[RFC bpf-next v5] bpf: Force to MPTCP
Paul Moore
paul at paul-moore.com
Tue Jul 18 16:14:38 UTC 2023
On Tue, Jul 18, 2023 at 11:21 AM Geliang Tang <geliang.tang at suse.com> wrote:
>
> As is described in the "How to use MPTCP?" section in MPTCP wiki [1]:
>
> "Your app can create sockets with IPPROTO_MPTCP as the proto:
> ( socket(AF_INET, SOCK_STREAM, IPPROTO_MPTCP); ). Legacy apps can be
> forced to create and use MPTCP sockets instead of TCP ones via the
> mptcpize command bundled with the mptcpd daemon."
>
> But the mptcpize (LD_PRELOAD technique) command has some limitations
> [2]:
>
> - it doesn't work if the application is not using libc (e.g. GoLang
> apps)
> - in some envs, it might not be easy to set env vars / change the way
> apps are launched, e.g. on Android
> - mptcpize needs to be launched with all apps that want MPTCP: we could
> have more control from BPF to enable MPTCP only for some apps or all the
> ones of a netns or a cgroup, etc.
> - it is not in BPF, we cannot talk about it at netdev conf.
>
> So this patchset attempts to use BPF to implement functions similer to
> mptcpize.
>
> The main idea is add a hook in sys_socket() to change the protocol id
> from IPPROTO_TCP (or 0) to IPPROTO_MPTCP.
>
> [1]
> https://github.com/multipath-tcp/mptcp_net-next/wiki
> [2]
> https://github.com/multipath-tcp/mptcp_net-next/issues/79
>
> v5:
> - add bpf_mptcpify helper.
>
> v4:
> - use lsm_cgroup/socket_create
>
> v3:
> - patch 8: char cmd[128]; -> char cmd[256];
>
> v2:
> - Fix build selftests errors reported by CI
>
> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/79
> Signed-off-by: Geliang Tang <geliang.tang at suse.com>
> ---
> include/linux/bpf.h | 1 +
> include/linux/lsm_hook_defs.h | 2 +-
> include/linux/security.h | 6 +-
> include/uapi/linux/bpf.h | 7 +
> kernel/bpf/bpf_lsm.c | 2 +
> net/mptcp/bpf.c | 20 +++
> net/socket.c | 4 +-
> security/apparmor/lsm.c | 8 +-
> security/security.c | 2 +-
> security/selinux/hooks.c | 6 +-
> tools/include/uapi/linux/bpf.h | 7 +
> .../testing/selftests/bpf/prog_tests/mptcp.c | 128 ++++++++++++++++--
> tools/testing/selftests/bpf/progs/mptcpify.c | 17 +++
> 13 files changed, 187 insertions(+), 23 deletions(-)
> create mode 100644 tools/testing/selftests/bpf/progs/mptcpify.c
...
> diff --git a/security/security.c b/security/security.c
> index b720424ca37d..bbebcddce420 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -4078,7 +4078,7 @@ EXPORT_SYMBOL(security_unix_may_send);
> *
> * Return: Returns 0 if permission is granted.
> */
> -int security_socket_create(int family, int type, int protocol, int kern)
> +int security_socket_create(int *family, int *type, int *protocol, int kern)
> {
> return call_int_hook(socket_create, 0, family, type, protocol, kern);
> }
Using the LSM to change the protocol family is not something we want
to allow. I'm sorry, but you will need to take a different approach.
--
paul-moore.com
More information about the Linux-security-module-archive
mailing list