772412176f
At the moment, BPF_CGROUP_INET{4,6}_BIND hooks can rewrite user_port
to the privileged ones (< ip_unprivileged_port_start), but it will
be rejected later on in the __inet_bind or __inet6_bind.
Let's add another return value to indicate that CAP_NET_BIND_SERVICE
check should be ignored. Use the same idea as we currently use
in cgroup/egress where bit #1 indicates CN. Instead, for
cgroup/bind{4,6}, bit #1 indicates that CAP_NET_BIND_SERVICE should
be bypassed.
v5:
- rename flags to be less confusing (Andrey Ignatov)
- rework BPF_PROG_CGROUP_INET_EGRESS_RUN_ARRAY to work on flags
and accept BPF_RET_SET_CN (no behavioral changes)
v4:
- Add missing IPv6 support (Martin KaFai Lau)
v3:
- Update description (Martin KaFai Lau)
- Fix capability restore in selftest (Martin KaFai Lau)
v2:
- Switch to explicit return code (Martin KaFai Lau)
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Andrey Ignatov <rdna@fb.com>
Link: https://lore.kernel.org/bpf/20210127193140.3170382-1-sdf@google.com
76 lines
2.6 KiB
C
76 lines
2.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _INET_COMMON_H
|
|
#define _INET_COMMON_H
|
|
|
|
#include <linux/indirect_call_wrapper.h>
|
|
|
|
extern const struct proto_ops inet_stream_ops;
|
|
extern const struct proto_ops inet_dgram_ops;
|
|
|
|
/*
|
|
* INET4 prototypes used by INET6
|
|
*/
|
|
|
|
struct msghdr;
|
|
struct sock;
|
|
struct sockaddr;
|
|
struct socket;
|
|
|
|
int inet_release(struct socket *sock);
|
|
int inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
|
|
int addr_len, int flags);
|
|
int __inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
|
|
int addr_len, int flags, int is_sendmsg);
|
|
int inet_dgram_connect(struct socket *sock, struct sockaddr *uaddr,
|
|
int addr_len, int flags);
|
|
int inet_accept(struct socket *sock, struct socket *newsock, int flags,
|
|
bool kern);
|
|
int inet_send_prepare(struct sock *sk);
|
|
int inet_sendmsg(struct socket *sock, struct msghdr *msg, size_t size);
|
|
ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset,
|
|
size_t size, int flags);
|
|
int inet_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
|
|
int flags);
|
|
int inet_shutdown(struct socket *sock, int how);
|
|
int inet_listen(struct socket *sock, int backlog);
|
|
void inet_sock_destruct(struct sock *sk);
|
|
int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len);
|
|
/* Don't allocate port at this moment, defer to connect. */
|
|
#define BIND_FORCE_ADDRESS_NO_PORT (1 << 0)
|
|
/* Grab and release socket lock. */
|
|
#define BIND_WITH_LOCK (1 << 1)
|
|
/* Called from BPF program. */
|
|
#define BIND_FROM_BPF (1 << 2)
|
|
/* Skip CAP_NET_BIND_SERVICE check. */
|
|
#define BIND_NO_CAP_NET_BIND_SERVICE (1 << 3)
|
|
int __inet_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
|
|
u32 flags);
|
|
int inet_getname(struct socket *sock, struct sockaddr *uaddr,
|
|
int peer);
|
|
int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
|
|
int inet_ctl_sock_create(struct sock **sk, unsigned short family,
|
|
unsigned short type, unsigned char protocol,
|
|
struct net *net);
|
|
int inet_recv_error(struct sock *sk, struct msghdr *msg, int len,
|
|
int *addr_len);
|
|
|
|
struct sk_buff *inet_gro_receive(struct list_head *head, struct sk_buff *skb);
|
|
int inet_gro_complete(struct sk_buff *skb, int nhoff);
|
|
struct sk_buff *inet_gso_segment(struct sk_buff *skb,
|
|
netdev_features_t features);
|
|
|
|
static inline void inet_ctl_sock_destroy(struct sock *sk)
|
|
{
|
|
if (sk)
|
|
sock_release(sk->sk_socket);
|
|
}
|
|
|
|
#define indirect_call_gro_receive(f2, f1, cb, head, skb) \
|
|
({ \
|
|
unlikely(gro_recursion_inc_test(skb)) ? \
|
|
NAPI_GRO_CB(skb)->flush |= 1, NULL : \
|
|
INDIRECT_CALL_2(cb, f2, f1, head, skb); \
|
|
})
|
|
|
|
#endif
|