| Message ID | 20190118004106.163825-2-sdf@google.com |
|---|---|
| State | Changes Requested |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | add bpf cgroup hooks that trigger on socket close | expand |
Stanislav Fomichev <sdf@google.com> [Thu, 2019-01-17 16:41 -0800]: > These hooks mirror existing BPF_CGROUP_INET{4,6}_SOCK hooks (which > trigger upon socket creation), but trigger when the socket is closed. > > Signed-off-by: Stanislav Fomichev <sdf@google.com> > --- > include/linux/bpf-cgroup.h | 6 ++++++ > include/net/inet_common.h | 1 + > include/uapi/linux/bpf.h | 2 ++ > kernel/bpf/syscall.c | 8 ++++++++ > net/core/filter.c | 7 +++++++ > net/ipv4/af_inet.c | 13 ++++++++++++- > net/ipv6/af_inet6.c | 5 ++++- > 7 files changed, 40 insertions(+), 2 deletions(-) > > diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h > index 588dd5f0bd85..31fcfe215d80 100644 > --- a/include/linux/bpf-cgroup.h > +++ b/include/linux/bpf-cgroup.h > @@ -176,6 +176,12 @@ int bpf_percpu_cgroup_storage_update(struct bpf_map *map, void *key, > #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) \ > BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET_SOCK_CREATE) > > +#define BPF_CGROUP_RUN_PROG_INET4_SOCK_RELEASE(sk) \ > + BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_SOCK_RELEASE) > + > +#define BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE(sk) \ > + BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET6_SOCK_RELEASE) > + > #define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) \ > BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_POST_BIND) These macros should also be defined for the case when CONFIG_CGROUP_BPF is not set. See in this file below: #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; }) > diff --git a/include/net/inet_common.h b/include/net/inet_common.h > index 975901a95c0f..0e64046afe30 100644 > --- a/include/net/inet_common.h > +++ b/include/net/inet_common.h > @@ -17,6 +17,7 @@ struct sockaddr; > struct socket; > > int inet_release(struct socket *sock); > +int __inet_release(struct socket *sock); > int inet_stream_connect(struct socket *sock, struct sockaddr *uaddr, > int addr_len, int flags); > int __inet_stream_connect(struct socket *sock, struct sockaddr *uaddr, > diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h > index 91c43884f295..8e78aa28a42e 100644 > --- a/include/uapi/linux/bpf.h > +++ b/include/uapi/linux/bpf.h > @@ -186,6 +186,8 @@ enum bpf_attach_type { > BPF_CGROUP_UDP6_SENDMSG, > BPF_LIRC_MODE2, > BPF_FLOW_DISSECTOR, > + BPF_CGROUP_INET4_SOCK_RELEASE, > + BPF_CGROUP_INET6_SOCK_RELEASE, > __MAX_BPF_ATTACH_TYPE > }; > > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c > index b155cd17c1bd..6fa113448580 100644 > --- a/kernel/bpf/syscall.c > +++ b/kernel/bpf/syscall.c > @@ -1417,6 +1417,8 @@ bpf_prog_load_check_attach_type(enum bpf_prog_type prog_type, > case BPF_PROG_TYPE_CGROUP_SOCK: > switch (expected_attach_type) { > case BPF_CGROUP_INET_SOCK_CREATE: > + case BPF_CGROUP_INET4_SOCK_RELEASE: > + case BPF_CGROUP_INET6_SOCK_RELEASE: > case BPF_CGROUP_INET4_POST_BIND: > case BPF_CGROUP_INET6_POST_BIND: > return 0; > @@ -1709,6 +1711,8 @@ static int bpf_prog_attach(const union bpf_attr *attr) > ptype = BPF_PROG_TYPE_CGROUP_SKB; > break; > case BPF_CGROUP_INET_SOCK_CREATE: > + case BPF_CGROUP_INET4_SOCK_RELEASE: > + case BPF_CGROUP_INET6_SOCK_RELEASE: > case BPF_CGROUP_INET4_POST_BIND: > case BPF_CGROUP_INET6_POST_BIND: > ptype = BPF_PROG_TYPE_CGROUP_SOCK; > @@ -1791,6 +1795,8 @@ static int bpf_prog_detach(const union bpf_attr *attr) > ptype = BPF_PROG_TYPE_CGROUP_SKB; > break; > case BPF_CGROUP_INET_SOCK_CREATE: > + case BPF_CGROUP_INET4_SOCK_RELEASE: > + case BPF_CGROUP_INET6_SOCK_RELEASE: > case BPF_CGROUP_INET4_POST_BIND: > case BPF_CGROUP_INET6_POST_BIND: > ptype = BPF_PROG_TYPE_CGROUP_SOCK; > @@ -1841,6 +1847,8 @@ static int bpf_prog_query(const union bpf_attr *attr, > case BPF_CGROUP_INET_INGRESS: > case BPF_CGROUP_INET_EGRESS: > case BPF_CGROUP_INET_SOCK_CREATE: > + case BPF_CGROUP_INET4_SOCK_RELEASE: > + case BPF_CGROUP_INET6_SOCK_RELEASE: > case BPF_CGROUP_INET4_BIND: > case BPF_CGROUP_INET6_BIND: > case BPF_CGROUP_INET4_POST_BIND: > diff --git a/net/core/filter.c b/net/core/filter.c > index 2b3b436ef545..b4da6793fdbc 100644 > --- a/net/core/filter.c > +++ b/net/core/filter.c > @@ -5885,12 +5885,16 @@ static bool __sock_filter_check_attach_type(int off, > switch (attach_type) { > case BPF_CGROUP_INET_SOCK_CREATE: > goto full_access; > + case BPF_CGROUP_INET4_SOCK_RELEASE: > + case BPF_CGROUP_INET6_SOCK_RELEASE: > + goto read_only; > default: > return false; > } > case bpf_ctx_range(struct bpf_sock, src_ip4): > switch (attach_type) { > case BPF_CGROUP_INET4_POST_BIND: > + case BPF_CGROUP_INET4_SOCK_RELEASE: > goto read_only; > default: > return false; > @@ -5898,6 +5902,7 @@ static bool __sock_filter_check_attach_type(int off, > case bpf_ctx_range_till(struct bpf_sock, src_ip6[0], src_ip6[3]): > switch (attach_type) { > case BPF_CGROUP_INET6_POST_BIND: > + case BPF_CGROUP_INET6_SOCK_RELEASE: > goto read_only; > default: > return false; > @@ -5906,6 +5911,8 @@ static bool __sock_filter_check_attach_type(int off, > switch (attach_type) { > case BPF_CGROUP_INET4_POST_BIND: > case BPF_CGROUP_INET6_POST_BIND: > + case BPF_CGROUP_INET4_SOCK_RELEASE: > + case BPF_CGROUP_INET6_SOCK_RELEASE: > goto read_only; > default: > return false; > diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c > index 0dfb72c46671..b703ad242365 100644 > --- a/net/ipv4/af_inet.c > +++ b/net/ipv4/af_inet.c > @@ -403,7 +403,7 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, > * function we are destroying the object and from then on nobody > * should refer to it. > */ > -int inet_release(struct socket *sock) > +int __inet_release(struct socket *sock) > { > struct sock *sk = sock->sk; > > @@ -429,6 +429,17 @@ int inet_release(struct socket *sock) > } > return 0; > } > +EXPORT_SYMBOL(__inet_release); > + > +int inet_release(struct socket *sock) > +{ > + struct sock *sk = sock->sk; > + > + if (sk && !sk->sk_kern_sock) > + BPF_CGROUP_RUN_PROG_INET4_SOCK_RELEASE(sk); > + > + return __inet_release(sock); > +} > EXPORT_SYMBOL(inet_release); > > int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) > diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c > index d99753b5e39b..44c86595eba8 100644 > --- a/net/ipv6/af_inet6.c > +++ b/net/ipv6/af_inet6.c > @@ -464,13 +464,16 @@ int inet6_release(struct socket *sock) > if (!sk) > return -EINVAL; > > + if (!sk->sk_kern_sock) > + BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE(sock->sk); Nit: s/sock->sk/sk/ > + > /* Free mc lists */ > ipv6_sock_mc_close(sk); > > /* Free ac lists */ > ipv6_sock_ac_close(sk); > > - return inet_release(sock); > + return __inet_release(sock); > } > EXPORT_SYMBOL(inet6_release); > > -- > 2.20.1.321.g9e740568ce-goog >
Hi Stanislav,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on bpf-next/master]
url: https://github.com/0day-ci/linux/commits/Stanislav-Fomichev/bpf-add-BPF_CGROUP_INET-4-6-_SOCK_RELEASE-hooks/20190118-141334
base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
config: x86_64-randconfig-x005-201902 (attached as .config)
compiler: gcc-8 (Debian 8.2.0-14) 8.2.0
reproduce:
# save the attached .config to linux build tree
make ARCH=x86_64
All errors (new ones prefixed by >>):
net//ipv4/af_inet.c: In function 'inet_release':
>> net//ipv4/af_inet.c:439:3: error: implicit declaration of function 'BPF_CGROUP_RUN_PROG_INET4_SOCK_RELEASE'; did you mean 'BPF_CGROUP_RUN_PROG_INET_SOCK'? [-Werror=implicit-function-declaration]
BPF_CGROUP_RUN_PROG_INET4_SOCK_RELEASE(sk);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
BPF_CGROUP_RUN_PROG_INET_SOCK
cc1: some warnings being treated as errors
--
net//ipv6/af_inet6.c: In function 'inet6_release':
