• Stanislav Fomichev's avatar
    bpf: Allow any port in bpf_bind helper · 8086fbaf
    Stanislav Fomichev authored
    We want to have a tighter control on what ports we bind to in
    the BPF_CGROUP_INET{4,6}_CONNECT hooks even if it means
    connect() becomes slightly more expensive. The expensive part
    comes from the fact that we now need to call inet_csk_get_port()
    that verifies that the port is not used and allocates an entry
    in the hash table for it.
    
    Since we can't rely on "snum || !bind_address_no_port" to prevent
    us from calling POST_BIND hook anymore, let's add another bind flag
    to indicate that the call site is BPF program.
    
    v5:
    * fix wrong AF_INET (should be AF_INET6) in the bpf program for v6
    
    v3:
    * More bpf_bind documentation refinements (Martin KaFai Lau)
    * Add UDP tests as well (Martin KaFai Lau)
    * Don't start the thread, just do socket+bind+listen (Martin KaFai Lau)
    
    v2:
    * Update documentation (Andrey Ignatov)
    * Pass BIND_FORCE_ADDRESS_NO_PORT conditionally (Andrey Ignatov)
    Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: default avatarAndrey Ignatov <rdna@fb.com>
    Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
    Link: https://lore.kernel.org/bpf/20200508174611.228805-5-sdf@google.com
    8086fbaf
af_inet.c 51 KB