtx8DDtiZpnX4+Tr9g ZFkk7KXKic+g8KVs/R183mfrhcGXcod21oLIX5UhAhiz+qtjQDlKG8LcRZnB1FCnTROG H4OUy9V5GjYna6QPqs0q7kU75/bal6MDaySVetSFNB6+D13wB94FthL1CZQq72vEcW+9 zKAtomE3OhDBpSkdLmhpi3ie3Ho7Je9TU7la2n0uQX3wpiEle0GoPsDlre7edu+3Ft63 w0L1zNsjkyBCKRPmORyWOvP9O5+vOopcpTMTU/cU4Pd26829GqdhMpdreZIJI3wJB0+O D5yA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682094687; x=1684686687; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=FWulsIzALwMd9wYNJRNZRarwLcG9Zsb0Jk1OKBFMIm0=; b=UgEh0JyIen/A+zAAUFGC6+kjAyeuaGTKjFCEhHniHDppgsdoxNZUwgy+D6M0wcOxZw C/CP4nHMuiSlsrzB2kiN1j1PWWEXsmO1rljICvQXy4u33KVGV27mrvgeWuMFBNRkSsI8 Bziq8+XbmLd5/j/ysIdfPFCRe2QBgG8bMjLauLlB4rh0KqkHYdHnNVDpeq7dKxku/FSb eNsqokhaUKpUzmdsQAFp9A2joniDDNGO68kffuIbrVRd3+DuoxA6k4l/feteqrh8+l4K zTaNvvukr+0u3UiKXAic9ublaCBGNmm83x5KbKL+cYKcF3vTTBw+Qor/hm+rkMyG16nA ufbQ== X-Gm-Message-State: AAQBX9dJ/XF8SxObYZeAXeoeVUDV0brms53vypysz9vQ5u0kpnHGqP7w YTIyDYp8ltgXFwqOXugFbtJOOmo+fjem0Q== X-Google-Smtp-Source: AKy350ZFeXqG2flUbiWOddZucH6cAB0YBgbwuAF/5Hx0TXzE39XdkikdrjwLuDsI4/4OthkUVWG5Ow== X-Received: by 2002:a17:906:6b83:b0:94f:3d6e:f584 with SMTP id l3-20020a1709066b8300b0094f3d6ef584mr2924578ejr.5.1682094687392; Fri, 21 Apr 2023 09:31:27 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:864b:8201:e534:34f4:1c34:8de7]) by smtp.googlemail.com with ESMTPSA id k9-20020a170906970900b009534211cc97sm2248578ejx.159.2023.04.21.09.31.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Apr 2023 09:31:27 -0700 (PDT) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v3 09/10] selftests/bpf: Add tests for cgroup unix socket address hooks Date: Fri, 21 Apr 2023 18:27:17 +0200 Message-Id: <20230421162718.440230-10-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230421162718.440230-1-daan.j.demeyer@gmail.com> References: <20230421162718.440230-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net The unix socket address hooks do not support modifying the source address so we skip source address checks when we're running a unix socket address hook test. Signed-off-by: Daan De Meyer --- tools/testing/selftests/bpf/bpf_kfuncs.h | 13 ++ .../selftests/bpf/prog_tests/section_names.c | 30 ++++ .../testing/selftests/bpf/progs/bindun_prog.c | 59 ++++++++ .../selftests/bpf/progs/connectun_prog.c | 53 +++++++ .../selftests/bpf/progs/recvmsgun_prog.c | 59 ++++++++ .../selftests/bpf/progs/sendmsgun_prog.c | 53 +++++++ tools/testing/selftests/bpf/test_sock_addr.c | 137 +++++++++++++++++- 7 files changed, 397 insertions(+), 7 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/bindun_prog.c create mode 100644 tools/testing/selftests/bpf/progs/connectun_prog.c create mode 100644 tools/testing/selftests/bpf/progs/recvmsgun_prog.c create mode 100644 tools/testing/selftests/bpf/progs/sendmsgun_prog.c diff --git a/tools/testing/selftests/bpf/bpf_kfuncs.h b/tools/testing/selftests/bpf/bpf_kfuncs.h index 8c993ec8ceea..dbdec3d5152e 100644 --- a/tools/testing/selftests/bpf/bpf_kfuncs.h +++ b/tools/testing/selftests/bpf/bpf_kfuncs.h @@ -1,6 +1,8 @@ #ifndef __BPF_KFUNCS__ #define __BPF_KFUNCS__ +struct bpf_sock_addr_kern; + /* Description * Initializes an skb-type dynptr * Returns @@ -35,4 +37,15 @@ extern void *bpf_dynptr_slice(const