[PATCH bpf-next 1/2] bpf: add get_netns_cookie helper to tracing programs

[PATCH bpf-next 1/2] bpf: add get_netns_cookie helper to tracing programs

[Mahe Tardy]

This is needed in the context of Cilium and Tetragon to retrieve netns
cookie from hostns when traffic leaves Pod, so that we can correlate
skb->sk's netns cookie.

Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
---
This is a follow-up of c221d3744ad3 ("bpf: add get_netns_cookie helper
to cgroup_skb programs") and eb62f49de7ec ("bpf: add get_netns_cookie
helper to tc programs"), adding this helper respectively to cgroup_skb
and tcx programs.

I looked up a patch doing a similar thing c5dbb89fc2ac ("bpf: Expose
bpf_get_socket_cookie to tracing programs") and there was an item about
"sleepable context". It seems it indeed concerns tracing and LSM progs
from reading 1e6c62a88215 ("bpf: Introduce sleepable BPF programs"). Is
this needed here?

Thanks!

 include/linux/bpf.h      | 1 +
 kernel/trace/bpf_trace.c | 2 ++
 net/core/filter.c        | 6 ++++++
 3 files changed, 9 insertions(+)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 15164787ce7f..c079cf3e34ea 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -3361,6 +3361,7 @@ extern const struct bpf_func_proto bpf_get_retval_proto;
 extern const struct bpf_func_proto bpf_user_ringbuf_drain_proto;
 extern const struct bpf_func_proto bpf_cgrp_storage_get_proto;
 extern const struct bpf_func_proto bpf_cgrp_storage_delete_proto;
+extern const struct bpf_func_proto bpf_get_netns_cookie_sock_ptr_proto;

 const struct bpf_func_proto *tracing_prog_func_proto(
   enum bpf_func_id func_id, const struct bpf_prog *prog);
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 13bef2462e94..f2d37ae27ad2 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2012,6 +2012,8 @@ tracing_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 		return &bpf_sock_from_file_proto;
 	case BPF_FUNC_get_socket_cookie:
 		return &bpf_get_socket_ptr_cookie_proto;
+	case BPF_FUNC_get_netns_cookie:
+		return &bpf_get_netns_cookie_sock_ptr_proto;
 	case BPF_FUNC_xdp_get_buff_len:
 		return &bpf_xdp_get_buff_len_trace_proto;
 #endif
diff --git a/net/core/filter.c b/net/core/filter.c
index 827108c6dad9..4f42ab00c875 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5168,6 +5168,12 @@ static const struct bpf_func_proto bpf_get_netns_cookie_sock_proto = {
 	.arg1_type	= ARG_PTR_TO_CTX_OR_NULL,
 };

+const struct bpf_func_proto bpf_get_netns_cookie_sock_ptr_proto = {
+	.func		= bpf_get_netns_cookie_sock,
+	.ret_type	= RET_INTEGER,
+	.arg1_type	= ARG_PTR_TO_BTF_ID_SOCK_COMMON | PTR_MAYBE_NULL,
+};
+
 BPF_CALL_1(bpf_get_netns_cookie_sock_addr, struct bpf_sock_addr_kern *, ctx)
 {
 	return __bpf_get_netns_cookie(ctx ? ctx->sk : NULL);
--
2.34.1

[PATCH bpf-next 2/2] selftests/bpf: add tracing netns cookie tests

[Mahe Tardy]

Add netns cookie test that verifies the helper is now supported and work
in the context of tracing programs.

Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
---
 .../testing/selftests/bpf/prog_tests/netns_cookie.c |  7 +++++++
 .../testing/selftests/bpf/progs/netns_cookie_prog.c | 13 +++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/netns_cookie.c b/tools/testing/selftests/bpf/prog_tests/netns_cookie.c
index e00cd34586dd..53a3272f3e32 100644
--- a/tools/testing/selftests/bpf/prog_tests/netns_cookie.c
+++ b/tools/testing/selftests/bpf/prog_tests/netns_cookie.c
@@ -52,6 +52,11 @@ void test_netns_cookie(void)
 	if (!ASSERT_OK_PTR(skel->links.get_netns_cookie_cgroup_skb, "prog_attach_cgroup_skb"))
 		goto cleanup_tc;

