* [PATCH bpf-next] bpf: enable bpf_{g,s}etsockopt in BPF_CGROUP_UDP{4,6}_SENDMSG
@ 2021-01-27 17:47 Stanislav Fomichev
2021-01-27 21:30 ` Daniel Borkmann
0 siblings, 1 reply; 3+ messages in thread
From: Stanislav Fomichev @ 2021-01-27 17:47 UTC (permalink / raw)
To: netdev, bpf; +Cc: ast, daniel, Stanislav Fomichev
Can be used to query/modify socket state for unconnected UDP sendmsg.
Those hooks run as BPF_CGROUP_RUN_SA_PROG_LOCK and operate on
a locked socket.
Signed-off-by: Stanislav Fomichev <sdf@google.com>
---
net/core/filter.c | 4 ++++
tools/testing/selftests/bpf/progs/sendmsg4_prog.c | 7 +++++++
tools/testing/selftests/bpf/progs/sendmsg6_prog.c | 7 +++++++
3 files changed, 18 insertions(+)
diff --git a/net/core/filter.c b/net/core/filter.c
index 9ab94e90d660..3d7f78a19565 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -7023,6 +7023,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
case BPF_CGROUP_INET6_BIND:
case BPF_CGROUP_INET4_CONNECT:
case BPF_CGROUP_INET6_CONNECT:
+ case BPF_CGROUP_UDP4_SENDMSG:
+ case BPF_CGROUP_UDP6_SENDMSG:
return &bpf_sock_addr_setsockopt_proto;
default:
return NULL;
@@ -7033,6 +7035,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
case BPF_CGROUP_INET6_BIND:
case BPF_CGROUP_INET4_CONNECT:
case BPF_CGROUP_INET6_CONNECT:
+ case BPF_CGROUP_UDP4_SENDMSG:
+ case BPF_CGROUP_UDP6_SENDMSG:
return &bpf_sock_addr_getsockopt_proto;
default:
return NULL;
diff --git a/tools/testing/selftests/bpf/progs/sendmsg4_prog.c b/tools/testing/selftests/bpf/progs/sendmsg4_prog.c
index 092d9da536f3..fcac40a05c3d 100644
--- a/tools/testing/selftests/bpf/progs/sendmsg4_prog.c
+++ b/tools/testing/selftests/bpf/progs/sendmsg4_prog.c
@@ -21,9 +21,16 @@ int _version SEC("version") = 1;
SEC("cgroup/sendmsg4")
int sendmsg_v4_prog(struct bpf_sock_addr *ctx)
{
+ int prio;
+
if (ctx->type != SOCK_DGRAM)
return 0;
+ if (bpf_getsockopt(ctx, SOL_SOCKET, SO_PRIORITY, &prio, sizeof(prio)))
+ return 0;
+ if (bpf_setsockopt(ctx, SOL_SOCKET, SO_PRIORITY, &prio, sizeof(prio)))
+ return 0;
+
/* Rewrite source. */
if (ctx->msg_src_ip4 == bpf_htonl(SRC1_IP4) ||
ctx->msg_src_ip4 == bpf_htonl(SRC2_IP4)) {
diff --git a/tools/testing/selftests/bpf/progs/sendmsg6_prog.c b/tools/testing/selftests/bpf/progs/sendmsg6_prog.c
index 255a432bc163..50b46961d08a 100644
--- a/tools/testing/selftests/bpf/progs/sendmsg6_prog.c
+++ b/tools/testing/selftests/bpf/progs/sendmsg6_prog.c
@@ -25,9 +25,16 @@ int _version SEC("version") = 1;
SEC("cgroup/sendmsg6")
int sendmsg_v6_prog(struct bpf_sock_addr *ctx)
{
+ int prio;
+
if (ctx->type != SOCK_DGRAM)
return 0;
+ if (bpf_getsockopt(ctx, SOL_SOCKET, SO_PRIORITY, &prio, sizeof(prio)))
+ return 0;
+ if (bpf_setsockopt(ctx, SOL_SOCKET, SO_PRIORITY, &prio, sizeof(prio)))
+ return 0;
+
/* Rewrite source. */
if (ctx->msg_src_ip6[3] == bpf_htonl(1) ||
ctx->msg_src_ip6[3] == bpf_htonl(0)) {
--
2.30.0.280.ga3ce27912f-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] bpf: enable bpf_{g,s}etsockopt in BPF_CGROUP_UDP{4,6}_SENDMSG
2021-01-27 17:47 [PATCH bpf-next] bpf: enable bpf_{g,s}etsockopt in BPF_CGROUP_UDP{4,6}_SENDMSG Stanislav Fomichev
@ 2021-01-27 21:30 ` Daniel Borkmann
2021-01-27 21:32 ` Stanislav Fomichev
0 siblings, 1 reply; 3+ messages in thread
From: Daniel Borkmann @ 2021-01-27 21:30 UTC (permalink / raw)
To: Stanislav Fomichev, netdev, bpf; +Cc: ast
On 1/27/21 6:47 PM, Stanislav Fomichev wrote:
> Can be used to query/modify socket state for unconnected UDP sendmsg.
