Skip to content

KFunc bpf_ksock_send

v7.3

Send data through a BPF kernel socket.

Definition

Sends data on a connected BPF kernel socket. Sending is best-effort and non-blocking (MSG_DONTWAIT), if the data can't be sent immediately an error is returned instead of waiting.

The data is sent via the same code path as a sendmsg(2) call made by the current task, so the socket_sendmsg LSM hook is invoked like it would be for a userspace socket.

ks: The BPF kernel socket context. Must be an acquired reference, see bpf_ksock_acquire.

data: Pointer to the data to send.

data__sz: Size of the data to send.

Returns

Returns the number of bytes sent on success, or a negative error code on failure:

  • -EOPNOTSUPP: Not called from the context of a user task, for example from a BPF work-queue callback or a kernel thread.
  • -EAGAIN: The data can't be sent without blocking, for example because the send buffer is full.
  • -EDESTADDRREQ: The socket has not been connected with bpf_ksock_connect.
  • Any other error returned by the send operation, for example when an LSM denies the send or the data is too large to fit in a single datagram (-EMSGSIZE).

Signature

int bpf_ksock_send(struct bpf_ksock *ks, const void *data, u32 data__sz)

Note

This function may sleep, and therefore can only be used from sleepable programs.

Usage

This kfunc is used to send data, such as telemetry or security alerts, over a BPF kernel socket previously created with bpf_ksock_create and connected with bpf_ksock_connect. The main use case is to allow LSM programs to emit events over the network without depending on a userspace agent to read them from a ring buffer and forward them.

Typically, the socket is stored in a map as a kptr by a syscall program. The LSM program then acquires a reference with bpf_ksock_acquire, sends the data and releases the reference with bpf_ksock_release.

Since this kfunc may sleep, LSM programs must be loaded as sleepable (SEC("lsm.s/...")) to use it.

Warning

This kfunc can't be used by LSM programs attached to the socket_sendmsg hook, since this kfunc invokes that hook itself, which could cause infinite recursion. The verifier rejects such programs with the message calling kernel function bpf_ksock_send is not allowed. This restriction also applies to bpf_ksock_acquire and bpf_ksock_release.

Program types

The following program types can make use of this kfunc:

Example

See bpf_ksock_create for an example.