struct bpf_dynptr *ptr, __u32 offset, extern void *bpf_dynptr_slice_rdwr(const struct bpf_dynptr *ptr, __u32 offset, void *buffer, __u32 buffer__szk) __ksym; +/* Description + * Modify the contents of a sockaddr. + * Returns__bpf_kfunc + * -EINVAL if the sockaddr family does not match, the sockaddr is too small or + * too big, 0 if the sockaddr was successfully modified. + */ +extern int bpf_sock_addr_set(struct bpf_sock_addr_kern *sa_kern, + const void *addr, __u32 addrlen__sz) __ksym; + +void *bpf_rdonly_cast(void *obj, __u32 btf_id) __ksym; + #endif diff --git a/tools/testing/selftests/bpf/prog_tests/section_names.c b/tools/testing/selftests/bpf/prog_tests/section_names.c index fc5248e94a01..51ebc8e6065d 100644 --- a/tools/testing/selftests/bpf/prog_tests/section_names.c +++ b/tools/testing/selftests/bpf/prog_tests/section_names.c @@ -113,6 +113,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_BIND}, {0, BPF_CGROUP_INET6_BIND}, }, + { + "cgroup/bindun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_BIND}, + {0, BPF_CGROUP_UNIX_BIND}, + }, { "cgroup/connect4", {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_CONNECT}, @@ -123,6 +128,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_CONNECT}, {0, BPF_CGROUP_INET6_CONNECT}, }, + { + "cgroup/connectun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_CONNECT}, + {0, BPF_CGROUP_UNIX_CONNECT}, + }, { "cgroup/sendmsg4", {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UDP4_SENDMSG}, @@ -133,6 +143,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UDP6_SENDMSG}, {0, BPF_CGROUP_UDP6_SENDMSG}, }, + { + "cgroup/sendmsgun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_SENDMSG}, + {0, BPF_CGROUP_UNIX_SENDMSG}, + }, { "cgroup/recvmsg4", {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UDP4_RECVMSG}, @@ -143,6 +158,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UDP6_RECVMSG}, {0, BPF_CGROUP_UDP6_RECVMSG}, }, + { + "cgroup/recvmsgun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_RECVMSG}, + {0, BPF_CGROUP_UNIX_RECVMSG}, + }, { "cgroup/sysctl", {0, BPF_PROG_TYPE_CGROUP_SYSCTL, BPF_CGROUP_SYSCTL}, @@ -168,6 +188,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETPEERNAME}, {0, BPF_CGROUP_INET6_GETPEERNAME}, }, + { + "cgroup/getpeernameun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_GETPEERNAME}, + {0, BPF_CGROUP_UNIX_GETPEERNAME}, + }, { "cgroup/getsockname4", {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET4_GETSOCKNAME}, @@ -178,6 +203,11 @@ static struct sec_name_test tests[] = { {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_INET6_GETSOCKNAME}, {0, BPF_CGROUP_INET6_GETSOCKNAME}, }, + { + "cgroup/getsocknameun", + {0, BPF_PROG_TYPE_CGROUP_SOCK_ADDR, BPF_CGROUP_UNIX_GETSOCKNAME}, + {0, BPF_CGROUP_UNIX_GETSOCKNAME}, + }, }; static void test_prog_type_by_name(const struct sec_name_test *test) diff --git a/tools/testing/selftests/bpf/progs/bindun_prog.c b/tools/testing/selftests/bpf/progs/bindun_prog.c new file mode 100644 index 000000000000..60addb5a9c96 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/bindun_prog.c @@ -0,0 +1,59 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */ + +#include "vmlinux.h" + +#include +#include +#include +#include "bpf_kfuncs.h" + +#ifndef AF_UNIX +#define AF_UNIX 1 +#endif + +#define DST_REWRITE_PATH "\0bpf_cgroup_unix_test_rewrite" + +void *bpf_cast_to_kern_ctx(void *) __ksym; + +SEC("cgroup/bindun") +int bind_un_prog(struct bpf_sock_addr *ctx) +{ + struct bpf_sock *sk = ctx->sk; + struct bpf_sock_addr_kern *sa_kern = bpf_cast_to_kern_ctx(ctx); + struct sockaddr_un *sa_kern_unaddr; + struct sockaddr_un unaddr = { + .sun_family = AF_UNIX, + }; + __u32 unaddrlen = offsetof(struct sockaddr_un, sun_path) + + sizeof(DST_REWRITE_PATH) - 1; + int ret; + + if (!sk) + return 0; + + if (sk->family != AF_UNIX) + return 0; + + if (ctx->type != SOCK_STREAM && ctx->type != SOCK_DGRAM) + return 0; + + memcpy(unaddr.sun_path, DST_REWRITE_PATH, sizeof(DST_REWRITE_PATH) - 1); + + ret = bpf_sock_addr_set(sa_kern, (struct sockaddr *) &unaddr, unaddrlen); + if (ret) + return 0; + + if (sa_kern->uaddrlen != unaddrlen) + return 0; + + sa_kern_unaddr = bpf_rdonly_cast(sa_kern->uaddr, + bpf_core_type_id_kernel(struct sockaddr_un)); + if (memcmp(sa_kern_unaddr->sun_path, DST_REWRITE_PATH, + sizeof(DST_REWRITE_PATH) - 1) != 0) + return 0; + + return 1; +} + +char _license[] SEC("license") = "GPL"; diff --git a/tools/testing/selftests/bpf/progs/connectun_prog.c b/tools/testing/selftests/bpf/progs/connectun_prog.c new file mode 100644 index 000000000000..ac7209bd326f --- /dev/null +++ b/tools/testing/selftests/bpf/progs/connectun_prog.c @@ -0,0 +1,53 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */ + +#include "vmlinux.h" + +#include +#include +#include +#include "bpf_kfuncs.h" + +#ifndef AF_UNIX +#define AF_UNIX 1 +#endif + +#define DST_REWRITE_PATH "\0bpf_cgroup_unix_test_rewrite" + +void *bpf_cast_to_kern_ctx(void *) __ksym; + +SEC("cgroup/connectun") +int connect_un_prog(struct bpf_sock_addr *ctx) +{ + struct bpf_sock_addr_kern *sa_kern = bpf_cast_to_kern_ctx(ctx); + struct sockaddr_un *sa_kern_unaddr; + struct sockaddr_un unaddr = { + .sun_family = AF_UNIX, + }; + __u32 unaddrlen = offsetof(struct sockaddr_un, sun_path) + + sizeof(DST_REWRITE_PATH) - 1; + int ret; + + if (ctx->type != SOCK_STREAM && ctx->type != SOCK_DGRAM) + return 0; + + memcpy(unaddr.sun_path, DST_REWRITE_PATH, sizeof(DST_REWRITE_PATH) - 1); + + /* Rewrite destination. */ + ret = bpf_sock_addr_set(sa_kern, (struct sockaddr *) &unaddr, unaddrlen); + if (ret) + return 0; + + if (sa_kern->uaddrlen != unaddrlen) + return 0; + + sa_kern_unaddr = bpf_rdonly_cast(sa_kern->uaddr, + bpf_core_type_id_kernel(struct sockaddr_un)); + if (memcmp(sa_kern_unaddr->sun_path, DST_REWRITE_PATH, + sizeof(DST_REWRITE_PATH) - 1) != 0) + return 0; + + return 1; +} + +char _license[] SEC("license") = "GPL"; diff --git a/tools/testing/selftests/bpf/progs/recvmsgun_prog.c b/tools/testing/selftests/bpf/progs/recvmsgun_prog.c new file mode 100644 index 000000000000..4567aad723ee --- /dev/null +++ b/tools/testing/selftests/bpf/progs/recvmsgun_prog.c @@ -0,0 +1,59 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */ + +#include "vmlinux.h" + +#include +#include +#include +#include "bpf_kfuncs.h" + +#ifndef AF_UNIX +#define AF_UNIX 1 +#endif + +#define SERVUN_PATH "\0bpf_cgroup_unix_test" + +void *bpf_cast_to_kern_ctx(void *) __ksym; + +SEC("cgroup/recvmsgun") +int recvmsgun_prog(struct bpf_sock_addr *ctx) +{ + struct bpf_sock *sk = ctx->sk; + struct bpf_sock_addr_kern *sa_kern = bpf_cast_to_kern_ctx(ctx); + struct sockaddr_un *sa_kern_unaddr; + struct sockaddr_un unaddr = { + .sun_family = AF_UNIX, + }; + __u32 unaddrlen = offsetof(struct sockaddr_un, sun_path) + + sizeof(SERVUN_PATH) - 1; + int ret; + + if (!sk) + return 1; + + if (sk->family != AF_UNIX) + return 1; + + if (ctx->type != SOCK_STREAM && ctx->type != SOCK_DGRAM) + return 1; + + memcpy(unaddr.sun_path, SERVUN_PATH, sizeof(SERVUN_PATH) - 1); + + ret = bpf_sock_addr_set(sa_kern, (struct sockaddr *) &unaddr, unaddrlen); + if (ret) + return 1; + + if (sa_kern->uaddrlen != unaddrlen) + return 1; + + sa_kern_unaddr = bpf_rdonly_cast(sa_kern->uaddr, + bpf_core_type_id_kernel(struct sockaddr_un)); + if (memcmp(sa_kern_unaddr->sun_path, SERVUN_PATH, + sizeof(SERVUN_PATH) - 1) != 0) + return 1; + + return 1; +} + +char _license[] SEC("license") = "GPL"; diff --git a/tools/testing/selftests/bpf/progs/sendmsgun_prog.c b/tools/testing/selftests/bpf/progs/sendmsgun_prog.c new file mode 100644 index 000000000000..3e4fe0859421 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/sendmsgun_prog.c @@ -0,0 +1,53 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */ + +#include "vmlinux.h" + +#include +#include +#include +#include "bpf_kfuncs.h" + +#ifndef AF_UNIX +#define AF_UNIX 1 +#endif + +#define DST_REWRITE_PATH "\0bpf_cgroup_unix_test_rewrite" + +void *bpf_cast_to_kern_ctx(void *) __ksym; + +SEC("cgroup/sendmsgun") +int sendmsg_un_prog(struct bpf_sock_addr *ctx) +{ + struct bpf_sock_addr_kern *sa_kern = bpf_cast_to_kern_ctx(ctx); + struct sockaddr_un *sa_kern_unaddr; + struct sockaddr_un unaddr = { + .sun_family = AF_UNIX, + }; + __u32 unaddrlen = offsetof(struct sockaddr_un, sun_path) + + sizeof(DST_REWRITE_PATH) - 1; + int ret; + + if (ctx->type != SOCK_DGRAM) + return 0; + + memcpy(unaddr.sun_path, DST_REWRITE_PATH, sizeof(DST_REWRITE_PATH) - 1); + + /* Rewrite destination. */ + ret = bpf_sock_addr_set(sa_kern, (struct sockaddr *) &unaddr, unaddrlen); + if (ret) + return 0; + + if (sa_kern->uaddrlen != unaddrlen) + return 0; + + sa_kern_unaddr = bpf_rdonly_cast(sa_kern->uaddr, + bpf_core_type_id_kernel(struct sockaddr_un)); + if (memcmp(sa_kern_unaddr->sun_path, DST_REWRITE_PATH, + sizeof(DST_REWRITE_PATH) - 1) != 0) + return 0; + + return 1; +} + +char _license[] SEC("license") = "GPL"; diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c index 6a618c8f477c..c96322bcc6c8 100644 --- a/tools/testing/selftests/bpf/test_sock_addr.c +++ b/tools/testing/selftests/bpf/test_sock_addr.c @@ -12,6 +12,7 @@ #include #include #include +#include #include @@ -28,12 +29,16 @@ #define CG_PATH "/foo" #define CONNECT4_PROG_PATH "./connect4_prog.bpf.o" #define CONNECT6_PROG_PATH "./connect6_prog.bpf.o" +#define CONNECTUN_PROG_PATH "./connectun_prog.bpf.o" #define SENDMSG4_PROG_PATH "./sendmsg4_prog.bpf.o" #define SENDMSG6_PROG_PATH "./sendmsg6_prog.bpf.o" +#define SENDMSGUN_PROG_PATH "./sendmsgun_prog.bpf.o" #define RECVMSG4_PROG_PATH "./recvmsg4_prog.bpf.o" #define RECVMSG6_PROG_PATH "./recvmsg6_prog.bpf.o" +#define RECVMSGUN_PROG_PATH "./recvmsgun_prog.bpf.o" #define BIND4_PROG_PATH "./bind4_prog.bpf.o" #define BIND6_PROG_PATH "./bind6_prog.bpf.o" +#define BINDUN_PROG_PATH "./bindun_prog.bpf.o" #define SERV4_IP "192.168.1.254" #define SERV4_REWRITE_IP "127.0.0.1" @@ -51,6 +56,9 @@ #define SERV6_PORT 6060 #define SERV6_REWRITE_PORT 6666 +#define SERVUN_ADDRESS "bpf_cgroup_unix_test" +#define SERVUN_REWRITE_ADDRESS "bpf_cgroup_unix_test_rewrite" + #define INET_NTOP_BUF 40 struct sock_addr_test; @@ -88,8 +96,10 @@ struct sock_addr_test { static int bind4_prog_load(const struct sock_addr_test *test); static int bind6_prog_load(const struct sock_addr_test *test); +static int bindun_prog_load(const struct sock_addr_test *test); static int connect4_prog_load(const struct sock_addr_test *test); static int connect6_prog_load(const struct sock_addr_test *test); +static int connectun_prog_load(const struct sock_addr_test *test); static int sendmsg_allow_prog_load(const struct sock_addr_test *test); static int sendmsg_deny_prog_load(const struct sock_addr_test *test); static int recvmsg_allow_prog_load(const struct sock_addr_test *test); @@ -102,6 +112,8 @@ static int recvmsg6_rw_c_prog_load(const struct sock_addr_test *test); static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test); static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test); static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test); +static int sendmsgun_prog_load(const struct sock_addr_test *test); +static int recvmsgun_prog_load(const struct sock_addr_test *test); static struct sock_addr_test tests[] = { /* bind */ @@ -217,6 +229,20 @@ static struct sock_addr_test tests[] = { NULL, SUCCESS, }, + { + "bindun: rewrite path", + bindun_prog_load, + BPF_CGROUP_UNIX_BIND, + BPF_CGROUP_UNIX_BIND, + AF_UNIX, + SOCK_STREAM, + SERVUN_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + SUCCESS, + }, /* connect */ { @@ -331,6 +357,34 @@ static struct sock_addr_test tests[] = { SRC6_REWRITE_IP, SUCCESS, }, + { + "connectun: rewrite SOCK_STREAM path", + connectun_prog_load, + BPF_CGROUP_UNIX_CONNECT, + BPF_CGROUP_UNIX_CONNECT, + AF_UNIX, + SOCK_STREAM, + SERVUN_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + SUCCESS, + }, + { + "connectun: rewrite SOCK_DGRAM path", + connectun_prog_load, + BPF_CGROUP_UNIX_CONNECT, + BPF_CGROUP_UNIX_CONNECT, + AF_UNIX, + SOCK_DGRAM, + SERVUN_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + SUCCESS, + }, /* sendmsg */ { @@ -515,6 +569,20 @@ static struct sock_addr_test tests[] = { SRC6_REWRITE_IP, SYSCALL_EPERM, }, + { + "sendmsgun: rewrite SOCK_DGRAM path", + sendmsgun_prog_load, + BPF_CGROUP_UNIX_SENDMSG, + BPF_CGROUP_UNIX_SENDMSG, + AF_UNIX, + SOCK_DGRAM, + SERVUN_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + SUCCESS, + }, /* recvmsg */ { @@ -601,6 +669,20 @@ static struct sock_addr_test tests[] = { SERV6_IP, SUCCESS, }, + { + "recvmsgun: rewrite SOCK_DGRAM path", + recvmsgun_prog_load, + BPF_CGROUP_UNIX_RECVMSG, + BPF_CGROUP_UNIX_RECVMSG, + AF_UNIX, + SOCK_DGRAM, + SERVUN_REWRITE_ADDRESS, + 0, + SERVUN_REWRITE_ADDRESS, + 0, + NULL, + SUCCESS, + }, }; static int mk_sockaddr(int domain, const char *ip, unsigned short port, @@ -608,8 +690,9 @@ static int