mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/Documentation/networking
History
Ilya Maximets bc22988512 xsk: Honor SO_BINDTODEVICE on bind 
[ Upstream commit f7306acec9 ]

Initial creation of an AF_XDP socket requires CAP_NET_RAW capability. A
privileged process might create the socket and pass it to a non-privileged
process for later use. However, that process will be able to bind the socket
to any network interface. Even though it will not be able to receive any
traffic without modification of the BPF map, the situation is not ideal.

Sockets already have a mechanism that can be used to restrict what interface
they can be attached to. That is SO_BINDTODEVICE.

To change the SO_BINDTODEVICE binding the process will need CAP_NET_RAW.

Make xsk_bind() honor the SO_BINDTODEVICE in order to allow safer workflow
when non-privileged process is using AF_XDP.

The intended workflow is following:

  1. First process creates a bare socket with socket(AF_XDP, ...).
  2. First process loads the XSK program to the interface.
  3. First process adds the socket fd to a BPF map.
  4. First process ties socket fd to a particular interface using
     SO_BINDTODEVICE.
  5. First process sends socket fd to a second process.
  6. Second process allocates UMEM.
  7. Second process binds socket to the interface with bind(...).
  8. Second process sends/receives the traffic.

All the steps above are possible today if the first process is privileged
and the second one has sufficient RLIMIT_MEMLOCK and no capabilities.
However, the second process will be able to bind the socket to any interface
it wants on step 7 and send traffic from it. With the proposed change, the
second process will be able to bind the socket only to a specific interface
chosen by the first process at step 4.

