[PATCH net-next 0/2] BPF update

[PATCH net-next 0/2] BPF update

[Daniel Borkmann]

This small helper allows for accessing net_cls cgroups classid. Please
see individual patches for more details.

Thanks!

Daniel Borkmann (2):
  cls_cgroup: factor out classid retrieval
  ebpf: add helper to retrieve net_cls cgroup id

 include/net/cls_cgroup.h | 29 +++++++++++++++++++++++++++++
 include/uapi/linux/bpf.h |  7 +++++++
 net/core/filter.c        | 15 +++++++++++++++
 net/sched/cls_cgroup.c   | 23 ++---------------------
 4 files changed, 53 insertions(+), 21 deletions(-)

-- 
1.9.3

[PATCH net-next 1/2] cls_cgroup: factor out classid retrieval

[Daniel Borkmann]

Split out retrieving the cgroups net_cls classid retrieval into its
own function, so that it can be reused later on from other parts of
the traffic control subsystem. If there's no skb->sk, then the small
helper returns 0 as well, which in cls_cgroup terms means 'could not
classify'.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Thomas Graf <tgraf@suug.ch>
---
 include/net/cls_cgroup.h | 29 +++++++++++++++++++++++++++++
 net/sched/cls_cgroup.c   | 23 ++---------------------
 2 files changed, 31 insertions(+), 21 deletions(-)

diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
index c15d394..e85a22d 100644
--- a/include/net/cls_cgroup.h
+++ b/include/net/cls_cgroup.h
@@ -49,9 +49,38 @@ static inline void sock_update_classid(struct sock *sk)
 	if (classid != sk->sk_classid)
 		sk->sk_classid = classid;
 }
+
+static inline u32 task_get_classid(const struct sk_buff *skb)
+{
+	u32 classid = task_cls_state(current)->classid;
+
+	/* Due to the nature of the classifier it is required to ignore all
+	 * packets originating from softirq context as accessing `current'
+	 * would lead to false results.
+	 *
+	 * This test assumes that all callers of dev_queue_xmit() explicitly
+	 * disable bh. Knowing this, it is possible to detect softirq based
+	 * calls by looking at the number of nested bh disable calls because
+	 * softirqs always disables bh.
+	 */
+	if (in_serving_softirq()) {
+		/* If there is an sk_classid we'll use that. */
+		if (!skb->sk)
+			return 0;
+
+		classid = skb->sk->sk_classid;
+	}
+
+	return classid;
+}
 #else /* !CONFIG_CGROUP_NET_CLASSID */
 static inline void sock_update_classid(struct sock *sk)
 {
 }
+
+static inline u32 task_get_classid(const struct sk_buff *skb)
+{
+	return 0;
+}
 #endif /* CONFIG_CGROUP_NET_CLASSID */
 #endif  /* _NET_CLS_CGROUP_H */
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index ea611b21..4c85bd3 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -30,35 +30,16 @@ static int cls_cgroup_classify(struct sk_buff *skb, const struct tcf_proto *tp,
 			       struct tcf_result *res)
 {
 	struct cls_cgroup_head *head = rcu_dereference_bh(tp->root);
-	u32 classid;
-
-	classid = task_cls_state(current)->classid;
-
-	/*
-	 * Due to the nature of the classifier it is required to ignore all
-	 * packets originating from softirq context as accessing `current'
-	 * would lead to false results.
-	 *
-	 * This test assumes that all callers of dev_queue_xmit() explicitely
-	 * disable bh. Knowing this, it is possible to detect softirq based
-	 * calls by looking at the number of nested bh disable calls because
-	 * softirqs always disables bh.
-	 */
-	if (in_serving_softirq()) {
-		/* If there is an sk_classid we'll use that. */
-		if (!skb->sk)
-			return -1;
-		classid = skb->sk->sk_classid;
-	}
+	u32 classid = task_get_classid(skb);
 
 	if (!classid)
 		return -1;
-
 	if (!tcf_em_tree_match(skb, &head->ematches, NULL))
 		return -1;
 
 	res->classid = classid;
 	res->class = 0;
+
 	return tcf_exts_exec(skb, &head->exts, res);
 }
 
-- 
1.9.3

[PATCH net-next 2/2] ebpf: add helper to retrieve net_cls's classid cookie

[Daniel Borkmann]

It would be very useful to retrieve the net_cls's classid from an eBPF
program to allow for a more fine-grained classification, it could be
directly used or in conjunction with additional policies. I.e. docker,
but also tooling such as cgexec, can easily run applications via net_cls
cgroups:

  cgcreate -g net_cls:/foo
  echo 42 > foo/net_cls.classid
  cgexec -g net_cls:foo <prog>