mk_sockaddr(int domain, const char *ip, unsigned short port, { struct sockaddr_in6 *addr6; struct sockaddr_in *addr4; + struct sockaddr_un *addrun; - if (domain != AF_INET && domain != AF_INET6) { + if (domain != AF_INET && domain != AF_INET6 && domain != AF_UNIX) { log_err("Unsupported address family"); return -1; } @@ -638,6 +721,15 @@ static int mk_sockaddr(int domain, const char *ip, unsigned short port, return -1; } *addr_len = sizeof(struct sockaddr_in6); + } else if (domain == AF_UNIX) { + if (*addr_len < sizeof(struct sockaddr_un)) + return -1; + addrun = (struct sockaddr_un *)addr; + addrun->sun_family = domain; + addrun->sun_path[0] = 0; + strcpy(addrun->sun_path + 1, ip); + *addr_len = offsetof(struct sockaddr_un, sun_path) + 1 + + strlen(ip); } return 0; @@ -706,6 +798,11 @@ static int bind6_prog_load(const struct sock_addr_test *test) return load_path(test, BIND6_PROG_PATH); } +static int bindun_prog_load(const struct sock_addr_test *test) +{ + return load_path(test, BINDUN_PROG_PATH); +} + static int connect4_prog_load(const struct sock_addr_test *test) { return load_path(test, CONNECT4_PROG_PATH); @@ -716,6 +813,11 @@ static int connect6_prog_load(const struct sock_addr_test *test) return load_path(test, CONNECT6_PROG_PATH); } +static int connectun_prog_load(const struct sock_addr_test *test) +{ + return load_path(test, CONNECTUN_PROG_PATH); +} + static int xmsg_ret_only_prog_load(const struct sock_addr_test *test, int32_t rc) { @@ -889,12 +991,23 @@ static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test) return load_path(test, SENDMSG6_PROG_PATH); } +static int sendmsgun_prog_load(const struct sock_addr_test *test) +{ + return load_path(test, SENDMSGUN_PROG_PATH); +} + +static int recvmsgun_prog_load(const struct sock_addr_test *test) +{ + return load_path(test, RECVMSGUN_PROG_PATH); +} + static int cmp_addr(const struct sockaddr_storage *addr1, socklen_t addr1_len, const struct sockaddr_storage *addr2, socklen_t addr2_len, int cmp_port) { const struct sockaddr_in *four1, *four2; const struct sockaddr_in6 *six1, *six2; + const struct sockaddr_un *un1, *un2; if (addr1->ss_family != addr2->ss_family) return -1; @@ -913,6 +1026,10 @@ static int cmp_addr(const struct sockaddr_storage *addr1, socklen_t addr1_len, return !((six1->sin6_port == six2->sin6_port || !cmp_port) && !memcmp(&six1->sin6_addr, &six2->sin6_addr, sizeof(struct in6_addr))); + } else if (addr1->ss_family == AF_UNIX) { + un1 = (const struct sockaddr_un *)addr1; + un2 = (const struct sockaddr_un *)addr2; + return memcmp(un1, un2, addr1_len); } return -1; @@ -992,7 +1109,7 @@ static int connect_to_server(int type, const struct sockaddr_storage *addr, domain = addr->ss_family; - if (domain != AF_INET && domain != AF_INET6) { + if (domain != AF_INET && domain != AF_INET6 && domain != AF_UNIX) { log_err("Unsupported address family"); goto err; } @@ -1066,7 +1183,7 @@ static int sendmsg_to_server(int type, const struct sockaddr_storage *addr, domain = addr->ss_family; - if (domain != AF_INET && domain != AF_INET6) { + if (domain != AF_INET && domain != AF_INET6 && domain != AF_UNIX) { log_err("Unsupported address family"); goto err; } @@ -1095,7 +1212,7 @@ static int