From 3ad3794efa2112dd6ab23312acedd3d409608408 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Thu, 19 Sep 2024 00:13:04 +0000 Subject: [PATCH] bpf: merge block.c into netd.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since this is just a special case of a bpf cgroup hook, it really should be in netd.o with all other such hooks. Besides moving/renaming the map & programs this should be a no-op. Test: TreeHugger, atest bpf_existence_test Signed-off-by: Maciej Żenczykowski Change-Id: I4a2aedaf77f89a9c0a96fa1c369d80659535eabe --- Tethering/apex/Android.bp | 1 - bpf/netd/BpfHandler.cpp | 6 +- bpf/progs/Android.bp | 6 -- bpf/progs/block.c | 69 ------------------- bpf/progs/netd.c | 39 +++++++++++ bpf/progs/netd.h | 2 + bpf/tests/mts/bpf_existence_test.cpp | 6 +- .../ConnectivityNativeService.java | 2 +- 8 files changed, 47 insertions(+), 84 deletions(-) delete mode 100644 bpf/progs/block.c diff --git a/Tethering/apex/Android.bp b/Tethering/apex/Android.bp index 3b197fc27c..0c053548b6 100644 --- a/Tethering/apex/Android.bp +++ b/Tethering/apex/Android.bp @@ -98,7 +98,6 @@ apex { ], canned_fs_config: "canned_fs_config", bpfs: [ - "block.o", "clatd.o", "dscpPolicy.o", "netd.o", diff --git a/bpf/netd/BpfHandler.cpp b/bpf/netd/BpfHandler.cpp index 96825455b3..15ab19c41e 100644 --- a/bpf/netd/BpfHandler.cpp +++ b/bpf/netd/BpfHandler.cpp @@ -142,11 +142,9 @@ static Status initPrograms(const char* cg2_path) { } if (bpf::isAtLeastKernelVersion(4, 19, 0)) { - RETURN_IF_NOT_OK(attachProgramToCgroup( - "/sys/fs/bpf/netd_readonly/prog_block_bind4_block_port", + RETURN_IF_NOT_OK(attachProgramToCgroup(CGROUP_BIND4_PROG_PATH, cg_fd, BPF_CGROUP_INET4_BIND)); - RETURN_IF_NOT_OK(attachProgramToCgroup( - "/sys/fs/bpf/netd_readonly/prog_block_bind6_block_port", + RETURN_IF_NOT_OK(attachProgramToCgroup(CGROUP_BIND6_PROG_PATH, cg_fd, BPF_CGROUP_INET6_BIND)); // This should trivially pass, since we just attached up above, diff --git a/bpf/progs/Android.bp b/bpf/progs/Android.bp index dc1f56d9f6..52eb1b3ef5 100644 --- a/bpf/progs/Android.bp +++ b/bpf/progs/Android.bp @@ -63,12 +63,6 @@ cc_library_headers { // // bpf kernel programs // -bpf { - name: "block.o", - srcs: ["block.c"], - sub_dir: "net_shared", -} - bpf { name: "dscpPolicy.o", srcs: ["dscpPolicy.c"], diff --git a/bpf/progs/block.c b/bpf/progs/block.c deleted file mode 100644 index 0e2dba936b..0000000000 --- a/bpf/progs/block.c +++ /dev/null @@ -1,69 +0,0 @@ -/* - * Copyright (C) 2022 The Android Open Source Project - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// The resulting .o needs to load on Android T+ -#define BPFLOADER_MIN_VER BPFLOADER_MAINLINE_T_VERSION - -#include "bpf_net_helpers.h" - -DEFINE_BPF_MAP_GRW(blocked_ports_map, ARRAY, int, uint64_t, - 1024 /* 64K ports -> 1024 u64s */, AID_SYSTEM) - -static inline __always_inline int block_port(struct bpf_sock_addr *ctx) { - if (!ctx->user_port) return BPF_ALLOW; - - switch (ctx->protocol) { - case IPPROTO_TCP: - case IPPROTO_MPTCP: - case IPPROTO_UDP: - case IPPROTO_UDPLITE: - case IPPROTO_DCCP: - case IPPROTO_SCTP: - break; - default: - return BPF_ALLOW; // unknown protocols are allowed - } - - int key = ctx->user_port >> 6; - int shift = ctx->user_port & 63; - - uint64_t *val = bpf_blocked_ports_map_lookup_elem(&key); - // Lookup should never fail in reality, but if it does return here to keep the - // BPF verifier happy. - if (!val) return BPF_ALLOW; - - if ((*val >> shift) & 1) return BPF_DISALLOW; - return BPF_ALLOW; -} - -// the program need to be accessible/loadable by netd (from netd updatable plugin) -#define DEFINE_NETD_RO_BPF_PROG(SECTION_NAME, the_prog, min_kver) \ - DEFINE_BPF_PROG_EXT(SECTION_NAME, AID_ROOT, AID_ROOT, the_prog, min_kver, KVER_INF, \ - BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, MANDATORY, \ - "", "netd_readonly/", LOAD_ON_ENG, LOAD_ON_USER, LOAD_ON_USERDEBUG) - -DEFINE_NETD_RO_BPF_PROG("bind4/block_port", bind4_block_port, KVER_4_19) -(struct bpf_sock_addr *ctx) { - return block_port(ctx); -} - -DEFINE_NETD_RO_BPF_PROG("bind6/block_port", bind6_block_port, KVER_4_19) -(struct bpf_sock_addr *ctx) { - return block_port(ctx); -} - -LICENSE("Apache 2.0"); -CRITICAL("ConnectivityNative"); diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c index 4248a46d2b..8804ad569d 100644 --- a/bpf/progs/netd.c +++ b/bpf/progs/netd.c @@ -69,6 +69,8 @@ DEFINE_BPF_MAP_RO_NETD(configuration_map, ARRAY, uint32_t, uint32_t, CONFIGURATI // TODO: consider whether we can merge some of these maps // for example it might be possible to merge 2 or 3 of: // uid_counterset_map + uid_owner_map + uid_permission_map +DEFINE_BPF_MAP_NO_NETD(blocked_ports_map, ARRAY, int, uint64_t, + 1024 /* 64K ports -> 1024 u64s */) DEFINE_BPF_MAP_RW_NETD(cookie_tag_map, HASH, uint64_t, UidTagValue, COOKIE_UID_MAP_SIZE) DEFINE_BPF_MAP_NO_NETD(uid_counterset_map, HASH, uint32_t, uint8_t, UID_COUNTERSET_MAP_SIZE) DEFINE_BPF_MAP_NO_NETD(app_uid_stats_map, HASH, uint32_t, StatsValue, APP_STATS_MAP_SIZE) @@ -670,6 +672,43 @@ static __always_inline inline int check_localhost(__unused struct bpf_sock_addr return BPF_ALLOW; } +static inline __always_inline int block_port(struct bpf_sock_addr *ctx) { + if (!ctx->user_port) return BPF_ALLOW; + + switch (ctx->protocol) { + case IPPROTO_TCP: + case IPPROTO_MPTCP: + case IPPROTO_UDP: + case IPPROTO_UDPLITE: + case IPPROTO_DCCP: + case IPPROTO_SCTP: + break; + default: + return BPF_ALLOW; // unknown protocols are allowed + } + + int key = ctx->user_port >> 6; + int shift = ctx->user_port & 63; + + uint64_t *val = bpf_blocked_ports_map_lookup_elem(&key); + // Lookup should never fail in reality, but if it does return here to keep the + // BPF verifier happy. + if (!val) return BPF_ALLOW; + + if ((*val >> shift) & 1) return BPF_DISALLOW; + return BPF_ALLOW; +} + +DEFINE_NETD_BPF_PROG_KVER("bind4/inet4_bind", AID_ROOT, AID_ROOT, inet4_bind, KVER_4_19) +(struct bpf_sock_addr *ctx) { + return block_port(ctx); +} + +DEFINE_NETD_BPF_PROG_KVER("bind6/inet6_bind", AID_ROOT, AID_ROOT, inet6_bind, KVER_4_19) +(struct