inpcb: Allow SO_REUSEPORT_LB to be used in jails
ClosedPublic
Actions

Authored by markj on Oct 17 2022, 8:39 PM.

Details

Reviewers

Group Reviewers

Commits

rG535984471641: inpcb: Allow SO_REUSEPORT_LB to be used in jails
rGd93ec8cb1324: inpcb: Allow SO_REUSEPORT_LB to be used in jails

Summary

Currently SO_REUSEPORT_LB silently does nothing when set by a jailed
process. It is trivial to support this option in VNET jails, but it's
also useful in traditional jails where the semantics are not quite
clear.

This patch enables LB groups in jails with the following semantics:

- all PCBs in a group must belong to the same jail
- PCB lookup prefers jailed groups to non-jailed groups, exactly how
we handle individual sockets

One pre-existing quirk of lbgroups is that they are matched before
jailed sockets. This seems like a (minor?) bug to me, but that
behaviour is preserved with this change.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

markj created this revision.Oct 17 2022, 8:39 PM

Herald added subscribers: glebius, melifaro, ae, imp. · View Herald TranscriptOct 17 2022, 8:39 PM

markj requested review of this revision.Oct 17 2022, 8:39 PM

Harbormaster completed remote builds in B47866: Diff 111876.Oct 17 2022, 8:39 PM

markj added a parent revision: D37028: in6: Consolidate IN6_ARE_ADDR_EQUAL definitions.Oct 17 2022, 8:40 PM

zlei added a subscriber: zlei.Oct 18 2022, 1:34 AM

Didn't do a thorough review, but overall looks good. Thanks!

sys/netinet/in_pcb.c
261	Why is this M_NOWAIT spread around the LB group code? This all happens in context of setsockopt(2), doesn't it?

This revision is now accepted and ready to land.Oct 18 2022, 4:36 AM

markj added inline comments.Oct 18 2022, 1:40 PM

sys/netinet/in_pcb.c
261	No, it's a bit weird. It happens when binding the socket. First you set the SO_REUSEPORT_LB option, then bind. All sockets with SO_REUSEPORT_LB which bind to the same port are added to the same LB group. Here, the inpcb and hash table are locked, so we can't allocate anything with M_WAITOK. I don't like it, I agree that we should be using M_WAITOK here but I haven't thought about how to fix it.