src/core/bpf-socket-bind.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #if BPF_FRAMEWORK
   4 #include <bpf/bpf.h>
   5 #endif
   6
   7 #include "fd-util.h"
   8 #include "bpf-socket-bind.h"
   9
  10 #if BPF_FRAMEWORK
  11 /* libbpf, clang, llvm and bpftool compile time dependencies are satisfied */
  12 #include "bpf-dlopen.h"
  13 #include "bpf-link.h"
  14 #include "bpf/socket_bind/socket-bind.skel.h"
  15 #include "bpf/socket_bind/socket-bind-api.bpf.h"
  16
  17 static struct socket_bind_bpf *socket_bind_bpf_free(struct socket_bind_bpf *obj) {
  18         /* socket_bind_bpf__destroy handles object == NULL case */
  19         (void) socket_bind_bpf__destroy(obj);
  20
  21         return NULL;
  22 }
  23
  24 DEFINE_TRIVIAL_CLEANUP_FUNC(struct socket_bind_bpf *, socket_bind_bpf_free);
  25
  26 static int update_rules_map(
  27                 int map_fd,
  28                 CGroupSocketBindItem *head) {
  29
  30         CGroupSocketBindItem *item;
  31         uint32_t i = 0;
  32
  33         assert(map_fd >= 0);
  34
  35         LIST_FOREACH(socket_bind_items, item, head) {
  36                 struct socket_bind_rule val = {
  37                         .address_family = (uint32_t) item->address_family,
  38                         .nr_ports = item->nr_ports,
  39                         .port_min = item->port_min,
  40                 };
  41
  42                 uint32_t key = i++;
  43
  44                 if (sym_bpf_map_update_elem(map_fd, &key, &val, BPF_ANY) != 0)
  45                         return -errno;
  46         }
  47
  48         return 0;
  49 }
  50
  51 static int prepare_socket_bind_bpf(
  52                 Unit *u,
  53                 CGroupSocketBindItem *allow,
  54                 CGroupSocketBindItem *deny,
  55                 struct socket_bind_bpf **ret_obj) {
  56
  57         _cleanup_(socket_bind_bpf_freep) struct socket_bind_bpf *obj = NULL;
  58         size_t allow_count = 0, deny_count = 0;
  59         int allow_map_fd, deny_map_fd, r;
  60         CGroupSocketBindItem *item;
  61
  62         assert(ret_obj);
  63
  64         LIST_FOREACH(socket_bind_items, item, allow)
  65                 allow_count++;
  66
  67         LIST_FOREACH(socket_bind_items, item, deny)
  68                 deny_count++;
  69
  70         if (allow_count > SOCKET_BIND_MAX_RULES)
  71                 return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, SYNTHETIC_ERRNO(EINVAL),
  72                                            "Maximum number of socket bind rules=%u is exceeded", SOCKET_BIND_MAX_RULES);
  73
  74         if (deny_count > SOCKET_BIND_MAX_RULES)
  75                 return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, SYNTHETIC_ERRNO(EINVAL),
  76                                            "Maximum number of socket bind rules=%u is exceeded", SOCKET_BIND_MAX_RULES);
  77
  78         obj = socket_bind_bpf__open();
  79         if (!obj)
  80                 return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, SYNTHETIC_ERRNO(ENOMEM),
  81                                            "Failed to open BPF object");
  82
  83         if (sym_bpf_map__resize(obj->maps.sd_bind_allow, MAX(allow_count, 1u)) != 0)
  84                 return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, errno,
  85                                            "Failed to resize BPF map '%s': %m", sym_bpf_map__name(obj->maps.sd_bind_allow));
  86
  87         if (sym_bpf_map__resize(obj->maps.sd_bind_deny, MAX(deny_count, 1u)) != 0)
  88                 return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, errno,
  89                                            "Failed to resize BPF map '%s': %m", sym_bpf_map__name(obj->maps.sd_bind_deny));
  90
  91         if (socket_bind_bpf__load(obj) != 0)
  92                 return log_unit_full_errno(u, u ? LOG_ERR : LOG_DEBUG, errno,
  93                                            "Failed to load BPF object: %m");
  94
  95         allow_map_fd = sym_bpf_map__fd(obj->maps.sd_bind_allow);
  96         assert(allow_map_fd >= 0);
  97
  98         r = update_rules_map(allow_map_fd, allow);
  99         if (r < 0)
 100                 return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, r,
 101                                            "Failed to put socket bind allow rules into BPF map '%s'",
 102                                            sym_bpf_map__name(obj->maps.sd_bind_allow));
 103
 104         deny_map_fd = sym_bpf_map__fd(obj->maps.sd_bind_deny);
 105         assert(deny_map_fd >= 0);
 106
 107         r = update_rules_map(deny_map_fd, deny);
 108         if (r < 0)
 109                 return log_unit_full_errno(u, u ? LOG_ERR : LOG_WARNING, r,
 110                                            "Failed to put socket bind deny rules into BPF map '%s'",
 111                                            sym_bpf_map__name(obj->maps.sd_bind_deny));
 112
 113         *ret_obj = TAKE_PTR(obj);
 114         return 0;
 115 }
 116
 117 int bpf_socket_bind_supported(void) {