Thus, their respecitve classid cookie of foo can then be looked up on
the egress path to apply further policies. The helper is desigend such
that a non-zero value returns the cgroup id.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Thomas Graf <tgraf@suug.ch>
---
 include/uapi/linux/bpf.h |  7 +++++++
 net/core/filter.c        | 15 +++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 29ef6f9..2de87e5 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -249,6 +249,13 @@ enum bpf_func_id {
 	 * Return: 0 on success
 	 */
 	BPF_FUNC_get_current_comm,
+
+	/**
+	 * bpf_get_cgroup_classid(skb) - retrieve a proc's classid
+	 * @skb: pointer to skb
+	 * Return: classid if != 0
+	 */
+	BPF_FUNC_get_cgroup_classid,
 	__BPF_FUNC_MAX_ID,
 };
 
diff --git a/net/core/filter.c b/net/core/filter.c
index be3098f..247450a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -47,6 +47,7 @@
 #include <linux/if_vlan.h>
 #include <linux/bpf.h>
 #include <net/sch_generic.h>
+#include <net/cls_cgroup.h>
 
 /**
  *	sk_filter - run a packet through a socket filter
@@ -1424,6 +1425,18 @@ const struct bpf_func_proto bpf_clone_redirect_proto = {
 	.arg3_type      = ARG_ANYTHING,
 };
 
+static u64 bpf_get_cgroup_classid(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
+{
+	return task_get_classid((struct sk_buff *) (unsigned long) r1);
+}
+
+static const struct bpf_func_proto bpf_get_cgroup_classid_proto = {
+	.func           = bpf_get_cgroup_classid,
+	.gpl_only       = false,
+	.ret_type       = RET_INTEGER,
+	.arg1_type      = ARG_PTR_TO_CTX,
+};
+
 static const struct bpf_func_proto *
 sk_filter_func_proto(enum bpf_func_id func_id)
 {
@@ -1461,6 +1474,8 @@ tc_cls_act_func_proto(enum bpf_func_id func_id)
 		return &bpf_l4_csum_replace_proto;
 	case BPF_FUNC_clone_redirect:
 		return &bpf_clone_redirect_proto;
+	case BPF_FUNC_get_cgroup_classid:
+		return &bpf_get_cgroup_classid_proto;
 	default:
 		return sk_filter_func_proto(func_id);
 	}
-- 
1.9.3

Re: [PATCH net-next 2/2] ebpf: add helper to retrieve net_cls's classid cookie

[Alexei Starovoitov]

On 7/15/15 5:21 AM, Daniel Borkmann wrote:
> It would be very useful to retrieve the net_cls's classid from an eBPF
> program to allow for a more fine-grained classification, it could be
> directly used or in conjunction with additional policies. I.e. docker,
> but also tooling such as cgexec, can easily run applications via net_cls
> cgroups:
>
>    cgcreate -g net_cls:/foo
>    echo 42 > foo/net_cls.classid
>    cgexec -g net_cls:foo <prog>
>
> Thus, their respecitve classid cookie of foo can then be looked up on
> the egress path to apply further policies. The helper is desigend such
> that a non-zero value returns the cgroup id.
>
> Signed-off-by: Daniel Borkmann<daniel@iogearbox.net>
> Cc: Thomas Graf<tgraf@suug.ch>

looks good to me.
Acked-by: Alexei Starovoitov <ast@plumgrid.com>

Re: [PATCH net-next 0/2] BPF update

[David Miller]

From: Daniel Borkmann <daniel@iogearbox.net>
Date: Wed, 15 Jul 2015 14:21:40 +0200

> This small helper allows for accessing net_cls cgroups classid. Please
> see individual patches for more details.

Series applied, thanks.

[PATCH net-next 0/2] BPF update

[Daniel Borkmann]

This set adds IPv6 support for bpf_skb_{set,get}_tunnel_key() helper.
It also exports flags to user space that are being used in helpers and
weren't exported thus far. For more details, please see the individual
patches.

Thanks!

Daniel Borkmann (2):
  bpf: export helper function flags and reject invalid ones
  bpf: support ipv6 for bpf_skb_{set,get}_tunnel_key

 include/uapi/linux/bpf.h |  26 +++++++++++-
 net/core/filter.c        | 106 +++++++++++++++++++++++++++++++++++++----------
 2 files changed, 110 insertions(+), 22 deletions(-)

-- 
1.9.3

Re: [PATCH net-next 0/2] BPF update

[David Miller]

From: Daniel Borkmann <daniel@iogearbox.net>
Date: Mon, 11 Jan 2016 01:16:37 +0100

> This set adds IPv6 support for bpf_skb_{set,get}_tunnel_key() helper.
> It also exports flags to user space that are being used in helpers and
> weren't exported thus far. For more details, please see the individual
> patches.

Series applied, thank you.