+	skel->links.get_netns_cookie_tracing = bpf_program__attach(
+			skel->progs.get_netns_cookie_tracing);
+	if (!ASSERT_OK_PTR(skel->links.get_netns_cookie_tracing, "prog_attach_tracing"))
+		goto cleanup_tc;
+
 	server_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0);
 	if (CHECK(server_fd < 0, "start_server", "errno %d\n", errno))
 		goto cleanup_tc;
@@ -86,6 +91,8 @@ void test_netns_cookie(void)
 	ASSERT_EQ(skel->bss->tcx_netns_cookie, cookie_expected_value, "cookie_value_tcx");
 	ASSERT_EQ(skel->bss->cgroup_skb_init_netns_cookie, cookie_expected_value, "cookie_value_init_cgroup_skb");
 	ASSERT_EQ(skel->bss->cgroup_skb_netns_cookie, cookie_expected_value, "cookie_value_cgroup_skb");
+	ASSERT_EQ(skel->bss->tracing_init_netns_cookie, cookie_expected_value, "cookie_value_init_tracing");
+	ASSERT_EQ(skel->bss->tracing_netns_cookie, cookie_expected_value, "cookie_value_tracing");

 cleanup_tc:
 	err = bpf_prog_detach_opts(tc_fd, loopback, BPF_TCX_INGRESS, &optd);
diff --git a/tools/testing/selftests/bpf/progs/netns_cookie_prog.c b/tools/testing/selftests/bpf/progs/netns_cookie_prog.c
index 94040714af18..5de573571640 100644
--- a/tools/testing/selftests/bpf/progs/netns_cookie_prog.c
+++ b/tools/testing/selftests/bpf/progs/netns_cookie_prog.c
@@ -3,6 +3,7 @@
 #include "vmlinux.h"

 #include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>

 #define AF_INET6 10

@@ -29,6 +30,7 @@ struct {

 int tcx_init_netns_cookie, tcx_netns_cookie;
 int cgroup_skb_init_netns_cookie, cgroup_skb_netns_cookie;
+int tracing_init_netns_cookie, tracing_netns_cookie;

 SEC("sockops")
 int get_netns_cookie_sockops(struct bpf_sock_ops *ctx)
@@ -100,4 +102,15 @@ int get_netns_cookie_cgroup_skb(struct __sk_buff *skb)
 	return SK_PASS;
 }

+SEC("fexit/inet_stream_connect")
+int BPF_PROG(get_netns_cookie_tracing, struct socket *sock,
+	struct sockaddr *uaddr, int addr_len, int flags)
+{
+	if (uaddr->sa_family != AF_INET6)
+		return 0;
+	tracing_init_netns_cookie = bpf_get_netns_cookie(NULL);
+	tracing_netns_cookie = bpf_get_netns_cookie(sock->sk);
+	return 0;
+}
+
 char _license[] SEC("license") = "GPL";
--
2.34.1

Re: [PATCH bpf-next 1/2] bpf: add get_netns_cookie helper to tracing programs

[Martin KaFai Lau]

On 2/27/25 10:28 AM, Mahe Tardy wrote:
> This is needed in the context of Cilium and Tetragon to retrieve netns
> cookie from hostns when traffic leaves Pod, so that we can correlate
> skb->sk's netns cookie.
> 
> Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
> ---
> This is a follow-up of c221d3744ad3 ("bpf: add get_netns_cookie helper
> to cgroup_skb programs") and eb62f49de7ec ("bpf: add get_netns_cookie
> helper to tc programs"), adding this helper respectively to cgroup_skb
> and tcx programs.
> 
> I looked up a patch doing a similar thing c5dbb89fc2ac ("bpf: Expose
> bpf_get_socket_cookie to tracing programs") and there was an item about
> "sleepable context". It seems it indeed concerns tracing and LSM progs
> from reading 1e6c62a88215 ("bpf: Introduce sleepable BPF programs"). Is
> this needed here?

Regarding sleepable, I think the bpf_get_netns_cookie_sock is only reading, 
should be fine.

The immediate question is whether sock_net(sk) must be non-NULL for tracing.