Fixes: 965a990984 ("xsk: add support for bind for Rx")
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/bpf/20230703175329.3259672-1-i.maximets@ovn.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2023-07-19 16:36:47 +02:00
..
caif tty: cumulate and document tty_struct::flow* members 2021-05-13 16:57:16 +02:00
device_drivers Documentation: net/mlx5: Wrap notes in admonition blocks 2023-05-24 20:44:20 -07:00
devlink Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-04-20 16:29:51 -07:00
dsa Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
mac80211_hwsim
…
6lowpan.rst
…
6pack.rst
…
af_xdp.rst xsk: Honor SO_BINDTODEVICE on bind 2023-07-19 16:36:47 +02:00
alias.rst
…
arcnet-hardware.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
arcnet.rst Documentation: networking: arcnet: drop doubled word 2020-07-04 17:46:21 -07:00
atm.rst
…
ax25.rst Documentation: networking: ax25: drop doubled word 2020-07-04 17:46:21 -07:00
bareudp.rst Documentation: bareudp: Corrected description of bareudp module. 2020-07-28 17:53:03 -07:00
batman-adv.rst batman-adv: Fix mailing list address 2023-01-21 19:01:59 +01:00
bonding.rst Documentation: bonding: fix the doc of peer_notif_delay 2023-05-10 09:27:20 +01:00
bridge.rst docs: networking: Fix bridge documentation URL 2023-01-25 22:44:27 -08:00
can.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
can_ucan_protocol.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
cdc_mbim.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
checksum-offloads.rst docs: networking: convert netdev-features.txt to ReST 2020-04-30 12:56:36 -07:00
dccp.rst net: dccp: Add SIOCOUTQ IOCTL support (send buffer fill) 2020-07-22 17:00:37 -07:00
dctcp.rst
…
dns_resolver.rst
…
driver.rst net: docs: update the sample code in driver.rst 2023-04-13 13:30:21 +02:00
eql.rst
…
ethtool-netlink.rst net: ethtool: coalesce: try to make user settings stick twice 2023-04-24 18:09:49 -07:00
failover.rst
…
fib_trie.rst
…
filter.rst treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
gen_stats.rst
…
generic-hdlc.rst
…
generic_netlink.rst Documentation: networking: Update generic_netlink_howto URL 2022-11-23 17:25:02 -08:00
gtp.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
ieee802154.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
ila.rst
…
index.rst docs: networking: fix x25-iface.rst heading & index order 2023-05-10 10:31:46 +01:00
ioam6-sysctl.rst ipv6: ioam: Documentation for new IOAM sysctls 2021-07-21 08:14:33 -07:00
ip-sysctl.rst net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294 2023-06-02 09:55:22 +01:00
ip_dynaddr.rst
…
ipddp.rst
…
ipsec.rst
…
ipv6.rst
…
ipvlan.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
ipvs-sysctl.rst ipvs: run_estimation should control the kthread tasks 2022-12-10 22:44:43 +01:00
j1939.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
kapi.rst wimax: move out to staging 2020-10-29 19:27:45 +01:00
kcm.rst docs: networking: convert kcm.txt to ReST 2020-04-28 14:40:19 -07:00
l2tp.rst Documentation: networking: correct possessive "its" 2022-08-31 12:36:08 -07:00
lapb-module.rst docs: networking: convert lapb-module.txt to ReST 2020-04-30 12:56:35 -07:00
mac80211-auth-assoc-deauth.txt
…
mac80211-injection.rst doc: networking: wireless: fix wiki website url 2020-06-08 10:05:53 +02:00
mctp.rst mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control 2022-02-09 12:00:11 +00:00
mpls-sysctl.rst docs: networking: convert mpls-sysctl.txt to ReST 2020-04-30 12:56:36 -07:00
mptcp-sysctl.rst Documentation: mptcp: fix pm_type formatting 2022-09-13 10:18:44 +02:00
msg_zerocopy.rst docs: net: fix inaccuracies in msg_zerocopy.rst 2023-02-24 18:31:31 -08:00
multiqueue.rst docs: networking: convert multiqueue.txt to ReST 2020-04-30 12:56:36 -07:00
napi.rst docs: networking: document NAPI 2023-03-23 19:47:40 -07:00
net_dim.rst
…
net_failover.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
netconsole.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
netdev-features.rst net: hsr: add offloading support 2021-02-11 13:24:44 -08:00
netdevices.rst net: bonding: move ioctl handling to private ndo operation 2021-07-27 20:11:45 +01:00
netfilter-sysctl.rst docs: networking: convert netfilter-sysctl.txt to ReST 2020-04-30 12:56:36 -07:00
netif-msg.rst docs: networking: convert netif-msg.txt to ReST 2020-04-30 12:56:36 -07:00
nexthop-group-resilient.rst Documentation: net: Document resilient next-hop groups 2021-03-29 13:51:38 -07:00
nf_conntrack-sysctl.rst netfilter: conntrack: unify established states for SCTP paths 2023-01-24 09:52:52 +01:00