sendmsg_to_server(int type, const struct sockaddr_storage *addr, hdr.msg_control = &control6; hdr.msg_controllen = sizeof(control6.buf); } - if (init_pktinfo(domain, CMSG_FIRSTHDR(&hdr))) { + if (domain != AF_UNIX && init_pktinfo(domain, CMSG_FIRSTHDR(&hdr))) { log_err("Fail to init pktinfo"); goto err; } @@ -1257,10 +1374,11 @@ static int run_connect_test_case(const struct sock_addr_test *test) if (cmp_peer_addr(clientfd, &expected_addr, expected_addr_len)) goto err; - if (cmp_local_ip(clientfd, &expected_src_addr, expected_src_addr_len)) + if (test->domain != AF_UNIX && + cmp_local_ip(clientfd, &expected_src_addr, expected_src_addr_len)) goto err; - if (test->type == SOCK_STREAM) { + if (test->domain != AF_UNIX && test->type == SOCK_STREAM) { /* Test TCP Fast Open scenario */ clientfd = fastconnect_to_server(&requested_addr, addr_len); if (clientfd == -1) @@ -1339,7 +1457,8 @@ static int run_xmsg_test_case(const struct sock_addr_test *test, int max_cmsg) &recvmsg_addr_len) == -1) goto err; - if (cmp_addr(&recvmsg_addr, recvmsg_addr_len, &expected_addr, + if (test->domain != AF_UNIX && + cmp_addr(&recvmsg_addr, recvmsg_addr_len, &expected_addr, expected_addr_len, /*cmp_port*/ 0)) goto err; @@ -1382,18 +1501,22 @@ static int run_test_case(int cgfd, const struct sock_addr_test *test) switch (test->attach_type) { case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: + case BPF_CGROUP_UNIX_BIND: err = run_bind_test_case(test); break; case BPF_CGROUP_INET4_CONNECT: case BPF_CGROUP_INET6_CONNECT: + case BPF_CGROUP_UNIX_CONNECT: err = run_connect_test_case(test); break; case BPF_CGROUP_UDP4_SENDMSG: case BPF_CGROUP_UDP6_SENDMSG: + case BPF_CGROUP_UNIX_SENDMSG: err = run_xmsg_test_case(test, 1); break; case BPF_CGROUP_UDP4_RECVMSG: case BPF_CGROUP_UDP6_RECVMSG: + case BPF_CGROUP_UNIX_RECVMSG: err = run_xmsg_test_case(test, 0); break; default: From patchwork Fri Apr 21 16:27:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daan De Meyer X-Patchwork-Id: 13220337 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 53AADC77B76 for ; Fri, 21 Apr 2023 16:31:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232978AbjDUQbh (ORCPT ); Fri, 21 Apr 2023 12:31:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44968 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232958AbjDUQbe (ORCPT ); Fri, 21 Apr 2023 12:31:34 -0400 Received: from mail-ej1-x630.google.com (mail-ej1-x630.google.com [IPv6:2a00:1450:4864:20::630]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7E38413F89 for ; Fri, 21 Apr 2023 09:31:30 -0700 (PDT) Received: by mail-ej1-x630.google.com with SMTP id a640c23a62f3a-94a34a14a54so315269066b.1 for ; Fri, 21 Apr 2023 09:31:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682094688; x=1684686688; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/nCvZ81MQ8C4KsN+w+vU2lanYJxjKn5TCB3KHbYXOxs=; b=hGLjT8S+vZ5GPA6gYuxCtOtR7BNDlqTHhcYCPlEOy/us7PpKAfL+SaoR7vrE+OwCd+ lyOAu8kQ8Fxb+u47hvJRi3k5mstrjIb7RIRAcB1VbaW6jXyTB8umC10rSiscoYEF6yJb PVcuS+BN7iyMVFMiDQ83Z1ghRiAx05/t7Y3UkZQvVJUmWNCGheA7AjjdmTOlNb18qgk4 8Gz/nBBszbBs2q4ZMX0f1B0azCmt4nSWtgW28LglMYXW0ggA5e6ZWCzeHWdigsos6bgv fKAE7SpE/188xijsJw9rrPcKOscIqlHmMi4iwUzp7OvA5jwFJn/mC9wjdcVBLMBfr4qs HdWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682094688; x=1684686688; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/nCvZ81MQ8C4KsN+w+vU2lanYJxjKn5TCB3KHbYXOxs=; b=LKL1dkB7BqYuwHrNZuEnAZXrHivX4MZgAuzykWoOPa0CP23hWgWd/5lSEb999tpR6G EfaU3L44Og86hNPjBt6i4j67ccDc7htvfaY1lmjRBCrNN496LePJFVSrIgU+7zAz2VXU rdpzQ7iTyBjwcVNpND5p7RQ/eJyEqbCR+/kke2xjmlRw6yG/RxVjsILsXoOwRjZo2u86 fBOGV3Thtud3JYmPbVHCpOLMXW9h+gtwfe+HNR/5oCNg6vo7OZK2MKkEC0TRRAamckRH KNUSvzXbT2qYIUxWKMeqmdoREEb2y5a3FmYf3RUrgonsWMiZqgHqBrSUSvKV9c1An6ox q3yw== X-Gm-Message-State: AAQBX9eWw/HQQdtERqazZLh9V0rvJc9qmqjAlyqEboNyEStyWeW/fJ7Z vDUIlReIrIqmy8OxqBvkJ/PzgVIWQZS69w== X-Google-Smtp-Source: AKy350b5akmogJd5oeOIQG3nEfYO7+jOgPblNBW7QbeJW8g13ktrLZIGQbajw8w+qd8Ge0BpDDvifg== X-Received: by 2002:a17:907:1c86:b0:94f:81c:725e with SMTP id nb6-20020a1709071c8600b0094f081c725emr3830871ejc.59.1682094688425; Fri, 21 Apr 2023 09:31:28 -0700 (PDT) Received: from localhost.localdomain ([2a02:a03f:864b:8201:e534:34f4:1c34:8de7]) by smtp.googlemail.com with ESMTPSA id k9-20020a170906970900b009534211cc97sm2248578ejx.159.2023.04.21.09.31.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Apr 2023 09:31:28 -0700 (PDT) From: Daan De Meyer To: bpf@vger.kernel.org Cc: Daan De Meyer , martin.lau@linux.dev, kernel-team@meta.com Subject: [PATCH bpf-next v3 10/10] documentation/bpf: Document cgroup unix socket address hooks Date: Fri, 21 Apr 2023 18:27:18 +0200 Message-Id: <20230421162718.440230-11-daan.j.demeyer@gmail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230421162718.440230-1-daan.j.demeyer@gmail.com> References: <20230421162718.440230-1-daan.j.demeyer@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net Update the documentation to mention the new cgroup unix sockaddr hooks. Signed-off-by: Daan De Meyer --- Documentation/bpf/libbpf/program_types.rst | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/Documentation/bpf/libbpf/program_types.rst b/Documentation/bpf/libbpf/program_types.rst index ad4d4d5eecb0..06168ad73d5e 100644 --- a/Documentation/bpf/libbpf/program_types.rst +++ b/Documentation/bpf/libbpf/program_types.rst @@ -56,6 +56,18 @@ described in more detail in the footnotes. | | ``BPF_CGROUP_UDP6_RECVMSG`` | ``cgroup/recvmsg6`` | | + +----------------------------------------+----------------------------------+-----------+ | | ``BPF_CGROUP_UDP6_SENDMSG`` | ``cgroup/sendmsg6`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_BIND`` | ``cgroup/bindun`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_CONNECT`` | ``cgroup/connectun`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_SENDMSG`` | ``cgroup/sendmsgun`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_RECVMSG`` | ``cgroup/recvmsgun`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_GETPEERNAME`` | ``cgroup/getpeernameun`` | | +| +----------------------------------------+----------------------------------+-----------+ +| | ``BPF_CGROUP_UNIX_GETSOCKNAME`` | ``cgroup/getsocknameun`` | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------+ | ``BPF_PROG_TYPE_CGROUP_SOCK`` | ``BPF_CGROUP_INET4_POST_BIND`` | ``cgroup/post_bind4`` | | + +----------------------------------------+----------------------------------+-----------+