Andrey Ignatov
be00aafb24
BACKPORT: bpf: Hooks for sys_connect ...
== The problem ==
See description of the problem in the initial patch of this patch set.
== The solution ==
The patch provides much more reliable in-kernel solution for the 2nd
part of the problem: making outgoing connecttion from desired IP.
It adds new attach types `BPF_CGROUP_INET4_CONNECT` and
`BPF_CGROUP_INET6_CONNECT` for program type
`BPF_PROG_TYPE_CGROUP_SOCK_ADDR` that can be used to override both
source and destination of a connection at connect(2) time.
Local end of connection can be bound to desired IP using newly
introduced BPF-helper `bpf_bind()`. It allows to bind to only IP though,
and doesn't support binding to port, i.e. leverages
`IP_BIND_ADDRESS_NO_PORT` socket option. There are two reasons for this:
* looking for a free port is expensive and can affect performance
significantly;
* there is no use-case for port.
As for remote end (`struct sockaddr *` passed by user), both parts of it
can be overridden, remote IP and remote port. It's useful if an
application inside cgroup wants to connect to another application inside
same cgroup or to itself, but knows nothing about IP assigned to the
cgroup.
Support is added for IPv4 and IPv6, for TCP and UDP.
IPv4 and IPv6 have separate attach types for same reason as sys_bind
hooks, i.e. to prevent reading from / writing to e.g. user_ip6 fields
when user passes sockaddr_in since it'd be out-of-bound.
== Implementation notes ==
The patch introduces new field in `struct proto`: `pre_connect` that is
a pointer to a function with same signature as `connect` but is called
before it. The reason is in some cases BPF hooks should be called way
before control is passed to `sk->sk_prot->connect`. Specifically
`inet_dgram_connect` autobinds socket before calling
`sk->sk_prot->connect` and there is no way to call `bpf_bind()` from
hooks from e.g. `ip4_datagram_connect` or `ip6_datagram_connect` since
it'd cause double-bind. On the other hand `proto.pre_connect` provides a
flexible way to add BPF hooks for connect only for necessary `proto` and
call them at desired time before `connect`. Since `bpf_bind()` is
allowed to bind only to IP and autobind in `inet_dgram_connect` binds
only port there is no chance of double-bind.
bpf_bind() sets `force_bind_address_no_port` to bind to only IP despite
of value of `bind_address_no_port` socket field.
bpf_bind() sets `with_lock` to `false` when calling to __inet_bind()
and __inet6_bind() since all call-sites, where bpf_bind() is called,
already hold socket lock.
Change-Id: Ief71932407d9e96d6264ebf2089be8ea38a67ea4
Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
2026-05-15 17:56:15 +07:00
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
2022-08-25 11:09:20 +02:00
net: caif: add proper error handling
2021-06-10 12:42:36 +02:00
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
2022-03-31 22:52:51 +03:00
UPSTREAM: tcp: Namespace-ify sysctl_tcp_default_congestion_control
2026-05-15 17:55:40 +07:00
NFC: add NCI_UNREG flag to eliminate the race
2021-12-08 08:45:04 +01:00
phonet: fix building with clang
2019-03-23 13:19:44 +01:00
BACKPORT: net: Work around lockdep limitation in sockets that use sockets
2026-05-15 17:56:15 +07:00
net/sched: act_tunnel_key: fix NULL dereference when 'goto chain' is used
2018-08-24 13:12:37 +02:00
6lowpan: add 802.15.4 short addr slaac
2016-06-15 20:41:22 -07:00
net sched: fix reporting the first-time use timestamp
2020-06-03 08:16:25 +02:00
BACKPORT: bpf: Hooks for sys_connect
2026-05-15 17:56:15 +07:00
rxrpc: Rewrite the data and ack handling code
2016-09-08 11:10:12 +01:00
af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
2024-07-21 16:03:38 -07:00
vsock: split dwork to avoid reinitializations
2018-08-22 07:47:13 +02:00
ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
2019-06-11 12:22:49 +02:00
ax25: fix possible use-after-free
2019-02-23 09:05:59 +01:00
bonding: wait for sysfs kobject destruction before freeing struct slave
2020-12-11 13:37:57 +01:00
net: Fix a data-race around sysctl_net_busy_poll.
2022-09-05 10:23:55 +02:00
calipso: Add a label cache.