Re: [PATCH bpf-next 1/2] bpf: add get_netns_cookie helper to tracing programs

[Mahe Tardy]

On Thu, Feb 27, 2025 at 12:32:43PM -0800, Martin KaFai Lau wrote:
> On 2/27/25 10:28 AM, Mahe Tardy wrote:
> > This is needed in the context of Cilium and Tetragon to retrieve netns
> > cookie from hostns when traffic leaves Pod, so that we can correlate
> > skb->sk's netns cookie.
> > 
> > Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
> > ---
> > This is a follow-up of c221d3744ad3 ("bpf: add get_netns_cookie helper
> > to cgroup_skb programs") and eb62f49de7ec ("bpf: add get_netns_cookie
> > helper to tc programs"), adding this helper respectively to cgroup_skb
> > and tcx programs.
> > 
> > I looked up a patch doing a similar thing c5dbb89fc2ac ("bpf: Expose
> > bpf_get_socket_cookie to tracing programs") and there was an item about
> > "sleepable context". It seems it indeed concerns tracing and LSM progs
> > from reading 1e6c62a88215 ("bpf: Introduce sleepable BPF programs"). Is
> > this needed here?
> 
> Regarding sleepable, I think the bpf_get_netns_cookie_sock is only reading,
> should be fine.

Ok thank you.

> The immediate question is whether sock_net(sk) must be non-NULL for tracing.

We discussed this offline with Daniel Borkmann and we think that it
might not be the question. The get_netns_cookie(NULL) call allows us to
compare against get_netns_cookie(sock) to see whether the sock's netns
is equal to the init netns and thus dispatch different logic.

Given we (in Tetragon) historically used tracing programs when no
appropriate network hook was available on older kernels I can foresee
how it can still be useful in such programs.

Re: [PATCH bpf-next 1/2] bpf: add get_netns_cookie helper to tracing programs

[Martin KaFai Lau]

On 3/3/25 2:14 AM, Mahe Tardy wrote:
> On Thu, Feb 27, 2025 at 12:32:43PM -0800, Martin KaFai Lau wrote:
>> On 2/27/25 10:28 AM, Mahe Tardy wrote:
>>> This is needed in the context of Cilium and Tetragon to retrieve netns
>>> cookie from hostns when traffic leaves Pod, so that we can correlate
>>> skb->sk's netns cookie.
>>>
>>> Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
>>> ---
>>> This is a follow-up of c221d3744ad3 ("bpf: add get_netns_cookie helper
>>> to cgroup_skb programs") and eb62f49de7ec ("bpf: add get_netns_cookie
>>> helper to tc programs"), adding this helper respectively to cgroup_skb
>>> and tcx programs.
>>>
>>> I looked up a patch doing a similar thing c5dbb89fc2ac ("bpf: Expose
>>> bpf_get_socket_cookie to tracing programs") and there was an item about
>>> "sleepable context". It seems it indeed concerns tracing and LSM progs
>>> from reading 1e6c62a88215 ("bpf: Introduce sleepable BPF programs"). Is
>>> this needed here?
>>
>> Regarding sleepable, I think the bpf_get_netns_cookie_sock is only reading,
>> should be fine.
> 
> Ok thank you.
> 
>> The immediate question is whether sock_net(sk) must be non-NULL for tracing.
> 
> We discussed this offline with Daniel Borkmann and we think that it
> might not be the question. The get_netns_cookie(NULL) call allows us to
> compare against get_netns_cookie(sock) to see whether the sock's netns
> is equal to the init netns and thus dispatch different logic.

bpf_get_netns_cookie(NULL) should be fine.

I meant to ask if sock_net(sk) may return NULL for a non NULL sk. Please check.

> 
> Given we (in Tetragon) historically used tracing programs when no
> appropriate network hook was available on older kernels I can foresee
> how it can still be useful in such programs.
> 

Re: [PATCH bpf-next 1/2] bpf: add get_netns_cookie helper to tracing programs

[Mahe Tardy]

