5.10 LTS - Request for inclusion of getsockopt(SO_NETNS_COOKIE)

5.10 LTS - Request for inclusion of getsockopt(SO_NETNS_COOKIE)

[Maciej Żenczykowski]

Could we please get:
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e8b9eab99232c4e62ada9d7976c80fd5e8118289
  'net: retrieve netns cookie via getsocketopt'

included in 5.10 LTS.

This is technically a feature, but it's absolutely trivial - it just
adds a new getsockopt to fetch a u64.
Using netns cookies from bpf without it is pretty annoying.

It doesn't cherrypick to 5.10 cleanly, due to trivial conflicts in
header files (previous constants haven't yet been defined),
and because of a post 5.10 change from atomic64_t to u64 - which
requires adding in an atomic_read(&).

I've uploaded a compiling version to:
  https://android-review.googlesource.com/c/kernel/common/+/2503056
I think you should be able to cherrypick it via:
  git fetch https://android.googlesource.com/kernel/common
refs/changes/56/2503056/2 && git cherry-pick FETCH_HEAD

Thanks!

Maciej Żenczykowski, Kernel Networking Developer @ Google

Re: 5.10 LTS - Request for inclusion of getsockopt(SO_NETNS_COOKIE)

[Greg Kroah-Hartman]

On Wed, Mar 22, 2023 at 12:17:55PM -0700, Maciej Żenczykowski wrote:
> Could we please get:
>   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e8b9eab99232c4e62ada9d7976c80fd5e8118289
>   'net: retrieve netns cookie via getsocketopt'
> 
> included in 5.10 LTS.
> 
> This is technically a feature, but it's absolutely trivial - it just
> adds a new getsockopt to fetch a u64.
> Using netns cookies from bpf without it is pretty annoying.

This really is a new feature, why not just move to a new kernel version
instead if you really need this?

> It doesn't cherrypick to 5.10 cleanly, due to trivial conflicts in
> header files (previous constants haven't yet been defined),
> and because of a post 5.10 change from atomic64_t to u64 - which
> requires adding in an atomic_read(&).
> 
> I've uploaded a compiling version to:
>   https://android-review.googlesource.com/c/kernel/common/+/2503056
> I think you should be able to cherrypick it via:
>   git fetch https://android.googlesource.com/kernel/common
> refs/changes/56/2503056/2 && git cherry-pick FETCH_HEAD

Please always submit a working backport here, we can't use random git
commands for this type of thing, sorry.  That way we can all properly
review it and verify that you sent what you want us to apply.

thanks,

greg k-h

[PATCH] net: retrieve netns cookie via getsocketopt

[Maciej Żenczykowski]

From: Martynas Pumputis <m@lambda.lt>

It's getting more common to run nested container environments for
testing cloud software. One of such examples is Kind [1] which runs a
Kubernetes cluster in Docker containers on a single host. Each container
acts as a Kubernetes node, and thus can run any Pod (aka container)
inside the former. This approach simplifies testing a lot, as it
eliminates complicated VM setups.

Unfortunately, such a setup breaks some functionality when cgroupv2 BPF
programs are used for load-balancing. The load-balancer BPF program
needs to detect whether a request originates from the host netns or a
container netns in order to allow some access, e.g. to a service via a
loopback IP address. Typically, the programs detect this by comparing
netns cookies with the one of the init ns via a call to
bpf_get_netns_cookie(NULL). However, in nested environments the latter
cannot be used given the Kubernetes node's netns is outside the init ns.
To fix this, we need to pass the Kubernetes node netns cookie to the
program in a different way: by extending getsockopt() with a
SO_NETNS_COOKIE option, the orchestrator which runs in the Kubernetes
node netns can retrieve the cookie and pass it to the program instead.

Thus, this is following up on Eric's commit 3d368ab87cf6 ("net:
initialize net->net_cookie at netns setup") to allow retrieval via
SO_NETNS_COOKIE.  This is also in line in how we retrieve socket cookie
via SO_COOKIE.

  [1] https://kind.sigs.k8s.io/

Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Martynas Pumputis <m@lambda.lt>
Cc: Eric Dumazet <edumazet@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit e8b9eab99232c4e62ada9d7976c80fd5e8118289)
---
 arch/alpha/include/uapi/asm/socket.h  | 2 ++
 arch/mips/include/uapi/asm/socket.h   | 2 ++
 arch/parisc/include/uapi/asm/socket.h | 2 ++
 arch/sparc/include/uapi/asm/socket.h  | 2 ++
 include/uapi/asm-generic/socket.h     | 2 ++
 net/core/sock.c                       | 7 +++++++
 6 files changed, 17 insertions(+)

diff --git a/arch/alpha/include/uapi/asm/socket.h b/arch/alpha/include/uapi/asm/socket.h
index de6c4df61082..d033d3f92d6d 100644
--- a/arch/alpha/include/uapi/asm/socket.h
+++ b/arch/alpha/include/uapi/asm/socket.h
@@ -124,6 +124,8 @@
 