2016-06-27 15:06:17 -04:00
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-18.1-caf-sdm845
2021-07-22 02:11:11 +03:00
ieee802154: add netns support
2016-07-08 12:20:57 +02:00
openvswitch: Fix setting ipv6 fields causing hw csum failure
2022-03-02 11:32:02 +01:00
netlabel: out of bound access in cipso_v4_validate()
2017-02-18 15:11:41 +01:00
cls_cgroup: get sk_classid only from full sockets
2016-04-19 20:09:25 -04:00
Merge "cnss: Add support for PCIe WLAN IPA uc SMMU feature"
2018-07-26 07:45:06 -07:00
cnss2: Sync code from kernel 4.14
2020-05-17 20:19:19 -07:00
cnss: Add support of cnss driver
2018-02-08 16:32:00 +08:00
cnss_nl: Add new attributes for cld80211 attr list
2020-03-07 00:19:25 +05:30
wcnss: Fix buffer overflow in wcnss_prealloc_get
2018-09-12 16:05:33 +05:30
cnss_utils: Add support for derived MAC address
2017-11-09 15:08:16 -08:00
codel: split into multiple files
2016-04-25 16:44:27 -04:00
codel: split into multiple files
2016-04-25 16:44:27 -04:00
net_sched: fq_codel: cache skb->truesize into skb->cb
2016-06-25 12:19:35 -04:00
packet: compat support for sock_fprog
2016-06-09 23:41:03 -07:00
devlink: remove unused priv_size
2016-08-26 11:55:18 -07:00
net: dsa: add port fast ageing
2016-09-23 08:38:50 -04:00
net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
2020-07-22 09:10:48 +02:00
UPSTREAM: bpf: don't rely on the verifier lock for metadata_dst allocation
2026-05-15 17:55:50 +07:00
BACKPORT: net: fix __dst_negative_advice() race
2024-08-19 10:13:09 +03:00
This is the 4.9.217 stable release
2020-03-20 11:01:08 +01:00
UPSTREAM: flow: Extend flow informations with xfrm interface id.
2018-10-26 21:39:51 -07:00
UPSTREAM: net: flow_dissector: add support for dissection of tcp flags
2026-05-15 17:54:42 +07:00
fou: Add encap ops for IPv6 tunnels
2016-05-20 18:03:16 -04:00
net/flow_dissector: switch to siphash
2019-11-10 11:23:31 +01:00
net/flow_dissector: switch to siphash
2019-11-10 11:23:31 +01:00
net: sched: do not acquire qdisc spinlock in qdisc/class stats dump
2016-06-07 16:37:14 -07:00
genetlink: remove genl_bind
2020-07-22 09:10:48 +02:00
net: Remove deprecated tunnel specific UDP offload functions
2016-06-17 20:23:32 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2016-08-18 01:17:32 -04:00
BACKPORT: gro_cells: move to net/core/gro_cells.c
2026-05-15 17:54:38 +07:00
gtp: #define #define _GTP_H_ and not #define _GTP_H
2016-07-25 17:55:43 -07:00
net: add a hardware buffer management helper API
2016-03-14 12:19:46 -04:00
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-03 17:44:46 +01:00
mac80211: add support for radiotap timestamp field
2016-09-12 11:45:45 +02:00
net: ieee802154: return -EINVAL for unknown addr type
2022-10-26 13:15:48 +02:00
BACKPORT: ipv6: Implement draft-ietf-6man-rfc4941bis
2022-01-31 14:39:14 +00:00
ipv6: remove unused in6_addr struct
2016-03-22 15:45:44 -04:00
BACKPORT: net: ipv6: add second dif to inet6 socket lookups
2026-05-15 17:55:19 +07:00
BACKPORT: net: Work around lockdep limitation in sockets that use sockets
2026-05-15 17:56:15 +07:00
BACKPORT: net: Work around lockdep limitation in sockets that use sockets
2026-05-15 17:56:15 +07:00
vlan: consolidate VLAN parsing code and limit max parsing depth
2020-12-11 13:37:58 +01:00
net: IP defrag: encapsulate rbtree defrag code into callable functions
2019-05-02 09:32:06 +02:00
BACKPORT: net: ipv4: add second dif to inet socket lookups
2026-05-15 17:55:18 +07:00
This is the 4.9.325 stable release
2022-07-29 18:58:19 +02:00
BACKPORT: ipv4: Namespaceify tcp_tw_recycle and tcp_max_tw_buckets knob
2026-05-15 17:55:39 +07:00
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-23 09:05:59 +01:00
BACKPORT: net: ipv4: add second dif to udp socket lookups
2026-05-15 17:55:18 +07:00
ipv6: Pass proto to csum_ipv6_magic as __u8 instead of unsigned short
2016-03-13 23:55:13 -04:00
ipv6: fix sparse warning on rt6i_node
2017-09-20 08:19:53 +02:00
This is the 4.9.277 stable release
2021-07-28 12:36:41 +02:00
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
2019-07-21 09:05:57 +02:00
UPSTREAM: ipv4: fib: Remove unused functions
2026-05-15 17:55:00 +07:00
ip_tunnel: add collect_md mode to IPIP tunnel
2016-09-17 10:13:07 -04:00
ipvs: move old_secure_tcp into struct netns_ipvs
2019-11-12 19:15:57 +01:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-05-20 08:15:30 +02:00
ip6: fix skb leak in ip6frag_expire_frag_queue()
2019-09-16 08:19:33 +02:00
wext: handle NULL extra data in iwe_stream_add_point better
2017-08-11 08:49:34 -07:00
kcm: Use stream parser
2016-08-17 19:36:23 -04:00
ipvlan, l3mdev: fix broken l3s mode wrt local routes
2019-02-06 17:33:27 +01:00
llc: fix out-of-bound array index in llc_sk_dev_hash()
2021-11-26 11:48:39 +01:00
llc: fix sk_buff leak in llc_conn_service()
2019-11-06 12:18:24 +01:00
net: llc: fix skb_over_panic
2021-08-04 11:58:03 +02:00
lwtunnel: valid encap attr check should return 0 when lwtunnel is disabled
2017-02-18 15:11:42 +01:00
mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4
2018-05-30 07:50:28 +02:00
ieee802154: cleanup WARN_ON for fc fetch
2016-07-08 13:23:12 +02:00
openvswitch: use mpls_hdr
2016-10-03 02:00:22 -04:00
mrp: introduce active flags to prevent UAF when applicant uninit
2023-01-07 12:07:32 +01:00
net/ncsi: Introduce ncsi_stop_dev()
2016-10-04 02:11:51 -04:00
UPSTREAM: ipv6: ndisc: RFC-ietf-6man-ra-pref64-09 is now published as RFC8781
2020-11-16 14:33:43 +01:00
Merge android-4.9.209(c830063) into msm-4.9
2020-03-13 15:47:19 +08:00
netns: provide pure entropy for net_hash_mix()
2019-04-17 08:36:46 +02:00
neigh: Send a notification when DELAY_PROBE_TIME changes
2016-07-05 09:06:29 -07:00
netlabel: Implement CALIPSO config functions for SMACK.
