^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) .. SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) ============================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) BPF_PROG_TYPE_CGROUP_SOCKOPT
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) ============================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) ``BPF_PROG_TYPE_CGROUP_SOCKOPT`` program type can be attached to two
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) cgroup hooks:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * ``BPF_CGROUP_GETSOCKOPT`` - called every time process executes ``getsockopt``
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) system call.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) * ``BPF_CGROUP_SETSOCKOPT`` - called every time process executes ``setsockopt``
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) system call.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) The context (``struct bpf_sockopt``) has associated socket (``sk``) and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) all input arguments: ``level``, ``optname``, ``optval`` and ``optlen``.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) BPF_CGROUP_SETSOCKOPT
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) =====================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) ``BPF_CGROUP_SETSOCKOPT`` is triggered *before* the kernel handling of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) sockopt and it has writable context: it can modify the supplied arguments
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) before passing them down to the kernel. This hook has access to the cgroup
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) and socket local storage.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) If BPF program sets ``optlen`` to -1, the control will be returned
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) back to the userspace after all other BPF programs in the cgroup
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) chain finish (i.e. kernel ``setsockopt`` handling will *not* be executed).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) Note, that ``optlen`` can not be increased beyond the user-supplied
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) value. It can only be decreased or set to -1. Any other value will
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) trigger ``EFAULT``.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) Return Type
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) -----------
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) * ``0`` - reject the syscall, ``EPERM`` will be returned to the userspace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) * ``1`` - success, continue with next BPF program in the cgroup chain.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) BPF_CGROUP_GETSOCKOPT
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) =====================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) ``BPF_CGROUP_GETSOCKOPT`` is triggered *after* the kernel handing of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) sockopt. The BPF hook can observe ``optval``, ``optlen`` and ``retval``
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) if it's interested in whatever kernel has returned. BPF hook can override
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) the values above, adjust ``optlen`` and reset ``retval`` to 0. If ``optlen``
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) has been increased above initial ``getsockopt`` value (i.e. userspace
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) buffer is too small), ``EFAULT`` is returned.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) This hook has access to the cgroup and socket local storage.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) Note, that the only acceptable value to set to ``retval`` is 0 and the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) original value that the kernel returned. Any other value will trigger
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) ``EFAULT``.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) Return Type
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) -----------
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) * ``0`` - reject the syscall, ``EPERM`` will be returned to the userspace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) * ``1`` - success: copy ``optval`` and ``optlen`` to userspace, return
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) ``retval`` from the syscall (note that this can be overwritten by
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) the BPF program from the parent cgroup).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) Cgroup Inheritance
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) ==================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) Suppose, there is the following cgroup hierarchy where each cgroup
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) has ``BPF_CGROUP_GETSOCKOPT`` attached at each level with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) ``BPF_F_ALLOW_MULTI`` flag::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) A (root, parent)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) B (child)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) When the application calls ``getsockopt`` syscall from the cgroup B,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) the programs are executed from the bottom up: B, A. First program
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) (B) sees the result of kernel's ``getsockopt``. It can optionally
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) adjust ``optval``, ``optlen`` and reset ``retval`` to 0. After that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) control will be passed to the second (A) program which will see the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) same context as B including any potential modifications.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) Same for ``BPF_CGROUP_SETSOCKOPT``: if the program is attached to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) A and B, the trigger order is B, then A. If B does any changes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) to the input arguments (``level``, ``optname``, ``optval``, ``optlen``),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) then the next program in the chain (A) will see those changes,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) *not* the original input ``setsockopt`` arguments. The potentially
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) modified values will be then passed down to the kernel.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) Large optval
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) ============
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) When the ``optval`` is greater than the ``PAGE_SIZE``, the BPF program
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) can access only the first ``PAGE_SIZE`` of that data. So it has to options:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) * Set ``optlen`` to zero, which indicates that the kernel should
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) use the original buffer from the userspace. Any modifications
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) done by the BPF program to the ``optval`` are ignored.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) * Set ``optlen`` to the value less than ``PAGE_SIZE``, which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) indicates that the kernel should use BPF's trimmed ``optval``.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) When the BPF program returns with the ``optlen`` greater than
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) ``PAGE_SIZE``, the userspace will receive ``EFAULT`` errno.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) Example
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) =======
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) See ``tools/testing/selftests/bpf/progs/sockopt_sk.c`` for an example
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) of BPF program that handles socket options.
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags