From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,USER_AGENT_GIT,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4AD9AC43387 for ; Fri, 18 Jan 2019 00:41:21 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id EF75B20873 for ; Fri, 18 Jan 2019 00:41:20 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Gy0cG4cs" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726517AbfARAlP (ORCPT ); Thu, 17 Jan 2019 19:41:15 -0500 Received: from mail-io1-f74.google.com ([209.85.166.74]:34630 "EHLO mail-io1-f74.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725982AbfARAlO (ORCPT ); Thu, 17 Jan 2019 19:41:14 -0500 Received: by mail-io1-f74.google.com with SMTP id q16so8880965ios.1 for ; Thu, 17 Jan 2019 16:41:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=mKuzY+RrONFNfr6GgEzOJRFN6u3Ye2Ipp5sfARH6pKE=; b=Gy0cG4csdchxzsy9bKZ0z7QIRvlCEZxBwCWwVbBc55lK7TIOlR9wuV0yGS9j3aZA2H tHx96oEYHTbyPK9Q/WkXIqlioce0k+aPiZvHa8WP1Eksj9oDG8hk3sM8g2PVVUj00lEf EaZvSO8OSZfhjfDxh7/Jw5onLX2hvuERf+E+JxY5y2PMWBzhk0U27UfqpPuXS3d5T4DF tCATo+jqppasbCpIQ7fu94LkA+jtOwjjAX6u3WyO/7MO/+ekaUCE2iGSgRj8SzN1geYd 5f6P3b1Qh7famG2C9LieltdJyo2G8jc40zJGdBW3g8QLa3NSYomrj61SkmyAeNJOmaRB eJZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=mKuzY+RrONFNfr6GgEzOJRFN6u3Ye2Ipp5sfARH6pKE=; b=NwYcBj5tEUwOaiMuFIage6xzF81RxXJlbBwWtwFSr4jrsWVG+SpMiLTX5+maanxsG/ n3Gm3Ie4aTJX8MSb+GyaNIqkubNl/O0Zd3wnIaN4/uWrMrUmc513AdBD517WDuqgxOBj bzmos80iU7Velo15itTDYC86QmgBk9uBUludBVX1ellEGMwQ93J65kjqKPQeL1Fm9yvk Z3okivC3GK5TcuiYmCW3tDY5QwtaV1NmghNZLpnenaA1GVBGlpTK1ud62Naa7Gvv/tqH BM0CN7H7o9tdDd1HBug+UomIk6BhAb7MnXM609cOBLVXwdsQJoheAjt2phpjynq8Bded LjfQ== X-Gm-Message-State: AJcUuketKsoqd2D3J4BBA5nQ+42qIYrW3WDGQNyqe3KFZLIrQZabBlK7 0qO8NV+OHhFM3vPuTiJ+m+UDmz6MczWb1ib+0ikXwxW8y4l13efnMHZrDP6tjzYgBQFS1nTwQS4 O6rWc24MEPZEohfixJOfERCJs2w8r8OlBUpWT2Hm+3NxNnh+mumU3tQ== X-Google-Smtp-Source: ALg8bN4U4N8zExsqpYkepqmLcQN8Ag3yjxK2hT9iJj49UyMb81jeb/hDUHwrtLPc0qQfkJBnRqF9T+I= X-Received: by 2002:a24:194e:: with SMTP id b75mr2643572itb.36.1547772073177; Thu, 17 Jan 2019 16:41:13 -0800 (PST) Date: Thu, 17 Jan 2019 16:41:02 -0800 In-Reply-To: <20190118004106.163825-1-sdf@google.com> Message-Id: <20190118004106.163825-2-sdf@google.com> Mime-Version: 1.0 References: <20190118004106.163825-1-sdf@google.com> X-Mailer: git-send-email 2.20.1.321.g9e740568ce-goog Subject: [PATCH bpf-next 1/5] bpf: add BPF_CGROUP_INET{4,6}_SOCK_RELEASE hooks From: Stanislav Fomichev To: netdev@vger.kernel.org Cc: davem@davemloft.net, ast@kernel.org, daniel@iogearbox.net, Stanislav Fomichev Content-Type: text/plain; charset="UTF-8" Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org These hooks mirror existing BPF_CGROUP_INET{4,6}_SOCK hooks (which trigger upon socket creation), but trigger when the socket is closed. Signed-off-by: Stanislav Fomichev --- include/linux/bpf-cgroup.h | 6 ++++++ include/net/inet_common.h | 1 + include/uapi/linux/bpf.h | 2 ++ kernel/bpf/syscall.c | 8 ++++++++ net/core/filter.c | 7 +++++++ net/ipv4/af_inet.c | 13 ++++++++++++- net/ipv6/af_inet6.c | 5 ++++- 7 files changed, 40 insertions(+), 2 deletions(-) diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h index 588dd5f0bd85..31fcfe215d80 100644 --- a/include/linux/bpf-cgroup.h +++ b/include/linux/bpf-cgroup.h @@ -176,6 +176,12 @@ int bpf_percpu_cgroup_storage_update(struct bpf_map *map, void *key, #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) \ BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET_SOCK_CREATE) +#define BPF_CGROUP_RUN_PROG_INET4_SOCK_RELEASE(sk) \ + BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_SOCK_RELEASE) + +#define BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE(sk) \ + BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET6_SOCK_RELEASE) + #define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) \ BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_POST_BIND) diff --git a/include/net/inet_common.h b/include/net/inet_common.h index 975901a95c0f..0e64046afe30 100644 --- a/include/net/inet_common.h +++ b/include/net/inet_common.h @@ -17,6 +17,7 @@ struct sockaddr; struct socket; int inet_release(struct socket *sock); +int __inet_release(struct