On Mon, Mar 03, 2025 at 11:14:53AM -0800, Martin KaFai Lau wrote:
> On 3/3/25 2:14 AM, Mahe Tardy wrote:
> > On Thu, Feb 27, 2025 at 12:32:43PM -0800, Martin KaFai Lau wrote:
> > > On 2/27/25 10:28 AM, Mahe Tardy wrote:
> > > > This is needed in the context of Cilium and Tetragon to retrieve netns
> > > > cookie from hostns when traffic leaves Pod, so that we can correlate
> > > > skb->sk's netns cookie.
> > > > 
> > > > Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
> > > > ---
> > > > This is a follow-up of c221d3744ad3 ("bpf: add get_netns_cookie helper
> > > > to cgroup_skb programs") and eb62f49de7ec ("bpf: add get_netns_cookie
> > > > helper to tc programs"), adding this helper respectively to cgroup_skb
> > > > and tcx programs.
> > > > 
> > > > I looked up a patch doing a similar thing c5dbb89fc2ac ("bpf: Expose
> > > > bpf_get_socket_cookie to tracing programs") and there was an item about
> > > > "sleepable context". It seems it indeed concerns tracing and LSM progs
> > > > from reading 1e6c62a88215 ("bpf: Introduce sleepable BPF programs"). Is
> > > > this needed here?
> > > 
> > > Regarding sleepable, I think the bpf_get_netns_cookie_sock is only reading,
> > > should be fine.
> > 
> > Ok thank you.
> > 
> > > The immediate question is whether sock_net(sk) must be non-NULL for tracing.
> > 
> > We discussed this offline with Daniel Borkmann and we think that it
> > might not be the question. The get_netns_cookie(NULL) call allows us to
> > compare against get_netns_cookie(sock) to see whether the sock's netns
> > is equal to the init netns and thus dispatch different logic.
> 
> bpf_get_netns_cookie(NULL) should be fine.
> 
> I meant to ask if sock_net(sk) may return NULL for a non NULL sk. Please check.

Oh sorry for the confusion, I investigated with my humble kernel
knowledge: essentially sock_net(sk) is doing sk->sk_net->net, retrieving
the net struct representing the network namespace, to later extract the
cookie, and thus dereference the returned pointer (here is the concern).
The sk_net intermediary (in reality __sk_common.skc_net) is here because
of the possibility of switching on/off network namespaces via
CONFIG_NET_NS. It's a possible_net_t type containing (or not) the struct
net pointer, explaining why we use write/read_pnet to no-op or return
the global net ns. 

Now by adding this helper to tracing progs, it allows to call this
function in any function entry or function exit, but unlike kprobes,
it's not possible to just hook at an obvious arbitrary point in the code
where the net ns would be NULL in the sock struct. With that in mind, I
failed to crash the kernel tracing a function (some candidates were
inlined). I mostly grepped for sock_net_set, but I lack the knowledge to
guarantee that this could not happen right now or in the future. Maybe
that would be just safer to add a check and return 0 in that case if
that's ok? Not sure since the helper returns an 8-byte long opaque
number which thus includes 0 as a valid value.

Re: [PATCH bpf-next 1/2] bpf: add get_netns_cookie helper to tracing programs

[Martin KaFai Lau]

On 3/6/25 9:03 AM, Mahe Tardy wrote:
>>>> The immediate question is whether sock_net(sk) must be non-NULL for tracing.
>>> We discussed this offline with Daniel Borkmann and we think that it
>>> might not be the question. The get_netns_cookie(NULL) call allows us to
>>> compare against get_netns_cookie(sock) to see whether the sock's netns
>>> is equal to the init netns and thus dispatch different logic.
>> bpf_get_netns_cookie(NULL) should be fine.
>>
>> I meant to ask if sock_net(sk) may return NULL for a non NULL sk. Please check.
> Oh sorry for the confusion, I investigated with my humble kernel
> knowledge: essentially sock_net(sk) is doing sk->sk_net->net, retrieving
> the net struct representing the network namespace, to later extract the
> cookie, and thus dereference the returned pointer (here is the concern).
> The sk_net intermediary (in reality __sk_common.skc_net) is here because
> of the possibility of switching on/off network namespaces via
> CONFIG_NET_NS. It's a possible_net_t type containing (or not) the struct
> net pointer, explaining why we use write/read_pnet to no-op or return
> the global net ns.
> 
> Now by adding this helper to tracing progs, it allows to call this
> function in any function entry or function exit, but unlike kprobes,
> it's not possible to just hook at an obvious arbitrary point in the code
> where the net ns would be NULL in the sock struct. With that in mind, I
> failed to crash the kernel tracing a function (some candidates were
> inlined). I mostly grepped for sock_net_set, but I lack the knowledge to

Thanks for checking.

I took a quick look at the callers of sock_net_set. I suspect 
"fentry/sk_prot_alloc" and "lsm/sk_alloc" could have a NULL?

> guarantee that this could not happen right now or in the future. Maybe
> that would be just safer to add a check and return 0 in that case if
> that's ok? Not sure since the helper returns an 8-byte long opaque
> number which thus includes 0 as a valid value.