 118         _cleanup_(socket_bind_bpf_freep) struct socket_bind_bpf *obj = NULL;
 119         int r;
 120
 121         r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
 122         if (r < 0)
 123                 return log_debug_errno(r, "Can't determine whether the unified hierarchy is used: %m");
 124         if (r == 0) {
 125                 log_debug("Not running with unified cgroup hierarchy, BPF is not supported");
 126                 return false;
 127         }
 128
 129         if (dlopen_bpf() < 0)
 130                 return false;
 131
 132         if (!sym_bpf_probe_prog_type(BPF_PROG_TYPE_CGROUP_SOCK_ADDR, /*ifindex=*/0)) {
 133                 log_debug("BPF program type cgroup_sock_addr is not supported");
 134                 return false;
 135         }
 136
 137         r = prepare_socket_bind_bpf(/*unit=*/NULL, /*allow_rules=*/NULL, /*deny_rules=*/NULL, &obj);
 138         if (r < 0) {
 139                 log_debug_errno(r, "BPF based socket_bind is not supported: %m");
 140                 return false;
 141         }
 142
 143         return bpf_can_link_program(obj->progs.sd_bind4);
 144 }
 145
 146 int bpf_socket_bind_add_initial_link_fd(Unit *u, int fd) {
 147         int r;
 148
 149         assert(u);
 150
 151         if (!u->initial_socket_bind_link_fds) {
 152                 u->initial_socket_bind_link_fds = fdset_new();
 153                 if (!u->initial_socket_bind_link_fds)
 154                         return log_oom();
 155         }
 156
 157         r = fdset_put(u->initial_socket_bind_link_fds, fd);
 158         if (r < 0)
 159                 return log_unit_error_errno(u, r, "Failed to put socket-bind BPF link fd %d to initial fdset", fd);
 160
 161         return 0;
 162 }
 163
 164 static int socket_bind_install_impl(Unit *u) {
 165         _cleanup_(bpf_link_freep) struct bpf_link *ipv4 = NULL, *ipv6 = NULL;
 166         _cleanup_(socket_bind_bpf_freep) struct socket_bind_bpf *obj = NULL;
 167         _cleanup_free_ char *cgroup_path = NULL;
 168         _cleanup_close_ int cgroup_fd = -1;
 169         CGroupContext *cc;
 170         int r;
 171
 172         assert(u);
 173
 174         cc = unit_get_cgroup_context(u);
 175         if (!cc)
 176                 return 0;
 177
 178         r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, NULL, &cgroup_path);
 179         if (r < 0)
 180                 return log_unit_error_errno(u, r, "Failed to get cgroup path: %m");
 181
 182         if (!cc->socket_bind_allow && !cc->socket_bind_deny)
 183                 return 0;
 184
 185         r = prepare_socket_bind_bpf(u, cc->socket_bind_allow, cc->socket_bind_deny, &obj);
 186         if (r < 0)
 187                 return log_unit_error_errno(u, r, "Failed to load BPF object: %m");
 188
 189         cgroup_fd = open(cgroup_path, O_RDONLY | O_CLOEXEC, 0);
 190         if (cgroup_fd < 0)
 191                 return log_unit_error_errno(u, errno, "Failed to open cgroup=%s for reading: %m", cgroup_path);
 192
 193         ipv4 = sym_bpf_program__attach_cgroup(obj->progs.sd_bind4, cgroup_fd);
 194         r = sym_libbpf_get_error(ipv4);
 195         if (r != 0)
 196                 return log_unit_error_errno(u, r, "Failed to link '%s' cgroup-bpf program: %m",
 197                                             sym_bpf_program__name(obj->progs.sd_bind4));
 198
 199         ipv6 = sym_bpf_program__attach_cgroup(obj->progs.sd_bind6, cgroup_fd);
 200         r = sym_libbpf_get_error(ipv6);
 201         if (r != 0)
 202                 return log_unit_error_errno(u, r, "Failed to link '%s' cgroup-bpf program: %m",
 203                                             sym_bpf_program__name(obj->progs.sd_bind6));
 204
 205         u->ipv4_socket_bind_link = TAKE_PTR(ipv4);
 206         u->ipv6_socket_bind_link = TAKE_PTR(ipv6);
 207
 208         return 0;
 209 }
 210
 211 int bpf_socket_bind_install(Unit *u) {
 212         int r;
 213
 214         assert(u);
 215
 216         r = socket_bind_install_impl(u);
 217         if (r == -ENOMEM)
 218                 return r;
 219
 220         fdset_close(u->initial_socket_bind_link_fds);
 221         return r;
 222 }
 223
 224 int bpf_serialize_socket_bind(Unit *u, FILE *f, FDSet *fds) {
 225         int r;
 226
 227         assert(u);
 228
 229         r = bpf_serialize_link(f, fds, "ipv4-socket-bind-bpf-link", u->ipv4_socket_bind_link);
 230         if (r < 0)
 231                 return r;
 232
 233         return bpf_serialize_link(f, fds, "ipv6-socket-bind-bpf-link", u->ipv6_socket_bind_link);
 234 }
 235
 236 #else /* ! BPF_FRAMEWORK */
 237 int bpf_socket_bind_supported(void) {
 238         return false;
 239 }
 240
 241 int bpf_socket_bind_add_initial_link_fd(Unit *u, int fd) {
 242         return 0;
 243 }
 244
 245 int bpf_socket_bind_install(Unit *u) {
 246         return log_unit_debug_errno(u, SYNTHETIC_ERRNO(EOPNOTSUPP), "Failed to install socket bind: BPF framework is not supported");
 247 }
 248
 249 int bpf_serialize_socket_bind(Unit *u, FILE *f, FDSet *fds) {
 250         return 0;
 251 }
 252 #endif