sk-filter: Add ability to get socket filter program (v2)
Subsystems (15)
PATCH 1/1 sk-filter: Add ability to get socket filter program (v2)
The SO_ATTACH_FILTER option is set only. I propose to add the get ability by using SO_ATTACH_FILTER in getsockopt. To be less irritating to eyes the SO_GET_FILTER alias to it is declared. This ability is required by checkpoint-restore project to be able to save full state of a socket.
There are two issues with getting filter back.
First, kernel modifies the sock_filter->code on filter load, thus in order to return the filter element back to user we have to decode it into user-visible constants. Fortunately the modification in question is interconvertible.
Second, the BPF_S_ALU_DIV_K code modifies the command argument k to speed up the run-time division by doing kernel_k = reciprocal(user_k). Bad news is that different user_k may result in same kernel_k, so we can't get the original user_k back. Good news is that we don't have to do it. What we need to is calculate a user2_k so, that
reciprocal(user2_k) == reciprocal(user_k) == kernel_k
i.e. if it's re-loaded back the compiled again value will be exactly the same as it was. That said, the user2_k can be calculated like this
user2_k = reciprocal(kernel_k)
with an exception, that if kernel_k == 0, then user2_k == 1.
The optlen argument is treated like this -- when zero, kernel returns the amount of sock_fprog elements in filter, otherwise it should be large enough for the sock_fprog array.
changes since v1:
* Declared SO_GET_FILTER in all arch headers
* Added decode of vlan-tag codes
---
arch/alpha/include/asm/socket.h +1 -0
@@ -47,6 +47,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/avr32/include/uapi/asm/socket.h +1 -0
@@ -40,6 +40,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/cris/include/asm/socket.h +1 -0
@@ -42,6 +42,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/frv/include/uapi/asm/socket.h +1 -0
@@ -40,6 +40,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/h8300/include/asm/socket.h +1 -0
@@ -40,6 +40,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/ia64/include/uapi/asm/socket.h +1 -0
@@ -49,6 +49,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/m32r/include/asm/socket.h +1 -0
@@ -40,6 +40,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/m68k/include/asm/socket.h +1 -0
@@ -40,6 +40,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/mips/include/uapi/asm/socket.h +1 -0
@@ -63,6 +63,7 @@ To add: #define SO_REUSEPORT 0x0200 /* Allow local address and port reuse. *//* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/mn10300/include/uapi/asm/socket.h +1 -0
@@ -40,6 +40,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/parisc/include/asm/socket.h +1 -0
@@ -48,6 +48,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 0x401a#define SO_DETACH_FILTER 0x401b +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_ACCEPTCONN 0x401c
arch/powerpc/include/uapi/asm/socket.h +1 -0
@@ -47,6 +47,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/s390/include/uapi/asm/socket.h +1 -0
@@ -46,6 +46,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
arch/sparc/include/uapi/asm/socket.h +1 -0
@@ -41,6 +41,7 @@#define SO_ATTACH_FILTER 0x001a#define SO_DETACH_FILTER 0x001b +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 0x001c#define SO_TIMESTAMP 0x001d
arch/xtensa/include/asm/socket.h +1 -0
@@ -52,6 +52,7 @@#define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
include/linux/filter.h +1 -0
@@ -45,6 +45,7 @@ extern void sk_unattached_filter_destroy(struct sk_filter *fp);extern int sk_attach_filter (struct sock_fprog *fprog,struct sock *sk);extern int sk_detach_filter (struct sock *sk);extern int sk_chk_filter (struct sock_filter *filter,unsigned int flen); +extern int sk_get_filter (struct sock *sk,struct sock_filter __user *filter,unsigned len);#ifdef CONFIG_BPF_JIT extern void bpf_jit_compile (struct sk_filter *fp);
include/uapi/asm-generic/socket.h +1 -0
@@ -43,6 +43,7 @@/* Socket filtering */ #define SO_ATTACH_FILTER 26#define SO_DETACH_FILTER 27 +#define SO_GET_FILTER SO_ATTACH_FILTER#define SO_PEERNAME 28#define SO_TIMESTAMP 29
net/core/filter.c +130 -0
133 lines not on this page · raw message
net/core/sock.c +6 -0
@@ -1077,6 +1077,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,case SO_BINDTODEVICE : v.val = sk->sk_bound_dev_if;break ; +case SO_GET_FILTER : + len =sk_get_filter (sk, (struct sock_filter __user *)optval, len); +if (len <0 ) +return len; + + goto lenout;default :return -ENOPROTOOPT ; }
From: Pavel Emelyanov <[email protected]>
Date: Thu, 01 Nov 2012 16:01:48 +0400
Quoted 34 lines
The
SO_ATTACH_FILTERoption is set only. I propose to add the get ability by usingSO_ATTACH_FILTERin getsockopt. To be less irritating to eyes theSO_GET_FILTERalias to it is declared. This ability is required by checkpoint-restore project to be able to save full state of a socket.There are two issues with getting filter back.
First, kernel modifies the
sock_filter->codeon filter load, thus in order to return the filter element back to user we have to decode it into user-visible constants. Fortunately the modification in question is interconvertible.Second, the
BPF_S_ALU_DIV_Kcode modifies the command argument k to speed up the run-time division by doingkernel_k=reciprocal(user_k). Bad news is that differentuser_kmay result in samekernel_k, so we can't get the originaluser_kback. Good news is that we don't have to do it. What we need to is calculate auser2_kso, that
reciprocal(user2_k)==reciprocal(user_k)==kernel_ki.e. if it's re-loaded back the compiled again value will be exactly the same as it was. That said, the
user2_kcan be calculated like this
user2_k=reciprocal(kernel_k)with an exception, that if
kernel_k== 0, thenuser2_k== 1.The optlen argument is treated like this -- when zero, kernel returns the amount of
sock_fprogelements in filter, otherwise it should be large enough for thesock_fprogarray.
Quoted 5 lines
changes since v1:
* DeclaredSO_GET_FILTERin all arch headers
* Added decode of vlan-tag codesSigned-off-by Pavel Emelyanov <[email protected]>
Applied, thanks.