> Those hooks run as BPF_CGROUP_RUN_SA_PROG_LOCK and operate on
> a locked socket.
>
> Signed-off-by: Stanislav Fomichev <sdf@google.com>
> ---
> net/core/filter.c | 4 ++++
> tools/testing/selftests/bpf/progs/sendmsg4_prog.c | 7 +++++++
> tools/testing/selftests/bpf/progs/sendmsg6_prog.c | 7 +++++++
> 3 files changed, 18 insertions(+)
>
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 9ab94e90d660..3d7f78a19565 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -7023,6 +7023,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
> case BPF_CGROUP_INET6_BIND:
> case BPF_CGROUP_INET4_CONNECT:
> case BPF_CGROUP_INET6_CONNECT:
> + case BPF_CGROUP_UDP4_SENDMSG:
> + case BPF_CGROUP_UDP6_SENDMSG:
> return &bpf_sock_addr_setsockopt_proto;
> default:
> return NULL;
> @@ -7033,6 +7035,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
> case BPF_CGROUP_INET6_BIND:
> case BPF_CGROUP_INET4_CONNECT:
> case BPF_CGROUP_INET6_CONNECT:
> + case BPF_CGROUP_UDP4_SENDMSG:
> + case BPF_CGROUP_UDP6_SENDMSG:
> return &bpf_sock_addr_getsockopt_proto;
Patch looks good, could we at this point also add all the others that run under
BPF_CGROUP_RUN_SA_PROG_LOCK while at it, that is v4/v6 flavors of recvmsg as well
as peername/sockname?
Thanks,
Daniel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] bpf: enable bpf_{g,s}etsockopt in BPF_CGROUP_UDP{4,6}_SENDMSG
2021-01-27 21:30 ` Daniel Borkmann
@ 2021-01-27 21:32 ` Stanislav Fomichev
0 siblings, 0 replies; 3+ messages in thread
From: Stanislav Fomichev @ 2021-01-27 21:32 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: Netdev, bpf, Alexei Starovoitov
On Wed, Jan 27, 2021 at 1:30 PM Daniel Borkmann <daniel@iogearbox.net> wrote:
>
> On 1/27/21 6:47 PM, Stanislav Fomichev wrote:
> > Can be used to query/modify socket state for unconnected UDP sendmsg.
> > Those hooks run as BPF_CGROUP_RUN_SA_PROG_LOCK and operate on
> > a locked socket.
> >
> > Signed-off-by: Stanislav Fomichev <sdf@google.com>
> > ---
> > net/core/filter.c | 4 ++++
> > tools/testing/selftests/bpf/progs/sendmsg4_prog.c | 7 +++++++
> > tools/testing/selftests/bpf/progs/sendmsg6_prog.c | 7 +++++++
> > 3 files changed, 18 insertions(+)
> >
> > diff --git a/net/core/filter.c b/net/core/filter.c
> > index 9ab94e90d660..3d7f78a19565 100644
> > --- a/net/core/filter.c
> > +++ b/net/core/filter.c
> > @@ -7023,6 +7023,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
> > case BPF_CGROUP_INET6_BIND:
> > case BPF_CGROUP_INET4_CONNECT:
> > case BPF_CGROUP_INET6_CONNECT:
> > + case BPF_CGROUP_UDP4_SENDMSG:
> > + case BPF_CGROUP_UDP6_SENDMSG:
> > return &bpf_sock_addr_setsockopt_proto;
> > default:
> > return NULL;
> > @@ -7033,6 +7035,8 @@ sock_addr_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
> > case BPF_CGROUP_INET6_BIND:
> > case BPF_CGROUP_INET4_CONNECT:
> > case BPF_CGROUP_INET6_CONNECT:
> > + case BPF_CGROUP_UDP4_SENDMSG:
> > + case BPF_CGROUP_UDP6_SENDMSG:
> > return &bpf_sock_addr_getsockopt_proto;
>
> Patch looks good, could we at this point also add all the others that run under
> BPF_CGROUP_RUN_SA_PROG_LOCK while at it, that is v4/v6 flavors of recvmsg as well
> as peername/sockname?
Sounds good, will resend with more hooks added.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-01-27 21:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-27 17:47 [PATCH bpf-next] bpf: enable bpf_{g,s}etsockopt in BPF_CGROUP_UDP{4,6}_SENDMSG Stanislav Fomichev
2021-01-27 21:30 ` Daniel Borkmann
2021-01-27 21:32 ` Stanislav Fomichev
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).