I assume net_cookie 0 is invalid, but then it leaks the implementation details 
of what is a valid cookie in a uapi helper

  * u64 bpf_get_netns_cookie(void *ctx)
  * ...
  *      Return
  *              A 8-byte long opaque number

Note that, the tracing program can already read most fields of the sk, including 
sk->sk_net.net->net_cookie. Therefore, what this patch aims to achieve has 
already been supported in tracing. It can also save a helper call.

The only thing that may be missing in your use case is determining the init_net. 
I don't think reading a global kernel variable has been supported yet. Not sure 
if init_net must have net_cookie 1. Otherwise, we could consider to add a kfunc 
to return &init_net, which could be used to compare with sk->sk_net.net. Having 
a pointer to &init_net might be more useful for other tracing use cases in general.

Re: [PATCH bpf-next 1/2] bpf: add get_netns_cookie helper to tracing programs

[Yonghong Song]

On 3/7/25 3:06 PM, Martin KaFai Lau wrote:
> On 3/6/25 9:03 AM, Mahe Tardy wrote:
>>>>> The immediate question is whether sock_net(sk) must be non-NULL 
>>>>> for tracing.
>>>> We discussed this offline with Daniel Borkmann and we think that it
>>>> might not be the question. The get_netns_cookie(NULL) call allows 
>>>> us to
>>>> compare against get_netns_cookie(sock) to see whether the sock's netns
>>>> is equal to the init netns and thus dispatch different logic.
>>> bpf_get_netns_cookie(NULL) should be fine.
>>>
>>> I meant to ask if sock_net(sk) may return NULL for a non NULL sk. 
>>> Please check.
>> Oh sorry for the confusion, I investigated with my humble kernel
>> knowledge: essentially sock_net(sk) is doing sk->sk_net->net, retrieving
>> the net struct representing the network namespace, to later extract the
>> cookie, and thus dereference the returned pointer (here is the concern).
>> The sk_net intermediary (in reality __sk_common.skc_net) is here because
>> of the possibility of switching on/off network namespaces via
>> CONFIG_NET_NS. It's a possible_net_t type containing (or not) the struct
>> net pointer, explaining why we use write/read_pnet to no-op or return
>> the global net ns.
>>
>> Now by adding this helper to tracing progs, it allows to call this
>> function in any function entry or function exit, but unlike kprobes,
>> it's not possible to just hook at an obvious arbitrary point in the code
>> where the net ns would be NULL in the sock struct. With that in mind, I
>> failed to crash the kernel tracing a function (some candidates were
>> inlined). I mostly grepped for sock_net_set, but I lack the knowledge to
>
> Thanks for checking.
>
> I took a quick look at the callers of sock_net_set. I suspect 
> "fentry/sk_prot_alloc" and "lsm/sk_alloc" could have a NULL?
>
>> guarantee that this could not happen right now or in the future. Maybe
>> that would be just safer to add a check and return 0 in that case if
>> that's ok? Not sure since the helper returns an 8-byte long opaque
>> number which thus includes 0 as a valid value.
>
> I assume net_cookie 0 is invalid, but then it leaks the implementation 
> details of what is a valid cookie in a uapi helper
>
>  * u64 bpf_get_netns_cookie(void *ctx)
>  * ...
>  *      Return
>  *              A 8-byte long opaque number
>
> Note that, the tracing program can already read most fields of the sk, 
> including sk->sk_net.net->net_cookie. Therefore, what this patch aims 
> to achieve has already been supported in tracing. It can also save a 
> helper call.
>
> The only thing that may be missing in your use case is determining the 
> init_net. I don't think reading a global kernel variable has been 
> supported yet. Not sure if init_net must have net_cookie 1. Otherwise, 
> we could consider to add a kfunc to return &init_net, which could be 
> used to compare with sk->sk_net.net. Having a pointer to &init_net 
> might be more useful for other tracing use cases in general.

There is the workaround for this tracing use case.

1. Declare a global variable in the bpf program, e.g.
    struct net *init_net;

2. After skel_open and before skel_load, find init_net address (from /proc/kallsyms) and
    assign the address to skel->bss->init_net.

3. In the prog, do
    struct net *netns = bpf_rdonly_cast(init_net, bpf_core_type_id_kernel(struct net));
    bpf_printk("%u\n", netns->net_cookie);

There is an effort to add global variables to BTF.
See https://lore.kernel.org/bpf/20250207012045.2129841-1-stephen.s.brennan@oracle.com/
The recommended way is to put these global variables in a module to avoid consume
too much kernel memory unconditionally.