From: Paul Moore <paul@paul-moore.com>
To: Geliang Tang <geliang.tang@suse.com>
Cc: Alexei Starovoitov <ast@kernel.org>,
bpf@vger.kernel.org, netdev@vger.kernel.org,
mptcp@lists.linux.dev, apparmor@lists.ubuntu.com,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org,
linux-kselftest@vger.kernel.org
Subject: Re: [RFC bpf-next v5] bpf: Force to MPTCP
Date: Tue, 18 Jul 2023 12:14:38 -0400 [thread overview]
Message-ID: <CAHC9VhS_LKdkEmm5_J5y34RpaRcTbg8==fpz8pMThDCjF6nYtQ@mail.gmail.com> (raw)
In-Reply-To: <3076188eb88cca9151a2d12b50ba1e870b11ce09.1689693294.git.geliang.tang@suse.com>
On Tue, Jul 18, 2023 at 11:21 AM Geliang Tang <geliang.tang@suse.com> wrote:
>
> As is described in the "How to use MPTCP?" section in MPTCP wiki [1]:
>
> "Your app can create sockets with IPPROTO_MPTCP as the proto:
> ( socket(AF_INET, SOCK_STREAM, IPPROTO_MPTCP); ). Legacy apps can be
> forced to create and use MPTCP sockets instead of TCP ones via the
> mptcpize command bundled with the mptcpd daemon."
>
> But the mptcpize (LD_PRELOAD technique) command has some limitations
> [2]:
>
> - it doesn't work if the application is not using libc (e.g. GoLang
> apps)
> - in some envs, it might not be easy to set env vars / change the way
> apps are launched, e.g. on Android
> - mptcpize needs to be launched with all apps that want MPTCP: we could
> have more control from BPF to enable MPTCP only for some apps or all the
> ones of a netns or a cgroup, etc.
> - it is not in BPF, we cannot talk about it at netdev conf.
>
> So this patchset attempts to use BPF to implement functions similer to
> mptcpize.
>
> The main idea is add a hook in sys_socket() to change the protocol id
> from IPPROTO_TCP (or 0) to IPPROTO_MPTCP.
>
> [1]
> https://github.com/multipath-tcp/mptcp_net-next/wiki
> [2]
> https://github.com/multipath-tcp/mptcp_net-next/issues/79
>
> v5:
> - add bpf_mptcpify helper.
>
> v4:
> - use lsm_cgroup/socket_create
>
> v3:
> - patch 8: char cmd[128]; -> char cmd[256];
>
> v2:
> - Fix build selftests errors reported by CI
>
> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/79
> Signed-off-by: Geliang Tang <geliang.tang@suse.com>
> ---
> include/linux/bpf.h | 1 +
> include/linux/lsm_hook_defs.h | 2 +-
> include/linux/security.h | 6 +-
> include/uapi/linux/bpf.h | 7 +
> kernel/bpf/bpf_lsm.c | 2 +
> net/mptcp/bpf.c | 20 +++
> net/socket.c | 4 +-
> security/apparmor/lsm.c | 8 +-
> security/security.c | 2 +-
> security/selinux/hooks.c | 6 +-
> tools/include/uapi/linux/bpf.h | 7 +
> .../testing/selftests/bpf/prog_tests/mptcp.c | 128 ++++++++++++++++--
> tools/testing/selftests/bpf/progs/mptcpify.c | 17 +++
> 13 files changed, 187 insertions(+), 23 deletions(-)
> create mode 100644 tools/testing/selftests/bpf/progs/mptcpify.c
...
> diff --git a/security/security.c b/security/security.c
> index b720424ca37d..bbebcddce420 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -4078,7 +4078,7 @@ EXPORT_SYMBOL(security_unix_may_send);
> *
> * Return: Returns 0 if permission is granted.
> */
> -int security_socket_create(int family, int type, int protocol, int kern)
> +int security_socket_create(int *family, int *type, int *protocol, int kern)
> {
> return call_int_hook(socket_create, 0, family, type, protocol, kern);
> }
Using the LSM to change the protocol family is not something we want
to allow. I'm sorry, but you will need to take a different approach.
--
paul-moore.com
next prev parent reply other threads:[~2023-07-18 16:14 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-18 15:21 [RFC bpf-next v5] bpf: Force to MPTCP Geliang Tang
2023-07-18 16:14 ` Paul Moore [this message]
2023-07-27 17:36 ` Matthieu Baerts
2023-07-27 18:01 ` Stanislav Fomichev
2023-07-28 15:15 ` Matthieu Baerts
2023-07-28 16:51 ` Stanislav Fomichev
2023-07-31 13:56 ` Matthieu Baerts
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHC9VhS_LKdkEmm5_J5y34RpaRcTbg8==fpz8pMThDCjF6nYtQ@mail.gmail.com' \
--to=paul@paul-moore.com \
--cc=apparmor@lists.ubuntu.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=geliang.tang@suse.com \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mptcp@lists.linux.dev \
--cc=netdev@vger.kernel.org \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).