bpf: Allow any port in bpf_bind helper
We want to have a tighter control on what ports we bind to in the BPF_CGROUP_INET{4,6}_CONNECT hooks even if it means connect() becomes slightly more expensive. The expensive part comes from the fact that we now need to call inet_csk_get_port() that verifies that the port is not used and allocates an entry in the hash table for it. Since we can't rely on "snum || !bind_address_no_port" to prevent us from calling POST_BIND hook anymore, let's add another bind flag to indicate that the call site is BPF program. v5: * fix wrong AF_INET (should be AF_INET6) in the bpf program for v6 v3: * More bpf_bind documentation refinements (Martin KaFai Lau) * Add UDP tests as well (Martin KaFai Lau) * Don't start the thread, just do socket+bind+listen (Martin KaFai Lau) v2: * Update documentation (Andrey Ignatov) * Pass BIND_FORCE_ADDRESS_NO_PORT conditionally (Andrey Ignatov) Signed-off-by:Stanislav Fomichev <sdf@google.com> Signed-off-by:
Daniel Borkmann <daniel@iogearbox.net> Acked-by:
Andrey Ignatov <rdna@fb.com> Acked-by:
Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200508174611.228805-5-sdf@google.com
Showing
- include/net/inet_common.h 2 additions, 0 deletionsinclude/net/inet_common.h
- include/uapi/linux/bpf.h 5 additions, 4 deletionsinclude/uapi/linux/bpf.h
- net/core/filter.c 7 additions, 11 deletionsnet/core/filter.c
- net/ipv4/af_inet.c 6 additions, 4 deletionsnet/ipv4/af_inet.c
- net/ipv6/af_inet6.c 7 additions, 5 deletionsnet/ipv6/af_inet6.c
- tools/include/uapi/linux/bpf.h 5 additions, 4 deletionstools/include/uapi/linux/bpf.h
- tools/testing/selftests/bpf/prog_tests/connect_force_port.c 115 additions, 0 deletionstools/testing/selftests/bpf/prog_tests/connect_force_port.c
- tools/testing/selftests/bpf/progs/connect_force_port4.c 28 additions, 0 deletionstools/testing/selftests/bpf/progs/connect_force_port4.c
- tools/testing/selftests/bpf/progs/connect_force_port6.c 28 additions, 0 deletionstools/testing/selftests/bpf/progs/connect_force_port6.c
Loading
Please register or sign in to comment