nf_flowtable.rst docs: nf_flowtable: fix compilation and warnings 2021-03-25 17:42:02 -07:00
nfc.rst
…
openvswitch.rst docs: networking: convert openvswitch.txt to ReST 2020-04-30 12:56:36 -07:00
operstates.rst docs: operstates: document IF_OPER_TESTING 2021-08-02 15:16:04 +01:00
packet_mmap.rst docs: networking: Replace strncpy() with strscpy() 2021-06-04 11:21:43 -06:00
page_pool.rst page_pool: allow caching from safely localized NAPI 2023-04-14 18:56:12 -07:00
phonet.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
phy.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
pktgen.rst pktgen: document the latest pktgen usage options 2021-08-25 13:44:30 +01:00
plip.rst docs: networking: convert PLIP.txt to ReST 2020-04-30 12:56:37 -07:00
ppp_generic.rst docs: update ppp_generic.rst to document new ioctls 2020-12-10 13:57:36 -08:00
proc_net_tcp.rst docs: networking: convert proc_net_tcp.txt to ReST 2020-04-30 12:56:37 -07:00
radiotap-headers.rst docs: networking: convert radiotap-headers.txt to ReST 2020-04-30 12:56:37 -07:00
rds.rst Doc: networking: Fix the title's Sphinx overline in rds.rst 2021-11-29 15:18:21 -07:00
regulatory.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
representors.rst docs: net: add an explanation of VF (and other) Representors 2022-09-21 07:31:38 -07:00
rxrpc.rst rxrpc: Fix potential race in error handling in afs_make_call() 2023-04-22 15:16:39 +01:00
scaling.rst docs: networking: update XPS to account for netif_set_xps_queue 2020-10-13 16:21:54 -07:00
sctp.rst docs: networking: convert sctp.txt to ReST 2020-04-30 12:56:38 -07:00
secid.rst docs: networking: convert secid.txt to ReST 2020-04-30 12:56:38 -07:00
seg6-sysctl.rst doc: move seg6_flowlabel to seg6-sysctl.rst 2021-04-14 13:13:15 -07:00
segmentation-offloads.rst
…
sfp-phylink.rst doc: sfp-phylink: Fix a broken reference 2022-08-02 21:45:07 -07:00
skbuff.rst skbuff: render the checksum comment to documentation 2022-05-10 17:48:37 -07:00
smc-sysctl.rst net/smc: Unbind r/w buffer size from clcsock and make them tunable 2022-09-22 12:58:21 +02:00
snmp_counter.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
statistics.rst docs: ethtool-netlink: document interface for MAC Merge layer 2023-01-23 12:44:18 +00:00
strparser.rst docs: networking: convert strparser.txt to ReST 2020-04-30 12:56:38 -07:00
switchdev.rst docs: net: add an explanation of VF (and other) Representors 2022-09-21 07:31:38 -07:00
sysfs-tagging.rst Documentation: networking: correct spelling 2023-01-31 13:00:47 +01:00
tc-actions-env-rules.rst docs: networking: convert tc-actions-env-rules.txt to ReST 2020-04-30 12:56:38 -07:00
tc-queue-filters.rst Documentation: networking: TC queue based filtering 2022-10-25 10:32:40 +02:00
tcp-thin.rst docs: networking: convert tcp-thin.txt to ReST 2020-04-30 12:56:38 -07:00
team.rst docs: networking: convert team.txt to ReST 2020-04-30 12:56:38 -07:00
timestamping.rst net_tstamp: add SOF_TIMESTAMPING_OPT_ID_TCP 2022-12-08 19:49:21 -08:00
tipc.rst Documentation: add more details in tipc.rst 2021-07-01 13:18:18 -07:00
tls-handshake.rst net/handshake: Enable the SNI extension to work properly 2023-05-24 22:05:24 -07:00
tls-offload-layers.svg
…
tls-offload-reorder-bad.svg
…
tls-offload-reorder-good.svg
…
tls-offload.rst net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled 2021-01-19 15:58:05 -08:00
tls.rst tls: rx: add counter for NoPad violations 2022-07-11 19:48:33 -07:00
tproxy.rst docs: networking: convert tproxy.txt to ReST 2020-04-30 12:56:38 -07:00
tuntap.rst docs: networking: Replace strncpy() with strscpy() 2021-06-04 11:21:43 -06:00
udplite.rst docs: networking: convert udplite.txt to ReST 2020-05-01 12:24:40 -07:00
vrf.rst doc: Document unexpected tcp_l3mdev_accept=1 behavior 2021-08-23 11:53:24 +01:00
vxlan.rst docs: vxlan: add info about device features 2020-09-28 12:50:12 -07:00
x25-iface.rst docs: networking: fix x25-iface.rst heading & index order 2023-05-10 10:31:46 +01:00
x25.rst net: x25: Remove unimplemented X.25-over-LLC code stubs 2020-12-12 17:15:33 -08:00
xdp-rx-metadata.rst xdp: bpf_xdp_metadata use EOPNOTSUPP for no driver support 2023-03-22 09:11:09 -07:00
xfrm_device.rst xfrm: extend add state callback to set failure reason 2023-01-26 16:28:48 -08:00
xfrm_proc.rst docs: networking: convert xfrm_proc.txt to ReST 2020-05-01 12:24:40 -07:00
xfrm_sync.rst docs: networking: convert xfrm_sync.txt to ReST 2020-05-01 12:24:41 -07:00
xfrm_sysctl.rst docs: networking: convert xfrm_sysctl.txt to ReST 2020-05-01 12:24:41 -07:00