>> net//ipv6/af_inet6.c:468:3: error: implicit declaration of function 'BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE'; did you mean 'BPF_CGROUP_RUN_PROG_INET_SOCK'? [-Werror=implicit-function-declaration]
BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE(sock->sk);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
BPF_CGROUP_RUN_PROG_INET_SOCK
cc1: some warnings being treated as errors
vim +439 net//ipv4/af_inet.c
433
434 int inet_release(struct socket *sock)
435 {
436 struct sock *sk = sock->sk;
437
438 if (sk && !sk->sk_kern_sock)
> 439 BPF_CGROUP_RUN_PROG_INET4_SOCK_RELEASE(sk);
440
441 return __inet_release(sock);
442 }
443 EXPORT_SYMBOL(inet_release);
444
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
Hi Stanislav,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on bpf-next/master]
url: https://github.com/0day-ci/linux/commits/Stanislav-Fomichev/bpf-add-BPF_CGROUP_INET-4-6-_SOCK_RELEASE-hooks/20190118-141334
base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
config: i386-randconfig-a2-201902 (attached as .config)
compiler: gcc-4.9 (Debian 4.9.4-2) 4.9.4
reproduce:
# save the attached .config to linux build tree
make ARCH=i386
All errors (new ones prefixed by >>):
net/ipv6/af_inet6.c: In function 'inet6_release':
>> net/ipv6/af_inet6.c:468:3: error: implicit declaration of function 'BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE' [-Werror=implicit-function-declaration]
BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE(sock->sk);
^
cc1: some warnings being treated as errors
vim +/BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE +468 net/ipv6/af_inet6.c
459
460 int inet6_release(struct socket *sock)
461 {
462 struct sock *sk = sock->sk;
463
464 if (!sk)
465 return -EINVAL;
466
467 if (!sk->sk_kern_sock)
> 468 BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE(sock->sk);
469
470 /* Free mc lists */
471 ipv6_sock_mc_close(sk);
472
473 /* Free ac lists */
474 ipv6_sock_ac_close(sk);
475
476 return __inet_release(sock);
477 }
478 EXPORT_SYMBOL(inet6_release);
479
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h index 588dd5f0bd85..31fcfe215d80 100644 --- a/include/linux/bpf-cgroup.h +++ b/include/linux/bpf-cgroup.h @@ -176,6 +176,12 @@ int bpf_percpu_cgroup_storage_update(struct bpf_map *map, void *key, #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) \ BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET_SOCK_CREATE) +#define BPF_CGROUP_RUN_PROG_INET4_SOCK_RELEASE(sk) \ + BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_SOCK_RELEASE) + +#define BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE(sk) \ + BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET6_SOCK_RELEASE) + #define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) \ BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_POST_BIND) diff --git a/include/net/inet_common.h b/include/net/inet_common.h index 975901a95c0f..0e64046afe30 100644 --- a/include/net/inet_common.h +++ b/include/net/inet_common.h @@ -17,6 +17,7 @@ struct sockaddr; struct socket; int inet_release(struct socket *sock); +int __inet_release(struct socket *sock); int inet_stream_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags); int __inet_stream_connect(struct socket *sock, struct sockaddr *uaddr, diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 91c43884f295..8e78aa28a42e 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -186,6 +186,8 @@ enum bpf_attach_type { BPF_CGROUP_UDP6_SENDMSG, BPF_LIRC_MODE2, BPF_FLOW_DISSECTOR, + BPF_CGROUP_INET4_SOCK_RELEASE, + BPF_CGROUP_INET6_SOCK_RELEASE, __MAX_BPF_ATTACH_TYPE }; diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index b155cd17c1bd..6fa113448580 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1417,6 +1417,8 @@ bpf_prog_load_check_attach_type(enum bpf_prog_type prog_type, case BPF_PROG_TYPE_CGROUP_SOCK: switch (expected_attach_type) { case BPF_CGROUP_INET_SOCK_CREATE: + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: case BPF_CGROUP_INET4_POST_BIND: case BPF_CGROUP_INET6_POST_BIND: return 0; @@ -1709,6 +1711,8 @@ static int bpf_prog_attach(const union bpf_attr *attr) ptype = BPF_PROG_TYPE_CGROUP_SKB; break; case BPF_CGROUP_INET_SOCK_CREATE: + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: case BPF_CGROUP_INET4_POST_BIND: case BPF_CGROUP_INET6_POST_BIND: ptype = BPF_PROG_TYPE_CGROUP_SOCK; @@ -1791,6 +1795,8 @@ static int bpf_prog_detach(const union bpf_attr *attr) ptype = BPF_PROG_TYPE_CGROUP_SKB; break; case BPF_CGROUP_INET_SOCK_CREATE: + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: case BPF_CGROUP_INET4_POST_BIND: case BPF_CGROUP_INET6_POST_BIND: ptype = BPF_PROG_TYPE_CGROUP_SOCK; @@ -1841,6 +1847,8 @@ static int bpf_prog_query(const union bpf_attr *attr, case BPF_CGROUP_INET_INGRESS: case BPF_CGROUP_INET_EGRESS: case BPF_CGROUP_INET_SOCK_CREATE: + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: case BPF_CGROUP_INET4_BIND: case BPF_CGROUP_INET6_BIND: case BPF_CGROUP_INET4_POST_BIND: diff --git a/net/core/filter.c b/net/core/filter.c index 2b3b436ef545..b4da6793fdbc 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -5885,12 +5885,16 @@ static bool __sock_filter_check_attach_type(int off, switch (attach_type) { case BPF_CGROUP_INET_SOCK_CREATE: goto full_access; + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: + goto read_only; default: return false; } case bpf_ctx_range(struct bpf_sock, src_ip4): switch (attach_type) { case BPF_CGROUP_INET4_POST_BIND: + case BPF_CGROUP_INET4_SOCK_RELEASE: goto read_only; default: return false; @@ -5898,6 +5902,7 @@ static bool __sock_filter_check_attach_type(int off, case bpf_ctx_range_till(struct bpf_sock, src_ip6[0], src_ip6[3]): switch (attach_type) { case BPF_CGROUP_INET6_POST_BIND: + case BPF_CGROUP_INET6_SOCK_RELEASE: goto read_only; default: return false; @@ -5906,6 +5911,8 @@ static bool __sock_filter_check_attach_type(int off, switch (attach_type) { case BPF_CGROUP_INET4_POST_BIND: case BPF_CGROUP_INET6_POST_BIND: + case BPF_CGROUP_INET4_SOCK_RELEASE: + case BPF_CGROUP_INET6_SOCK_RELEASE: goto read_only; default: return false; diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 0dfb72c46671..b703ad242365 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -403,7 +403,7 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, * function we are destroying the object and from then on nobody * should refer to it. */ -int inet_release(struct socket *sock) +int __inet_release(struct socket *sock) { struct sock *sk = sock->sk; @@ -429,6 +429,17 @@ int inet_release(struct socket *sock) } return 0; } +EXPORT_SYMBOL(__inet_release); + +int inet_release(struct socket *sock) +{ + struct sock *sk = sock->sk; + + if (sk && !sk->sk_kern_sock) + BPF_CGROUP_RUN_PROG_INET4_SOCK_RELEASE(sk); + + return __inet_release(sock); +} EXPORT_SYMBOL(inet_release); int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index d99753b5e39b..44c86595eba8 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -464,13 +464,16 @@ int inet6_release(struct socket *sock) if (!sk) return -EINVAL; + if (!sk->sk_kern_sock) + BPF_CGROUP_RUN_PROG_INET6_SOCK_RELEASE(sock->sk); + /* Free mc lists */ ipv6_sock_mc_close(sk); /* Free ac lists */ ipv6_sock_ac_close(sk); - return inet_release(sock); + return __inet_release(sock); } EXPORT_SYMBOL(inet6_release);
These hooks mirror existing BPF_CGROUP_INET{4,6}_SOCK hooks (which trigger upon socket creation), but trigger when the socket is closed. Signed-off-by: Stanislav Fomichev <sdf@google.com> --- include/linux/bpf-cgroup.h | 6 ++++++ include/net/inet_common.h | 1 + include/uapi/linux/bpf.h | 2 ++ kernel/bpf/syscall.c | 8 ++++++++ net/core/filter.c | 7 +++++++ net/ipv4/af_inet.c | 13 ++++++++++++- net/ipv6/af_inet6.c | 5 ++++- 7 files changed, 40 insertions(+), 2 deletions(-)