 #define SO_DETACH_REUSEPORT_BPF 68
 
+#define SO_NETNS_COOKIE		71
+
 #if !defined(__KERNEL__)
 
 #if __BITS_PER_LONG == 64
diff --git a/arch/mips/include/uapi/asm/socket.h b/arch/mips/include/uapi/asm/socket.h
index d0a9ed2ca2d6..ff3ab771e769 100644
--- a/arch/mips/include/uapi/asm/socket.h
+++ b/arch/mips/include/uapi/asm/socket.h
@@ -135,6 +135,8 @@
 
 #define SO_DETACH_REUSEPORT_BPF 68
 
+#define SO_NETNS_COOKIE		71
+
 #if !defined(__KERNEL__)
 
 #if __BITS_PER_LONG == 64
diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
index 10173c32195e..1a8ec3838c9b 100644
--- a/arch/parisc/include/uapi/asm/socket.h
+++ b/arch/parisc/include/uapi/asm/socket.h
@@ -116,6 +116,8 @@
 
 #define SO_DETACH_REUSEPORT_BPF 0x4042
 
+#define SO_NETNS_COOKIE		0x4045
+
 #if !defined(__KERNEL__)
 
 #if __BITS_PER_LONG == 64
diff --git a/arch/sparc/include/uapi/asm/socket.h b/arch/sparc/include/uapi/asm/socket.h
index 8029b681fc7c..08f9bbbf5bf2 100644
--- a/arch/sparc/include/uapi/asm/socket.h
+++ b/arch/sparc/include/uapi/asm/socket.h
@@ -117,6 +117,8 @@
 
 #define SO_DETACH_REUSEPORT_BPF  0x0047
 
+#define SO_NETNS_COOKIE          0x0050
+
 #if !defined(__KERNEL__)
 
 
diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
index 77f7c1638eb1..645606824258 100644
--- a/include/uapi/asm-generic/socket.h
+++ b/include/uapi/asm-generic/socket.h
@@ -119,6 +119,8 @@
 
 #define SO_DETACH_REUSEPORT_BPF 68
 
+#define SO_NETNS_COOKIE		71
+
 #if !defined(__KERNEL__)
 
 #if __BITS_PER_LONG == 64 || (defined(__x86_64__) && defined(__ILP32__))
diff --git a/net/core/sock.c b/net/core/sock.c
index 0506590b016b..64e2f9fb6552 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1613,6 +1613,13 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
 		v.val = sk->sk_bound_dev_if;
 		break;
 
+	case SO_NETNS_COOKIE:
+		lv = sizeof(u64);
+		if (len != lv)
+			return -EINVAL;
+		v.val64 = atomic64_read(&sock_net(sk)->net_cookie);
+		break;
+
 	default:
 		/* We implement the SO_SNDLOWAT etc to not be settable
 		 * (1003.1g 7).
-- 
2.40.0.rc1.284.g88254d51c5-goog

Re: 5.10 LTS - Request for inclusion of getsockopt(SO_NETNS_COOKIE)

[Maciej Żenczykowski]

On Wed, Mar 22, 2023 at 12:22 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> This really is a new feature, why not just move to a new kernel version
> instead if you really need this?

Oh, come on, I *know* you know the answer to this question.

How's your effort to get device vendors/oems to use newer (major)
kernels on their devices going?
Cause I was just recently *forced* into supporting 4.9 for another
couple years...
It's hard enough to get people to take stable version updates in a
reasonable timeframe.

We either need to get this in via 5.10 LTS, or it goes in via Android
Common Kernel...
going in via LTS always seems preferable to me, since it benefits the
wider community.

> Please always submit a working backport here, we can't use random git
> commands for this type of thing, sorry.  That way we can all properly
> review it and verify that you sent what you want us to apply.

Done.

Re: 5.10 LTS - Request for inclusion of getsockopt(SO_NETNS_COOKIE)

[Greg Kroah-Hartman]

On Wed, Mar 22, 2023 at 12:37:15PM -0700, Maciej Żenczykowski wrote:
> On Wed, Mar 22, 2023 at 12:22 PM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> > This really is a new feature, why not just move to a new kernel version
> > instead if you really need this?
> 
> Oh, come on, I *know* you know the answer to this question.
> 
> How's your effort to get device vendors/oems to use newer (major)
> kernels on their devices going?

Actually really well, with the new EU regulations and the reduced amount
of support time for LTS kernels, new devices will soon be forced to
update to move to newer kernel versions during the lifetime of the
device.

> Cause I was just recently *forced* into supporting 4.9 for another
> couple years...
> It's hard enough to get people to take stable version updates in a
> reasonable timeframe.
> 
> We either need to get this in via 5.10 LTS, or it goes in via Android
> Common Kernel...
> going in via LTS always seems preferable to me, since it benefits the
> wider community.

You are adding a new feature, we can't add that to stable kernels,
sorry.  Just stick this in your device-specific kernel please.

thanks,

greg k-h