netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH bpf-next 00/11] Add socket lookup support
@ 2018-09-12  0:36 Joe Stringer
  2018-09-12  0:36 ` [PATCH bpf-next 01/11] bpf: Add iterator for spilled registers Joe Stringer
                   ` (10 more replies)
  0 siblings, 11 replies; 34+ messages in thread
From: Joe Stringer @ 2018-09-12  0:36 UTC (permalink / raw)
  To: daniel
  Cc: netdev, ast, john.fastabend, tgraf, kafai, nitin.hande,
	mauricio.vasquez

This series proposes a new helper for the BPF API which allows BPF programs to
perform lookups for sockets in a network namespace. This would allow programs
to determine early on in processing whether the stack is expecting to receive
the packet, and perform some action (eg drop, forward somewhere) based on this
information.

The series is structured roughly into:
* Misc refactor
* Add the socket pointer type
* Add reference tracking to ensure that socket references are freed
* Extend the BPF API to add sk_lookup_xxx() / sk_release() functions
* Add tests/documentation

The helper proposed in this series includes a parameter for a tuple which must
be filled in by the caller to determine the socket to look up. The simplest
case would be filling with the contents of the packet, ie mapping the packet's
5-tuple into the parameter. In common cases, it may alternatively be useful to
reverse the direction of the tuple and perform a lookup, to find the socket
that initiates this connection; and if the BPF program ever performs a form of
IP address translation, it may further be useful to be able to look up
arbitrary tuples that are not based upon the packet, but instead based on state
held in BPF maps or hardcoded in the BPF program.

Currently, access into the socket's fields are limited to those which are
otherwise already accessible, and are restricted to read-only access.

Changes since RFC:
* Split up sk_lookup() into sk_lookup_tcp(), sk_lookup_udp().
* Only take references on the socket when necessary.
  * Make sk_release() only free the socket reference in this case.
* Fix some runtime reference leaks:
  * Disallow BPF_LD_[ABS|IND] instructions while holding a reference.
  * Disallow bpf_tail_call() while holding a reference.
* Prevent the same instruction being used for reference and other
  pointer type.
* Simplify locating copies of a reference during helper calls by caching
  the pointer id from the caller.
* Fix kbuild compilation warnings with particular configs.
* Improve code comments describing the new verifier pieces.
* Testing courtesy of Nitin
* Rebase

This tree is also available at:
https://github.com/joestringer/linux/commits/submit/sk-lookup-v1

Joe Stringer (11):
  bpf: Add iterator for spilled registers
  bpf: Simplify ptr_min_max_vals adjustment
  bpf: Generalize ptr_or_null regs check
  bpf: Add PTR_TO_SOCKET verifier type
  bpf: Macrofy stack state copy
  bpf: Add reference tracking to verifier
  bpf: Add helper to retrieve socket in BPF
  selftests/bpf: Add tests for reference tracking
  libbpf: Support loading individual progs
  selftests/bpf: Add C tests for reference tracking
  Documentation: Describe bpf reference tracking

 Documentation/networking/filter.txt           |  64 ++
 include/linux/bpf.h                           |  17 +
 include/linux/bpf_verifier.h                  |  37 +-
 include/uapi/linux/bpf.h                      |  54 +-
 kernel/bpf/verifier.c                         | 599 ++++++++++++++----
 net/core/filter.c                             | 175 ++++-
 tools/include/uapi/linux/bpf.h                |  54 +-
 tools/lib/bpf/libbpf.c                        |   4 +-
 tools/lib/bpf/libbpf.h                        |   3 +
 tools/testing/selftests/bpf/Makefile          |   2 +-
 tools/testing/selftests/bpf/bpf_helpers.h     |  12 +
 tools/testing/selftests/bpf/test_progs.c      |  38 ++
 .../selftests/bpf/test_sk_lookup_kern.c       | 128 ++++
 tools/testing/selftests/bpf/test_verifier.c   | 373 ++++++++++-
 14 files changed, 1426 insertions(+), 134 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/test_sk_lookup_kern.c

-- 
2.17.1

^ permalink raw reply	[flat|nested] 34+ messages in thread
* Re: [PATCH bpf-next 07/11] bpf: Add helper to retrieve socket in BPF
@ 2018-09-13 19:06 Alexei Starovoitov
  2018-09-13 20:55 ` Joe Stringer
  0 siblings, 1 reply; 34+ messages in thread
From: Alexei Starovoitov @ 2018-09-13 19:06 UTC (permalink / raw)
  To: Joe Stringer
  Cc: Daniel Borkmann, Network Development, Alexei Starovoitov,
	John Fastabend, Thomas Graf, Martin KaFai Lau, Nitin Hande,
	Mauricio Vasquez

