From mboxrd@z Thu Jan 1 00:00:00 1970 From: Martin KaFai Lau Subject: Re: [PATCH v2 bpf-next 1/5] bpf: Hooks for sys_sendmsg Date: Wed, 23 May 2018 09:02:10 -0700 Message-ID: <20180523160208.ak27o7alfa7tmzlg@kafai-mbp> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Cc: , , , , To: Andrey Ignatov Return-path: Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:54010 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750880AbeEWQCj (ORCPT ); Wed, 23 May 2018 12:02:39 -0400 Content-Disposition: inline In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: On Tue, May 22, 2018 at 04:40:02PM -0700, Andrey Ignatov wrote: > In addition to already existing BPF hooks for sys_bind and sys_connect, > the patch provides new hooks for sys_sendmsg. > > It leverages existing BPF program type `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` > that provides access to socket itlself (properties like family, type, > protocol) and user-passed `struct sockaddr *` so that BPF program can > override destination IP and port for system calls such as sendto(2) or > sendmsg(2) and/or assign source IP to the socket. > > The hooks are implemented as two new attach types: > `BPF_CGROUP_UDP4_SENDMSG` and `BPF_CGROUP_UDP6_SENDMSG` for UDPv4 and > UDPv6 correspondingly. > > UDPv4 and UDPv6 separate attach types for same reason as sys_bind and > sys_connect hooks, i.e. to prevent reading from / writing to e.g. > user_ip6 fields when user passes sockaddr_in since it'd be out-of-bound. > > The difference with already existing hooks is sys_sendmsg are > implemented only for unconnected UDP. > > For TCP it doesn't make sense to change user-provided `struct sockaddr *` > at sendto(2)/sendmsg(2) time since socket either was already connected > and has source/destination set or wasn't connected and call to > sendto(2)/sendmsg(2) would lead to ENOTCONN anyway. > > Connected UDP is already handled by sys_connect hooks that can override > source/destination at connect time and use fast-path later, i.e. these > hooks don't affect UDP fast-path. > > Rewriting source IP is implemented differently than that in sys_connect > hooks. When sys_sendmsg is used with unconnected UDP it doesn't work to > just bind socket to desired local IP address since source IP can be set > on per-packet basis by using ancillary data (cmsg(3)). So no matter if > socket is bound or not, source IP has to be rewritten on every call to > sys_sendmsg. > > To do so two new fields are added to UAPI `struct bpf_sock_addr`; > * `msg_src_ip4` to set source IPv4 for UDPv4; > * `msg_src_ip6` to set source IPv6 for UDPv6. > > Signed-off-by: Andrey Ignatov > Acked-by: Alexei Starovoitov Acked-by: Martin KaFai Lau