bpf_sock_addr *ctx) { + return block_port(ctx); +} + DEFINE_NETD_V_BPF_PROG_KVER("connect4/inet4_connect", AID_ROOT, AID_ROOT, inet4_connect, KVER_4_14) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); diff --git a/bpf/progs/netd.h b/bpf/progs/netd.h index 4877a4bfdd..be7c311a33 100644 --- a/bpf/progs/netd.h +++ b/bpf/progs/netd.h @@ -157,6 +157,8 @@ ASSERT_STRING_EQUAL(XT_BPF_DENYLIST_PROG_PATH, BPF_NETD_PATH "prog_netd_skfilte #define CGROUP_INET_CREATE_PROG_PATH BPF_NETD_PATH "prog_netd_cgroupsock_inet_create" #define CGROUP_INET_RELEASE_PROG_PATH BPF_NETD_PATH "prog_netd_cgroupsockrelease_inet_release" +#define CGROUP_BIND4_PROG_PATH BPF_NETD_PATH "prog_netd_bind4_inet4_bind" +#define CGROUP_BIND6_PROG_PATH BPF_NETD_PATH "prog_netd_bind6_inet6_bind" #define CGROUP_CONNECT4_PROG_PATH BPF_NETD_PATH "prog_netd_connect4_inet4_connect" #define CGROUP_CONNECT6_PROG_PATH BPF_NETD_PATH "prog_netd_connect6_inet6_connect" #define CGROUP_UDP4_RECVMSG_PROG_PATH BPF_NETD_PATH "prog_netd_recvmsg4_udp4_recvmsg" diff --git a/bpf/tests/mts/bpf_existence_test.cpp b/bpf/tests/mts/bpf_existence_test.cpp index f3c6907779..eaa6373d6c 100644 --- a/bpf/tests/mts/bpf_existence_test.cpp +++ b/bpf/tests/mts/bpf_existence_test.cpp @@ -82,13 +82,13 @@ static const set MAINLINE_FOR_S_PLUS = { // Provided by *current* mainline module for T+ devices static const set MAINLINE_FOR_T_PLUS = { - SHARED "map_block_blocked_ports_map", SHARED "map_clatd_clat_egress4_map", SHARED "map_clatd_clat_ingress6_map", SHARED "map_dscpPolicy_ipv4_dscp_policies_map", SHARED "map_dscpPolicy_ipv6_dscp_policies_map", SHARED "map_dscpPolicy_socket_policy_cache_map", NETD "map_netd_app_uid_stats_map", + NETD "map_netd_blocked_ports_map", NETD "map_netd_configuration_map", NETD "map_netd_cookie_tag_map", NETD "map_netd_data_saver_enabled_map", @@ -119,8 +119,8 @@ static const set MAINLINE_FOR_T_4_14_PLUS = { // Provided by *current* mainline module for T+ devices with 5.4+ kernels static const set MAINLINE_FOR_T_4_19_PLUS = { - NETD_RO "prog_block_bind4_block_port", - NETD_RO "prog_block_bind6_block_port", + NETD "prog_netd_bind4_inet4_bind", + NETD "prog_netd_bind6_inet6_bind", }; // Provided by *current* mainline module for T+ devices with 5.15+ kernels diff --git a/service/src/com/android/server/connectivity/ConnectivityNativeService.java b/service/src/com/android/server/connectivity/ConnectivityNativeService.java index 917ad4d69e..7a008c6704 100644 --- a/service/src/com/android/server/connectivity/ConnectivityNativeService.java +++ b/service/src/com/android/server/connectivity/ConnectivityNativeService.java @@ -43,7 +43,7 @@ public class ConnectivityNativeService extends ConnectivityNative.Stub { private static final String TAG = ConnectivityNativeService.class.getSimpleName(); private static final String BLOCKED_PORTS_MAP_PATH = - "/sys/fs/bpf/net_shared/map_block_blocked_ports_map"; + "/sys/fs/bpf/netd_shared/map_netd_blocked_ports_map"; private final Context mContext;