[PATCH bpf-next] bpf: enable bpf_{g,s}etsockopt in BPF_CGROUP_UDP{4,6}_SENDMSG

Subsystems: bpf [general] (safe dynamic programs and tools), bpf [networking] (tcx & tc bpf, sock_addr), bpf [selftests] (test runners & infrastructure), kernel selftest framework, networking [general], the rest

STALE2021d

3 messages, 2 authors, 2021-01-27 · open the first message on its own page

[PATCH bpf-next] bpf: enable bpf_{g,s}etsockopt in BPF_CGROUP_UDP{4,6}_SENDMSG

From: Stanislav Fomichev <hidden>
Date: 2021-01-27 17:49:28

Can be used to query/modify socket state for unconnected UDP sendmsg.
Those hooks run as BPF_CGROUP_RUN_SA_PROG_LOCK and operate on
a locked socket.

Signed-off-by: Stanislav Fomichev <redacted>
---
 net/core/filter.c                                 | 4 ++++
 tools/testing/selftests/bpf/progs/sendmsg4_prog.c | 7 +++++++
 tools/testing/selftests/bpf/progs/sendmsg6_prog.c | 7 +++++++
 3 files changed, 18 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 9ab94e90d660..3d7f78a19565 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c

@@ -7023,6 +7023,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 		case BPF_CGROUP_INET6_BIND:
 		case BPF_CGROUP_INET4_CONNECT:
 		case BPF_CGROUP_INET6_CONNECT:
+		case BPF_CGROUP_UDP4_SENDMSG:
+		case BPF_CGROUP_UDP6_SENDMSG:
 			return &bpf_sock_addr_setsockopt_proto;
 		default:
 			return NULL;

@@ -7033,6 +7035,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 		case BPF_CGROUP_INET6_BIND:
 		case BPF_CGROUP_INET4_CONNECT:
 		case BPF_CGROUP_INET6_CONNECT:
+		case BPF_CGROUP_UDP4_SENDMSG:
+		case BPF_CGROUP_UDP6_SENDMSG:
 			return &bpf_sock_addr_getsockopt_proto;
 		default:
 			return NULL;

diff --git a/tools/testing/selftests/bpf/progs/sendmsg4_prog.c b/tools/testing/selftests/bpf/progs/sendmsg4_prog.c
index 092d9da536f3..fcac40a05c3d 100644
--- a/tools/testing/selftests/bpf/progs/sendmsg4_prog.c
+++ b/tools/testing/selftests/bpf/progs/sendmsg4_prog.c

@@ -21,9 +21,16 @@ int _version SEC("version") = 1;
 SEC("cgroup/sendmsg4")
 int sendmsg_v4_prog(struct bpf_sock_addr *ctx)
 {
+	int prio;
+
 	if (ctx->type != SOCK_DGRAM)
 		return 0;
 
+	if (bpf_getsockopt(ctx, SOL_SOCKET, SO_PRIORITY, &prio, sizeof(prio)))
+		return 0;
+	if (bpf_setsockopt(ctx, SOL_SOCKET, SO_PRIORITY, &prio, sizeof(prio)))
+		return 0;
+
 	/* Rewrite source. */
 	if (ctx->msg_src_ip4 == bpf_htonl(SRC1_IP4) ||
 	    ctx->msg_src_ip4 == bpf_htonl(SRC2_IP4)) {

diff --git a/tools/testing/selftests/bpf/progs/sendmsg6_prog.c b/tools/testing/selftests/bpf/progs/sendmsg6_prog.c
index 255a432bc163..50b46961d08a 100644
--- a/tools/testing/selftests/bpf/progs/sendmsg6_prog.c
+++ b/tools/testing/selftests/bpf/progs/sendmsg6_prog.c

@@ -25,9 +25,16 @@ int _version SEC("version") = 1;
 SEC("cgroup/sendmsg6")
 int sendmsg_v6_prog(struct bpf_sock_addr *ctx)
 {
+	int prio;
+
 	if (ctx->type != SOCK_DGRAM)
 		return 0;
 
+	if (bpf_getsockopt(ctx, SOL_SOCKET, SO_PRIORITY, &prio, sizeof(prio)))
+		return 0;
+	if (bpf_setsockopt(ctx, SOL_SOCKET, SO_PRIORITY, &prio, sizeof(prio)))
+		return 0;
+
 	/* Rewrite source. */
 	if (ctx->msg_src_ip6[3] == bpf_htonl(1) ||
 	    ctx->msg_src_ip6[3] == bpf_htonl(0)) {

