netdev - Re: [PATCH bpf-next v10 3/9] bpf: Add bpf_sock_addr_set_sun_path() to allow writing unix sockaddr from bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231011175833.45358-1-kuniyu@amazon.com>
Date: Wed, 11 Oct 2023 10:58:33 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <daan.j.demeyer@...il.com>
CC: <bpf@...r.kernel.org>, <kernel-team@...a.com>, <martin.lau@...ux.dev>,
	<netdev@...r.kernel.org>, <kuniyu@...zon.com>
Subject: Re: [PATCH bpf-next v10 3/9] bpf: Add bpf_sock_addr_set_sun_path() to allow writing unix sockaddr from bpf

From: Daan De Meyer <daan.j.demeyer@...il.com>
Date: Wed, 11 Oct 2023 19:03:12 +0200
> As prep for adding unix socket support to the cgroup sockaddr hooks,
> let's add a kfunc bpf_sock_addr_set_sun_path() that allows modifying a unix
> sockaddr from bpf. While this is already possible for AF_INET and AF_INET6,
> we'll need this kfunc when we add unix socket support since modifying the
> address for those requires modifying both the address and the sockaddr
> length.
> 
> Signed-off-by: Daan De Meyer <daan.j.demeyer@...il.com>
> ---
>  kernel/bpf/btf.c  |  1 +
>  net/core/filter.c | 40 +++++++++++++++++++++++++++++++++++++++-
>  2 files changed, 40 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 69101200c124..15d71d2986d3 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -7850,6 +7850,7 @@ static int bpf_prog_type_to_kfunc_hook(enum bpf_prog_type prog_type)
>  	case BPF_PROG_TYPE_SYSCALL:
>  		return BTF_KFUNC_HOOK_SYSCALL;
>  	case BPF_PROG_TYPE_CGROUP_SKB:
> +	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
>  		return BTF_KFUNC_HOOK_CGROUP_SKB;
>  	case BPF_PROG_TYPE_SCHED_ACT:
>  		return BTF_KFUNC_HOOK_SCHED_ACT;
> diff --git a/net/core/filter.c b/net/core/filter.c
> index a094694899c9..12fbd8a560c8 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -81,6 +81,7 @@
>  #include <net/xdp.h>
>  #include <net/mptcp.h>
>  #include <net/netfilter/nf_conntrack_bpf.h>
> +#include <linux/un.h>
>  
>  static const struct bpf_func_proto *
>  bpf_sk_base_func_proto(enum bpf_func_id func_id);
> @@ -11752,6 +11753,32 @@ __bpf_kfunc int bpf_dynptr_from_xdp(struct xdp_buff *xdp, u64 flags,
>  
>  	return 0;
>  }
> +
> +__bpf_kfunc int bpf_sock_addr_set_sun_path(struct bpf_sock_addr_kern *sa_kern,
> +					   const u8 *sun_path, u32 sun_path__sz)
> +{
> +	struct sockaddr *sa = sa_kern->uaddr;
> +	struct sockaddr_un *un;
> +
> +	if (sa_kern->sk->sk_family != AF_UNIX)
> +		return -EINVAL;
> +
> +	/* We do not allow changing the address of unnamed unix sockets. */
> +	if (sa_kern->uaddrlen == 0)
> +		return -EINVAL;

Instead of adding this check, you can call the hooks after
unix_validate_addr() in connect() and sendmsg().

In unix_getname(), you can move up the bpf hooks into the else
branch below.

    if (!addr) {
        ...
    } else {
        ...
        <-- here
    }


> +
> +	/* We do not allow changing the address to unnamed or larger than the
> +	 * maximum allowed address size for a unix sockaddr.
> +	 */
> +	if (sun_path__sz == 0 || sun_path__sz > UNIX_PATH_MAX)
> +		return -EINVAL;
> +
> +	un = (struct sockaddr_un *)sa;
> +	memcpy(un->sun_path, sun_path, sun_path__sz);
> +	sa_kern->uaddrlen = offsetof(struct sockaddr_un, sun_path) + sun_path__sz;
> +
> +	return 0;
> +}
>  __diag_pop();
>  
>  int bpf_dynptr_from_skb_rdonly(struct sk_buff *skb, u64 flags,
> @@ -11776,6 +11803,10 @@ BTF_SET8_START(bpf_kfunc_check_set_xdp)
>  BTF_ID_FLAGS(func, bpf_dynptr_from_xdp)
>  BTF_SET8_END(bpf_kfunc_check_set_xdp)
>  
> +BTF_SET8_START(bpf_kfunc_check_set_sock_addr)
> +BTF_ID_FLAGS(func, bpf_sock_addr_set_sun_path)
> +BTF_SET8_END(bpf_kfunc_check_set_sock_addr)
> +
>  static const struct btf_kfunc_id_set bpf_kfunc_set_skb = {
>  	.owner = THIS_MODULE,
>  	.set = &bpf_kfunc_check_set_skb,
> @@ -11786,6 +11817,11 @@ static const struct btf_kfunc_id_set bpf_kfunc_set_xdp = {
>  	.set = &bpf_kfunc_check_set_xdp,
>  };
>  
> +static const struct btf_kfunc_id_set bpf_kfunc_set_sock_addr = {
> +	.owner = THIS_MODULE,
> +	.set = &bpf_kfunc_check_set_sock_addr,
> +};
> +
>  static int __init bpf_kfunc_init(void)
>  {
>  	int ret;
> @@ -11800,7 +11836,9 @@ static int __init bpf_kfunc_init(void)
>  	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_XMIT, &bpf_kfunc_set_skb);
>  	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_SEG6LOCAL, &bpf_kfunc_set_skb);
>  	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_NETFILTER, &bpf_kfunc_set_skb);
> -	return ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &bpf_kfunc_set_xdp);
> +	ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &bpf_kfunc_set_xdp);
> +	return ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCK_ADDR,
> +						&bpf_kfunc_set_sock_addr);
>  }
>  late_initcall(bpf_kfunc_init);
>  
> -- 
> 2.41.0