bpf, sockmap: Return socket cookie on lookup from syscall

Tooling that populates the SOCK{MAP,HASH} with sockets from user-space
needs a way to inspect its contents. Returning the struct sock * that the
map holds to user-space is neither safe nor useful. An approach established
by REUSEPORT_SOCKARRAY is to return a socket cookie (a unique identifier)
instead.

Since socket cookies are u64 values, SOCK{MAP,HASH} need to support such a
value size for lookup to be possible. This requires special handling on
update, though. Attempts to do a lookup on a map holding u32 values will be
met with ENOSPC error.

Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20200218171023.844439-7-jakub@cloudflare.com

diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index a5103112a344bbca411c2a089b1c140acbb36ad1..f48c934d5da0a614c8721ab0ad486c82e28d7fd6 100644 (file)
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -10,6 +10,7 @@
 #include <linux/skmsg.h>
 #include <linux/list.h>
 #include <linux/jhash.h>
+#include <linux/sock_diag.h>
 
 struct bpf_stab {
        struct bpf_map map;
@@ -31,7 +32,8 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr)
                return ERR_PTR(-EPERM);
        if (attr->max_entries == 0 ||
            attr->key_size    != 4 ||
-           attr->value_size  != 4 ||
+           (attr->value_size != sizeof(u32) &&
+            attr->value_size != sizeof(u64)) ||
            attr->map_flags & ~SOCK_CREATE_FLAG_MASK)
                return ERR_PTR(-EINVAL);
 
@@ -302,6 +304,21 @@ static void *sock_map_lookup(struct bpf_map *map, void *key)
        return ERR_PTR(-EOPNOTSUPP);
 }
 
+static void *sock_map_lookup_sys(struct bpf_map *map, void *key)
+{
+       struct sock *sk;
+
+       if (map->value_size != sizeof(u64))
+               return ERR_PTR(-ENOSPC);
+
+       sk = __sock_map_lookup_elem(map, *(u32 *)key);
+       if (!sk)
+               return ERR_PTR(-ENOENT);
+
+       sock_gen_cookie(sk);
+       return &sk->sk_cookie;
+}
+
 static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
                             struct sock **psk)
 {
@@ -445,11 +462,18 @@ static bool sock_map_sk_state_allowed(const struct sock *sk)
 static int sock_map_update_elem(struct bpf_map *map, void *key,
                                void *value, u64 flags)
 {
-       u32 ufd = *(u32 *)value;
        u32 idx = *(u32 *)key;
        struct socket *sock;
        struct sock *sk;
        int ret;
+       u64 ufd;
+
+       if (map->value_size == sizeof(u64))
+               ufd = *(u64 *)value;
+       else
+               ufd = *(u32 *)value;
+       if (ufd > S32_MAX)
+               return -EINVAL;
 
        sock = sockfd_lookup(ufd, &ret);
        if (!sock)
@@ -557,6 +581,7 @@ const struct bpf_map_ops sock_map_ops = {
        .map_alloc              = sock_map_alloc,
        .map_free               = sock_map_free,
        .map_get_next_key       = sock_map_get_next_key,
+       .map_lookup_elem_sys_only = sock_map_lookup_sys,
        .map_update_elem        = sock_map_update_elem,
        .map_delete_elem        = sock_map_delete_elem,
        .map_lookup_elem        = sock_map_lookup,
@@ -787,10 +812,17 @@ out_free:
 static int sock_hash_update_elem(struct bpf_map *map, void *key,
                                 void *value, u64 flags)
 {
-       u32 ufd = *(u32 *)value;
        struct socket *sock;
        struct sock *sk;
        int ret;
+       u64 ufd;
+
+       if (map->value_size == sizeof(u64))
+               ufd = *(u64 *)value;
+       else
+               ufd = *(u32 *)value;
+       if (ufd > S32_MAX)
+               return -EINVAL;
 
        sock = sockfd_lookup(ufd, &ret);
        if (!sock)
@@ -866,7 +898,8 @@ static struct bpf_map *sock_hash_alloc(union bpf_attr *attr)
                return ERR_PTR(-EPERM);
        if (attr->max_entries == 0 ||
            attr->key_size    == 0 ||
-           attr->value_size  != 4 ||
+           (attr->value_size != sizeof(u32) &&
+            attr->value_size != sizeof(u64)) ||
            attr->map_flags & ~SOCK_CREATE_FLAG_MASK)
                return ERR_PTR(-EINVAL);
        if (attr->key_size > MAX_BPF_STACK)
@@ -943,6 +976,21 @@ static void sock_hash_free(struct bpf_map *map)
        kfree(htab);
 }
 
+static void *sock_hash_lookup_sys(struct bpf_map *map, void *key)
+{
+       struct sock *sk;
+
+       if (map->value_size != sizeof(u64))
+               return ERR_PTR(-ENOSPC);
+
+       sk = __sock_hash_lookup_elem(map, key);
+       if (!sk)
+               return ERR_PTR(-ENOENT);
+
+       sock_gen_cookie(sk);
+       return &sk->sk_cookie;
+}
+
 static void sock_hash_release_progs(struct bpf_map *map)
 {
        psock_progs_drop(&container_of(map, struct bpf_htab, map)->progs);
@@ -1032,6 +1080,7 @@ const struct bpf_map_ops sock_hash_ops = {
        .map_update_elem        = sock_hash_update_elem,
        .map_delete_elem        = sock_hash_delete_elem,
        .map_lookup_elem        = sock_map_lookup,
+       .map_lookup_elem_sys_only = sock_hash_lookup_sys,
        .map_release_uref       = sock_hash_release_progs,
        .map_check_btf          = map_check_no_btf,
 };