bpf: Allow any port in bpf_bind helper
authorStanislav Fomichev <sdf@google.com>
Fri, 8 May 2020 17:46:11 +0000 (10:46 -0700)
committerDaniel Borkmann <daniel@iogearbox.net>
Fri, 8 May 2020 22:48:20 +0000 (00:48 +0200)
commit8086fbaf49345f988deec539ec8e182b02914401
tree0c7f078dca26060f1ef9217c2f959cb058614a37
parentcb0721c7e200750907bb8ef59b12646a5cb2dadf
bpf: Allow any port in bpf_bind helper

We want to have a tighter control on what ports we bind to in
the BPF_CGROUP_INET{4,6}_CONNECT hooks even if it means
connect() becomes slightly more expensive. The expensive part
comes from the fact that we now need to call inet_csk_get_port()
that verifies that the port is not used and allocates an entry
in the hash table for it.

Since we can't rely on "snum || !bind_address_no_port" to prevent
us from calling POST_BIND hook anymore, let's add another bind flag
to indicate that the call site is BPF program.

v5:
* fix wrong AF_INET (should be AF_INET6) in the bpf program for v6

v3:
* More bpf_bind documentation refinements (Martin KaFai Lau)
* Add UDP tests as well (Martin KaFai Lau)
* Don't start the thread, just do socket+bind+listen (Martin KaFai Lau)

v2:
* Update documentation (Andrey Ignatov)
* Pass BIND_FORCE_ADDRESS_NO_PORT conditionally (Andrey Ignatov)

Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrey Ignatov <rdna@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200508174611.228805-5-sdf@google.com
include/net/inet_common.h
include/uapi/linux/bpf.h
net/core/filter.c
net/ipv4/af_inet.c
net/ipv6/af_inet6.c
tools/include/uapi/linux/bpf.h
tools/testing/selftests/bpf/prog_tests/connect_force_port.c [new file with mode: 0644]
tools/testing/selftests/bpf/progs/connect_force_port4.c [new file with mode: 0644]
tools/testing/selftests/bpf/progs/connect_force_port6.c [new file with mode: 0644]