We're currently building a control plane for our BPF socket dispatch work. As part of that, we have a need to create a copy of an existing sockhash, to allow us to change the keys. I previously proposed allowing privileged userspace to look up sockets, which doesn't work due to security concerns (see [1]). In follow up discussions during BPF office hours we identified bpf_iter as a possible solution: instead of accessing sockets from user space we can iterate the source sockhash, and insert the values into a new map. Enabling this requires two pieces: the ability to iterate sockmap and sockhash, as well as being able to call map_update_elem from BPF. This patch set implements the latter: it's now possible to update sockmap from BPF context. As a next step, we can implement bpf_iter for sockmap. === I've done some more fixups, and audited the safe contexts more thoroughly. As a result I'm removing CGROUP_SKB, SK_MSG and SK_SKB for now. Changes in v3: - Use CHECK as much as possible (Yonghong) - Reject ARG_PTR_TO_MAP_VALUE_OR_NULL for sockmap (Yonghong) - Remove CGROUP_SKB, SK_MSG, SK_SKB from safe contexts - Test that the verifier rejects update from unsafe context Changes in v2: - Fix warning in patch #2 (Jakub K) - Renamed override_map_arg_type (John) - Only allow updating sockmap from known safe contexts (John) - Use __s64 for sockmap updates from user space (Yonghong) - Various small test fixes around test macros and such (Yonghong) Thank your for your reviews! 1: https://lore.kernel.org/bpf/20200310174711.7490-1-lmb@xxxxxxxxxxxxxx/ Lorenz Bauer (6): net: sk_msg: simplify sk_psock initialization bpf: sockmap: merge sockmap and sockhash update functions bpf: sockmap: call sock_map_update_elem directly bpf: override the meaning of ARG_PTR_TO_MAP_VALUE for sockmap and sockhash bpf: sockmap: allow update from BPF selftests: bpf: test sockmap update from BPF include/linux/bpf.h | 7 + include/linux/skmsg.h | 17 --- kernel/bpf/syscall.c | 5 +- kernel/bpf/verifier.c | 73 +++++++++- net/core/skmsg.c | 34 ++++- net/core/sock_map.c | 137 ++++++++---------- net/ipv4/tcp_bpf.c | 13 +- net/ipv4/udp_bpf.c | 9 +- .../selftests/bpf/prog_tests/sockmap_basic.c | 78 ++++++++++ .../bpf/progs/test_sockmap_invalid_update.c | 23 +++ .../selftests/bpf/progs/test_sockmap_update.c | 48 ++++++ 11 files changed, 326 insertions(+), 118 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/test_sockmap_invalid_update.c create mode 100644 tools/testing/selftests/bpf/progs/test_sockmap_update.c -- 2.25.1