socket *sock); int inet_stream_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags); int __inet_stream_connect(struct socket *sock, struct sockaddr *uaddr, diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 91c43884f295..8e78aa28a42e 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -186,6 +186,8 @@ enum bpf_attach_type { BPF_CGROUP_UDP6_SENDMSG, BPF_LIRC_MODE2, BPF_FLOW_DISSECTOR, + BPF_CGROUP_INET4_SOCK_RELEASE, + BPF_CGROUP_INET6_SOCK_RELEASE, __MAX_BPF_ATTACH_TYPE }; diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index b155cd17c1bd..6fa113448580 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1417,6 +1417,8 @@ bpf_prog_load_check_attach_type(enum bpf_prog_type prog_type, case BPF_PROG_TYPE_CGROUP_SOCK: switch (expected_attach_type) { case BPF_CGROUP_INET_SOCK_CREATE: + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: case BPF_CGROUP_INET4_POST_BIND: case BPF_CGROUP_INET6_POST_BIND: return 0; @@ -1709,6 +1711,8 @@ static int bpf_prog_attach(const union bpf_attr *attr) ptype = BPF_PROG_TYPE_CGROUP_SKB; break; case BPF_CGROUP_INET_SOCK_CREATE: + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: case BPF_CGROUP_INET4_POST_BIND: case BPF_CGROUP_INET6_POST_BIND: ptype = BPF_PROG_TYPE_CGROUP_SOCK; @@ -1791,6 +1795,8 @@ static int bpf_prog_detach(const union bpf_attr *attr) ptype = BPF_PROG_TYPE_CGROUP_SKB; break; case BPF_CGROUP_INET_SOCK_CREATE: + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: case BPF_CGROUP_INET4_POST_BIND: case BPF_CGROUP_INET6_POST_BIND: ptype = BPF_PROG_TYPE_CGROUP_SOCK; @@ -1841,6 +1847,8 @@ static int bpf_prog_query(const union bpf_attr *attr, case BPF_CGROUP_INET_INGRESS: case BPF_CGROUP_INET_EGRESS: case BPF_CGROUP_INET_SOCK_CREATE: + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: case BPF_CGROUP_INET4_POST_BIND: diff --git a/net/core/filter.c b/net/core/filter.c index 2b3b436ef545..b4da6793fdbc 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -5885,12 +5885,16 @@ static bool __sock_filter_check_attach_type(int off, switch (attach_type) { case BPF_CGROUP_INET_SOCK_CREATE: goto full_access; + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: + goto read_only; default: return false; } case bpf_ctx_range(struct bpf_sock, src_ip4): switch (attach_type) { case BPF_CGROUP_INET4_POST_BIND: + case BPF_CGROUP_INET4_SOCK_RELEASE: goto read_only; default: return false; @@ -5898,6 +5902,7 @@ static bool __sock_filter_check_attach_type(int off, case bpf_ctx_range_till(struct bpf_sock, src_ip6[0], src_ip6[3]): switch (attach_type) { case BPF_CGROUP_INET6_POST_BIND: + case BPF_CGROUP_INET6_SOCK_RELEASE: goto read_only; default: return false; @@ -5906,6 +5911,8 @@ static bool __sock_filter_check_attach_type(int off, switch (attach_type) { case BPF_CGROUP_INET4_POST_BIND: case BPF_CGROUP_INET6_POST_BIND: + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: goto read_only; default: return false; diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 0dfb72c46671..b703ad242365 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -403,7 +403,7 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, * function we are destroying the object and from then on nobody * should refer to it. */ -int inet_release(struct socket *sock) +int __inet_release(struct socket *sock) { struct sock *sk = sock->sk; @@ -429,6 +429,17 @@ int inet_release(struct socket *sock) } return 0; } +EXPORT_SYMBOL(__inet_release); + +int inet_release(struct socket *sock) +{ + struct sock *sk = sock->sk; + + if (sk && !sk->sk_kern_sock) + BPF_CGROUP_RUN_PROG_INET4_SOCK_RELEASE(sk); + + return __inet_release(sock); +} EXPORT_SYMBOL(inet_release); int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index d99753b5e39b..44c86595eba8 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -464,13 +464,16 @@ int inet6_release(struct socket *sock) if (!sk) return -EINVAL; + if (!sk->sk_kern_sock) + BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE(sock->sk); + /* Free mc lists */ ipv6_sock_mc_close(sk); /* Free ac lists */ ipv6_sock_ac_close(sk); - return inet_release(sock); + return __inet_release(sock); } EXPORT_SYMBOL(inet6_release); -- 2.20.1.321.g9e740568ce-goog