-- 
2.30.0.280.ga3ce27912f-goog

Re: [PATCH bpf-next] bpf: enable bpf_{g,s}etsockopt in BPF_CGROUP_UDP{4,6}_SENDMSG

From: Stanislav Fomichev <hidden>
Date: 2021-01-27 21:43:01

On Wed, Jan 27, 2021 at 1:30 PM Daniel Borkmann [off-list ref] wrote:

On 1/27/21 6:47 PM, Stanislav Fomichev wrote:

quoted

Can be used to query/modify socket state for unconnected UDP sendmsg.
Those hooks run as BPF_CGROUP_RUN_SA_PROG_LOCK and operate on
a locked socket.

Signed-off-by: Stanislav Fomichev <redacted>
---
  net/core/filter.c                                 | 4 ++++
  tools/testing/selftests/bpf/progs/sendmsg4_prog.c | 7 +++++++
  tools/testing/selftests/bpf/progs/sendmsg6_prog.c | 7 +++++++
  3 files changed, 18 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 9ab94e90d660..3d7f78a19565 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c

@@ -7023,6 +7023,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
              case BPF_CGROUP_INET6_BIND:
              case BPF_CGROUP_INET4_CONNECT:
              case BPF_CGROUP_INET6_CONNECT:
+             case BPF_CGROUP_UDP4_SENDMSG:
+             case BPF_CGROUP_UDP6_SENDMSG:
                      return &bpf_sock_addr_setsockopt_proto;
              default:
                      return NULL;

@@ -7033,6 +7035,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
              case BPF_CGROUP_INET6_BIND:
              case BPF_CGROUP_INET4_CONNECT:
              case BPF_CGROUP_INET6_CONNECT:
+             case BPF_CGROUP_UDP4_SENDMSG:
+             case BPF_CGROUP_UDP6_SENDMSG:
                      return &bpf_sock_addr_getsockopt_proto;

Patch looks good, could we at this point also add all the others that run under
BPF_CGROUP_RUN_SA_PROG_LOCK while at it, that is v4/v6 flavors of recvmsg as well
as peername/sockname?

Sounds good, will resend with more hooks added.

Re: [PATCH bpf-next] bpf: enable bpf_{g,s}etsockopt in BPF_CGROUP_UDP{4,6}_SENDMSG

From: Daniel Borkmann <daniel@iogearbox.net>
Date: 2021-01-27 21:46:06

On 1/27/21 6:47 PM, Stanislav Fomichev wrote:

quoted hunk

Can be used to query/modify socket state for unconnected UDP sendmsg.
Those hooks run as BPF_CGROUP_RUN_SA_PROG_LOCK and operate on
a locked socket.

Signed-off-by: Stanislav Fomichev <redacted>
---
  net/core/filter.c                                 | 4 ++++
  tools/testing/selftests/bpf/progs/sendmsg4_prog.c | 7 +++++++
  tools/testing/selftests/bpf/progs/sendmsg6_prog.c | 7 +++++++
  3 files changed, 18 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 9ab94e90d660..3d7f78a19565 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c

@@ -7023,6 +7023,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
  		case BPF_CGROUP_INET6_BIND:
  		case BPF_CGROUP_INET4_CONNECT:
  		case BPF_CGROUP_INET6_CONNECT:
+		case BPF_CGROUP_UDP4_SENDMSG:
+		case BPF_CGROUP_UDP6_SENDMSG:
  			return &bpf_sock_addr_setsockopt_proto;
  		default:
  			return NULL;

@@ -7033,6 +7035,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
  		case BPF_CGROUP_INET6_BIND:
  		case BPF_CGROUP_INET4_CONNECT:
  		case BPF_CGROUP_INET6_CONNECT:
+		case BPF_CGROUP_UDP4_SENDMSG:
+		case BPF_CGROUP_UDP6_SENDMSG:
  			return &bpf_sock_addr_getsockopt_proto;

Patch looks good, could we at this point also add all the others that run under
BPF_CGROUP_RUN_SA_PROG_LOCK while at it, that is v4/v6 flavors of recvmsg as well
as peername/sockname?

Thanks,
Daniel

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help