Files
linux/include/linux
Stanislav Fomichev 0d01da6afc bpf: implement getsockopt and setsockopt hooks
Implement new BPF_PROG_TYPE_CGROUP_SOCKOPT program type and
BPF_CGROUP_{G,S}ETSOCKOPT cgroup hooks.

BPF_CGROUP_SETSOCKOPT can modify user setsockopt arguments before
passing them down to the kernel or bypass kernel completely.
BPF_CGROUP_GETSOCKOPT can can inspect/modify getsockopt arguments that
kernel returns.
Both hooks reuse existing PTR_TO_PACKET{,_END} infrastructure.

The buffer memory is pre-allocated (because I don't think there is
a precedent for working with __user memory from bpf). This might be
slow to do for each {s,g}etsockopt call, that's why I've added
__cgroup_bpf_prog_array_is_empty that exits early if there is nothing
attached to a cgroup. Note, however, that there is a race between
__cgroup_bpf_prog_array_is_empty and BPF_PROG_RUN_ARRAY where cgroup
program layout might have changed; this should not be a problem
because in general there is a race between multiple calls to
{s,g}etsocktop and user adding/removing bpf progs from a cgroup.

The return code of the BPF program is handled as follows:
* 0: EPERM
* 1: success, continue with next BPF program in the cgroup chain

v9:
* allow overwriting setsockopt arguments (Alexei Starovoitov):
  * use set_fs (same as kernel_setsockopt)
  * buffer is always kzalloc'd (no small on-stack buffer)

v8:
* use s32 for optlen (Andrii Nakryiko)

v7:
* return only 0 or 1 (Alexei Starovoitov)
* always run all progs (Alexei Starovoitov)
* use optval=0 as kernel bypass in setsockopt (Alexei Starovoitov)
  (decided to use optval=-1 instead, optval=0 might be a valid input)
* call getsockopt hook after kernel handlers (Alexei Starovoitov)

v6:
* rework cgroup chaining; stop as soon as bpf program returns
  0 or 2; see patch with the documentation for the details
* drop Andrii's and Martin's Acked-by (not sure they are comfortable
  with the new state of things)

v5:
* skip copy_to_user() and put_user() when ret == 0 (Martin Lau)

v4:
* don't export bpf_sk_fullsock helper (Martin Lau)
* size != sizeof(__u64) for uapi pointers (Martin Lau)
* offsetof instead of bpf_ctx_range when checking ctx access (Martin Lau)

v3:
* typos in BPF_PROG_CGROUP_SOCKOPT_RUN_ARRAY comments (Andrii Nakryiko)
* reverse christmas tree in BPF_PROG_CGROUP_SOCKOPT_RUN_ARRAY (Andrii
  Nakryiko)
* use __bpf_md_ptr instead of __u32 for optval{,_end} (Martin Lau)
* use BPF_FIELD_SIZEOF() for consistency (Martin Lau)
* new CG_SOCKOPT_ACCESS macro to wrap repeated parts

v2:
* moved bpf_sockopt_kern fields around to remove a hole (Martin Lau)
* aligned bpf_sockopt_kern->buf to 8 bytes (Martin Lau)
* bpf_prog_array_is_empty instead of bpf_prog_array_length (Martin Lau)
* added [0,2] return code check to verifier (Martin Lau)
* dropped unused buf[64] from the stack (Martin Lau)
* use PTR_TO_SOCKET for bpf_sockopt->sk (Martin Lau)
* dropped bpf_target_off from ctx rewrites (Martin Lau)
* use return code for kernel bypass (Martin Lau & Andrii Nakryiko)

Cc: Andrii Nakryiko <andriin@fb.com>
Cc: Martin Lau <kafai@fb.com>
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2019-06-27 15:25:16 -07:00
..
2018-10-16 11:13:50 +02:00
2018-11-12 10:33:49 +01:00
2019-05-31 11:13:10 +02:00
2019-05-14 19:52:50 -07:00
2018-11-07 13:44:59 -07:00
2018-11-07 13:44:59 -07:00
2019-04-09 17:05:46 -07:00
2019-05-07 08:39:02 -06:00
2019-05-09 15:25:13 -04:00
2018-08-22 10:52:48 -07:00
2018-11-13 21:55:24 +01:00
2019-02-28 03:28:53 -05:00
2019-02-28 08:24:23 -07:00
2018-12-19 10:42:08 +01:00
2019-04-22 09:48:12 -06:00
2019-02-15 16:54:38 +01:00
2018-11-07 13:42:32 -07:00
2019-03-22 14:36:02 +01:00
2019-05-01 07:47:37 -07:00
2018-11-19 19:03:46 -07:00
2019-04-08 22:56:14 +02:00
2018-11-30 13:29:04 +00:00
2019-03-07 18:32:03 -08:00
2019-01-30 20:51:47 -05:00
2018-10-17 13:56:58 -07:00
2019-02-20 07:22:17 -07:00
2019-02-20 07:22:10 -07:00
2018-12-06 15:45:46 +01:00
2019-02-08 15:02:49 -08:00
2019-03-05 21:07:19 -08:00
2019-05-14 09:47:51 -07:00
2018-10-21 10:46:39 -04:00
2018-10-26 16:26:35 -07:00
2019-05-07 14:31:03 +02:00
2018-10-08 22:53:10 +11:00
2019-03-12 10:04:03 -07:00
2019-05-14 19:52:51 -07:00
2019-05-14 19:52:48 -07:00
2018-07-20 01:11:45 +02:00
2019-04-02 17:57:35 +02:00
2019-05-08 22:14:36 +02:00
2018-09-25 20:17:35 -07:00
2019-05-31 12:37:46 -07:00
2019-05-16 15:51:55 -07:00
2019-03-15 15:29:47 -07:00
2019-02-07 16:38:35 +01:00
2018-09-29 22:47:49 -04:00
2019-06-14 20:18:27 -07:00
2018-10-11 09:16:44 -07:00
2019-02-07 00:13:27 +01:00
2018-12-10 10:17:45 +01:00
2019-04-06 10:48:35 -06:00
2019-01-11 18:05:40 -08:00
2018-09-11 14:11:51 +02:00
2019-05-15 17:35:54 +01:00
2019-04-09 15:14:49 -06:00
2018-12-22 12:15:29 +01:00