2016-06-27 15:06:18 -04:00
netlink: fix nla_put_{u8,u16,u32} for KASAN
2017-10-12 11:51:25 +02:00
net: fix rtnh_ok()
2018-05-16 10:08:41 +02:00
net: ieee802154: handle iftypes as u32
2021-12-08 08:45:03 +01:00
net: ping: make ping_v6_sendmsg static
2016-03-23 22:09:58 -04:00
net/sched: pkt_cls: change tc actions order to be as the user sets
2016-09-28 05:02:44 -04:00
net_sched: Add flow control support to prio qdisc
2017-03-22 17:37:14 -06:00
pptp: Refactor the struct and macros of PPTP codes
2016-08-15 10:55:53 -07:00
BACKPORT: net: Add sysctl to toggle early demux for tcp and udp
2026-05-15 17:54:49 +07:00
BACKPORT: net: ipv4: add second dif to raw socket lookups
2026-05-15 17:55:19 +07:00
UPSTREAM: net: ipv6: add second dif to raw socket lookups
2026-05-15 17:55:19 +07:00
sch_red: fix off-by-one checks in red_check_params()
2021-04-16 11:59:07 +02:00
regulatory: add NUL to request alpha2
2018-05-30 07:50:30 +02:00
BACKPORT: ipv4: Namespaceify tcp_max_syn_backlog knob
2026-05-15 17:55:39 +07:00
net: rmnet_data: Add snapshot of rmnet_data driver
2016-11-01 20:02:26 -06:00
This is the 4.9.104 stable release
2018-05-30 13:19:56 +02:00
can: dev: Move device back to init netns on owning netns delete
2021-03-30 14:41:42 +02:00
net_sched: restore "mpu xxx" handling
2022-01-27 08:47:42 +01:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-25 11:45:19 +02:00
BACKPORT: ipv6: sr: add core files for SR HMAC support
2026-05-15 17:54:16 +07:00
BACKPORT: ipv6: sr: add core files for SR HMAC support
2026-05-15 17:54:16 +07:00
slip: Check if rstate is initialized before uncompressing
2018-04-20 08:21:07 +02:00
net: snmp: fix 64bit stats on 32bit arches
2016-04-28 11:49:45 -04:00
BACKPORT: bpf: Hooks for sys_connect
2026-05-15 17:56:15 +07:00
BACKPORT: strparser: initialize all callbacks
2026-05-15 17:55:20 +07:00
switchdev: remove FIB offload infrastructure
2016-09-28 04:48:00 -04:00
UPSTREAM: bpf: sockmap, add sock close() hook to remove socks
2026-05-15 17:56:10 +07:00
BACKPORT: tls: Fix TLS ulp context leak, when TLS_TX setsockopt is not used.
2026-05-15 17:55:32 +07:00
ipv6: add new struct ipcm6_cookie
2016-05-03 16:08:14 -04:00
BACKPORT: bpf: Hooks for sys_connect
2026-05-15 17:56:15 +07:00
vxlan: Add new UDP encapsulation offload type for VXLAN-GPE
2016-06-17 20:23:32 -07:00
udplite: fix partial checksum initialization
2018-03-11 16:21:32 +01:00
vxlan: fix hlist corruption
2017-07-21 07:42:18 +02:00
net: x25: fix one potential use-after-free issue
2018-04-13 19:48:00 +02:00
UPSTREAM: xdp: base API for new XDP rx-queue info concept
2026-05-15 17:56:12 +07:00
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
2022-06-12 01:39:01 +03:00
be00aafb24