On Wed, Sep 12, 2018 at 5:06 PM, Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
> On Tue, Sep 11, 2018 at 05:36:36PM -0700, Joe Stringer wrote:
>> This patch adds new BPF helper functions, bpf_sk_lookup_tcp() and
>> bpf_sk_lookup_udp() which allows BPF programs to find out if there is a
>> socket listening on this host, and returns a socket pointer which the
>> BPF program can then access to determine, for instance, whether to
>> forward or drop traffic. bpf_sk_lookup_xxx() may take a reference on the
>> socket, so when a BPF program makes use of this function, it must
>> subsequently pass the returned pointer into the newly added sk_release()
>> to return the reference.
>>
>> By way of example, the following pseudocode would filter inbound
>> connections at XDP if there is no corresponding service listening for
>> the traffic:
>>
>>   struct bpf_sock_tuple tuple;
>>   struct bpf_sock_ops *sk;
>>
>>   populate_tuple(ctx, &tuple); // Extract the 5tuple from the packet
>>   sk = bpf_sk_lookup_tcp(ctx, &tuple, sizeof tuple, netns, 0);
> ...
>> +struct bpf_sock_tuple {
>> +     union {
>> +             __be32 ipv6[4];
>> +             __be32 ipv4;
>> +     } saddr;
>> +     union {
>> +             __be32 ipv6[4];
>> +             __be32 ipv4;
>> +     } daddr;
>> +     __be16 sport;
>> +     __be16 dport;
>> +     __u8 family;
>> +};
>
> since we can pass ptr_to_packet into map lookup and other helpers now,
> can you move 'family' out of bpf_sock_tuple and combine with netns_id arg?
> then progs wouldn't need to copy bytes from the packet into tuple
> to do a lookup.

have been thinking more about it.
since only ipv4 and ipv6 supported may be use size of bpf_sock_tuple
to infer family inside the helper, so it doesn't need to be passed explicitly?

^ permalink raw reply	[flat|nested] 34+ messages in thread
end of thread, other threads:[~2018-09-14 12:25 UTC | newest]

Thread overview: 34+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-09-12  0:36 [PATCH bpf-next 00/11] Add socket lookup support Joe Stringer
2018-09-12  0:36 ` [PATCH bpf-next 01/11] bpf: Add iterator for spilled registers Joe Stringer
2018-09-12  0:36 ` [PATCH bpf-next 02/11] bpf: Simplify ptr_min_max_vals adjustment Joe Stringer
2018-09-12  0:36 ` [PATCH bpf-next 03/11] bpf: Generalize ptr_or_null regs check Joe Stringer
2018-09-12  0:36 ` [PATCH bpf-next 04/11] bpf: Add PTR_TO_SOCKET verifier type Joe Stringer
2018-09-12 22:50   ` Alexei Starovoitov
2018-09-13 18:59     ` Joe Stringer
2018-09-12  0:36 ` [PATCH bpf-next 05/11] bpf: Macrofy stack state copy Joe Stringer
2018-09-12 22:51   ` Alexei Starovoitov
2018-09-12  0:36 ` [PATCH bpf-next 06/11] bpf: Add reference tracking to verifier Joe Stringer
2018-09-12 23:17   ` Alexei Starovoitov
2018-09-13 19:00     ` Joe Stringer
2018-09-12  0:36 ` [PATCH bpf-next 07/11] bpf: Add helper to retrieve socket in BPF Joe Stringer
2018-09-13  0:06   ` Alexei Starovoitov
2018-09-14  6:57   ` kbuild test robot
2018-09-14  7:11   ` kbuild test robot
2018-09-12  0:36 ` [PATCH bpf-next 08/11] selftests/bpf: Add tests for reference tracking Joe Stringer
2018-09-13  0:09   ` Alexei Starovoitov
2018-09-12  0:36 ` [PATCH bpf-next 09/11] libbpf: Support loading individual progs Joe Stringer
2018-09-13  0:10   ` Alexei Starovoitov
2018-09-12  0:36 ` [PATCH bpf-next 10/11] selftests/bpf: Add C tests for reference tracking Joe Stringer
2018-09-13  0:11   ` Alexei Starovoitov
2018-09-13 20:56     ` Joe Stringer
2018-09-12  0:36 ` [PATCH bpf-next 11/11] Documentation: Describe bpf " Joe Stringer
2018-09-13  0:12   ` Alexei Starovoitov
2018-09-13 20:56     ` Joe Stringer
  -- strict thread matches above, loose matches on Subject: below --
2018-09-13 19:06 [PATCH bpf-next 07/11] bpf: Add helper to retrieve socket in BPF Alexei Starovoitov
2018-09-13 20:55 ` Joe Stringer
2018-09-13 20:57   ` Joe Stringer
2018-09-13 21:01   ` Alexei Starovoitov
2018-09-13 21:17     ` Joe Stringer
2018-09-13 21:22       ` Alexei Starovoitov
2018-09-13 21:24         ` Joe Stringer
2018-09-13 22:23           ` Alexei Starovoitov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).