tree f285f62416fa2f6adae9d22a1fa51aec7df297d5
parent 3a5c9e0254ec20a081077915bb5d19914e7dbae8
author Andrey Ignatov <rdna@fb.com> 1527263723 -0700
committer Tim Zimmermann <tim@linux4.de> 1721467386 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuwYxAyE4TRnuhLgPbcIaY/gZxe8FAmabgfoACgkQbcIaY/gZ
 xe/vyQ//RySp5i9rxv5b5KFk+0cP+zGH+7OeRW/wnylA4WDSZqGWy4nmQJVvcUzS
 MNntGcVHTeLzBx4NaS+G8xxMtEpZ0MrtHWkwwuHd8tF/R+zfaZBO5GJ1vKDwEhrN
 3YdlqO0tgKTBpP4b1EMIXto3OK/HEng7iP5PhHf7nVXXnLHQBT4BgUOwhe5xgkUK
 pgsiOGyYY6Wa78IDh3NupJUZ+2uRLUU4uX8N851Xt3d86ckx3LNI+RmVcNYVzMGm
 qwgkRWlzqDWUF4YehMiRazWEekO0ZmoTLK3sKCqv2gXGut1ugesEXGys+N0i2seD
 nHSYXCtGRMB5qTgbQJS5BWxNIeqSgjfj07pzTUlIC+6GC53nYaIkU/T1QWqJsqCJ
 6vkux6kXvM4PN9XVWulPqOmwjUqnTVrVBPTcfFMd4fbyA0S3KhP17sGmjRonfGiX
 bZwfv7LPODLw+WEGbj+7kPniExiahe1SJ0TvTDrLgpSUzcWsfsJdIYTUSjs+PZ4T
 bxLOPj4mIq7oLwushi1JFAALYBo01sI72cTy+/WRf1cK1cOHb5Jjh3CKsSwBm+1Q
 RuUu1p38Y4HtiiOsDOwB28gd9L3k0MTGu8fEpJNoFXtHr2/4UYBzQvffN05YjCY7
 10QHjoGqG9MEHDKU+ZTQC4VmEibh/LsnAgVttqR7MctnksahDHA=
 =V0S9
 -----END PGP SIGNATURE-----

bpf: Hooks for sys_sendmsg

In addition to already existing BPF hooks for sys_bind and sys_connect,
the patch provides new hooks for sys_sendmsg.

It leverages existing BPF program type `BPF_PROG_TYPE_CGROUP_SOCK_ADDR`
that provides access to socket itlself (properties like family, type,
protocol) and user-passed `struct sockaddr *` so that BPF program can
override destination IP and port for system calls such as sendto(2) or
sendmsg(2) and/or assign source IP to the socket.

The hooks are implemented as two new attach types:
`BPF_CGROUP_UDP4_SENDMSG` and `BPF_CGROUP_UDP6_SENDMSG` for UDPv4 and
UDPv6 correspondingly.

UDPv4 and UDPv6 separate attach types for same reason as sys_bind and
sys_connect hooks, i.e. to prevent reading from / writing to e.g.
user_ip6 fields when user passes sockaddr_in since it'd be out-of-bound.

The difference with already existing hooks is sys_sendmsg are
implemented only for unconnected UDP.

For TCP it doesn't make sense to change user-provided `struct sockaddr *`
at sendto(2)/sendmsg(2) time since socket either was already connected
and has source/destination set or wasn't connected and call to
sendto(2)/sendmsg(2) would lead to ENOTCONN anyway.

Connected UDP is already handled by sys_connect hooks that can override
source/destination at connect time and use fast-path later, i.e. these
hooks don't affect UDP fast-path.

Rewriting source IP is implemented differently than that in sys_connect
hooks. When sys_sendmsg is used with unconnected UDP it doesn't work to
just bind socket to desired local IP address since source IP can be set
on per-packet basis by using ancillary data (cmsg(3)). So no matter if
socket is bound or not, source IP has to be rewritten on every call to
sys_sendmsg.

To do so two new fields are added to UAPI `struct bpf_sock_addr`;
* `msg_src_ip4` to set source IPv4 for UDPv4;
* `msg_src_ip6` to set source IPv6 for UDPv6.

Change-Id: Icf5938b0b69ddfb1e99dc2abc90204f7c97f0473
Signed-off-by: Andrey Ignatov <rdna@fb.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>