sock_map: Lift socket state restriction for datagram sockets

TCP and other connection oriented sockets have accept()
for each incoming connection on the server side, hence
they can just insert those fd's from accept() to sockmap,
which are of course established.

Now with datagram sockets begin to support sockmap and
redirection, the restriction is no longer applicable to
them, as they have no accept(). So we have to lift this
restriction for them. This is fine, because inside
bpf_sk_redirect_map() we still have another socket status
check, sock_map_redirect_allowed(), as a guard.

This also means they do not have to be removed from
sockmap when disconnecting.

Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20210704190252.11866-3-xiyou.wangcong@gmail.com

diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index 60decd6420ca17361fb13363c9b3e0203e1f21ca..3c427e7e6df9cfe1e5527ac95b0e654f1fd4deb3 100644 (file)
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -211,8 +211,6 @@ out:
        return psock;
 }
 
-static bool sock_map_redirect_allowed(const struct sock *sk);
-
 static int sock_map_link(struct bpf_map *map, struct sock *sk)
 {
        struct sk_psock_progs *progs = sock_map_progs(map);
@@ -223,13 +221,6 @@ static int sock_map_link(struct bpf_map *map, struct sock *sk)
        struct sk_psock *psock;
        int ret;
 
-       /* Only sockets we can redirect into/from in BPF need to hold
-        * refs to parser/verdict progs and have their sk_data_ready
-        * and sk_write_space callbacks overridden.
-        */
-       if (!sock_map_redirect_allowed(sk))
-               goto no_progs;
-
        stream_verdict = READ_ONCE(progs->stream_verdict);
        if (stream_verdict) {
                stream_verdict = bpf_prog_inc_not_zero(stream_verdict);
@@ -264,7 +255,6 @@ static int sock_map_link(struct bpf_map *map, struct sock *sk)
                }
        }
 
-no_progs:
        psock = sock_map_psock_get_checked(sk);
        if (IS_ERR(psock)) {
                ret = PTR_ERR(psock);
@@ -527,12 +517,6 @@ static bool sk_is_tcp(const struct sock *sk)
               sk->sk_protocol == IPPROTO_TCP;
 }
 
-static bool sk_is_udp(const struct sock *sk)
-{
-       return sk->sk_type == SOCK_DGRAM &&
-              sk->sk_protocol == IPPROTO_UDP;
-}
-
 static bool sock_map_redirect_allowed(const struct sock *sk)
 {
        if (sk_is_tcp(sk))
@@ -550,10 +534,7 @@ static bool sock_map_sk_state_allowed(const struct sock *sk)
 {
        if (sk_is_tcp(sk))
                return (1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_LISTEN);
-       else if (sk_is_udp(sk))
-               return sk_hashed(sk);
-
-       return false;
+       return true;
 }
 
 static int sock_hash_update_common(struct bpf_map *map, void *key,

diff --git a/net/ipv4/udp_bpf.c b/net/ipv4/udp_bpf.c
index 45b8782aec0cc151817f7e9acd80e15f24a16cf7..cb1d113ce6fd880a1c6da43d803bc3617e38c59b 100644 (file)
--- a/net/ipv4/udp_bpf.c
+++ b/net/ipv4/udp_bpf.c
@@ -112,7 +112,6 @@ static struct proto udp_bpf_prots[UDP_BPF_NUM_PROTS];
 static void udp_bpf_rebuild_protos(struct proto *prot, const struct proto *base)
 {
        *prot        = *base;
-       prot->unhash = sock_map_unhash;
        prot->close  = sock_map_close;
        prot->recvmsg = udp_bpf_recvmsg;
 }

diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c b/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c
index 515229f24a9399c287ccade3b1cce54dad03fcd4..b8934ae694e5462a49e373a5061cea4852b9e38d 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c
+++ b/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c
@@ -351,9 +351,11 @@ static void test_insert_opened(int family, int sotype, int mapfd)
        errno = 0;
        value = s;
        err = bpf_map_update_elem(mapfd, &key, &value, BPF_NOEXIST);
-       if (!err || errno != EOPNOTSUPP)
-               FAIL_ERRNO("map_update: expected EOPNOTSUPP");
-
+       if (sotype == SOCK_STREAM) {
+               if (!err || errno != EOPNOTSUPP)
+                       FAIL_ERRNO("map_update: expected EOPNOTSUPP");
+       } else if (err)
+               FAIL_ERRNO("map_update: expected success");
        xclose(s);
 }