From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexei Starovoitov Subject: Re: [bpf-next, v4 0/5] Introduce eBPF flow dissector Date: Fri, 14 Sep 2018 12:22:27 -0700 Message-ID: <20180914192225.oj22b7klqzyombcf@ast-mbp> References: <20180914144622.16436-1-peterpenkov96@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netdev@vger.kernel.org, davem@davemloft.net, ast@kernel.org, daniel@iogearbox.net, simon.horman@netronome.com, ecree@solarflare.com, songliubraving@fb.com, tom@herbertland.com, Petar Penkov To: Petar Penkov Return-path: Received: from mail-pg1-f193.google.com ([209.85.215.193]:44765 "EHLO mail-pg1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726891AbeIOAiW (ORCPT ); Fri, 14 Sep 2018 20:38:22 -0400 Received: by mail-pg1-f193.google.com with SMTP id r1-v6so4823885pgp.11 for ; Fri, 14 Sep 2018 12:22:30 -0700 (PDT) Content-Disposition: inline In-Reply-To: <20180914144622.16436-1-peterpenkov96@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: On Fri, Sep 14, 2018 at 07:46:17AM -0700, Petar Penkov wrote: > From: Petar Penkov > > This patch series hardens the RX stack by allowing flow dissection in BPF, > as previously discussed [1]. Because of the rigorous checks of the BPF > verifier, this provides significant security guarantees. In particular, the > BPF flow dissector cannot get inside of an infinite loop, as with > CVE-2013-4348, because BPF programs are guaranteed to terminate. It cannot > read outside of packet bounds, because all memory accesses are checked. > Also, with BPF the administrator can decide which protocols to support, > reducing potential attack surface. Rarely encountered protocols can be > excluded from dissection and the program can be updated without kernel > recompile or reboot if a bug is discovered. > > Patch 1 adds infrastructure to execute a BPF program in __skb_flow_dissect. > This includes a new BPF program and attach type. > > Patch 2 adds the new BPF flow dissector definitions to tools/uapi. > > Patch 3 adds support for the new BPF program type to libbpf and bpftool. > > Patch 4 adds a flow dissector program in BPF. This parses most protocols in > __skb_flow_dissect in BPF for a subset of flow keys (basic, control, ports, > and address types). > > Patch 5 adds a selftest that attaches the BPF program to the flow dissector > and sends traffic with different levels of encapsulation. > > Performance Evaluation: > The in-kernel implementation was compared against the demo program from > patch 4 using the test in patch 5 with IPv4/UDP traffic over 10 seconds. > $perf record -a -C 4 taskset -c 4 ./test_flow_dissector -i 4 -f 8 \ > -t 10 Looks great. Applied to bpf-next with one extra patch: SEC("dissect") -int dissect(struct __sk_buff *skb) +int _dissect(struct __sk_buff *skb) otherwise the test doesn't build. I'm not sure how it builds for you. Which llvm did you use? Also above command works and ipv4 test in ./test_flow_dissector.sh is passing as well, but it still fails at the end for me: ./test_flow_dissector.sh bpffs not mounted. Mounting... 0: IP 1: IPV6 2: IPV6OP 3: IPV6FR 4: MPLS 5: VLAN Testing IPv4... inner.dest4: 127.0.0.1 inner.source4: 127.0.0.3 pkts: tx=10 rx=10 inner.dest4: 127.0.0.1 inner.source4: 127.0.0.3 pkts: tx=10 rx=0 inner.dest4: 127.0.0.1 inner.source4: 127.0.0.3 pkts: tx=10 rx=10 Testing IPIP... tunnels before test: tunl0: any/ip remote any local any ttl inherit nopmtudisc sit_test_LV5N: any/ip remote 127.0.0.2 local 127.0.0.1 dev lo ttl inherit ipip_test_LV5N: any/ip remote 127.0.0.2 local 127.0.0.1 dev lo ttl inherit sit0: ipv6/ip remote any local any ttl 64 nopmtudisc gre_test_LV5N: gre/ip remote 127.0.0.2 local 127.0.0.1 dev lo ttl inherit gre0: gre/ip remote any local any ttl inherit nopmtudisc inner.dest4: 192.168.0.1 inner.source4: 1.1.1.1 encap proto: 4 outer.dest4: 127.0.0.1 outer.source4: 127.0.0.2 pkts: tx=10 rx=0 tunnels after test: tunl0: any/ip remote any local any ttl inherit nopmtudisc sit0: ipv6/ip remote any local any ttl 64 nopmtudisc gre0: gre/ip remote any local any ttl inherit nopmtudisc selftests: test_flow_dissector [FAILED] is it something in my setup or test is broken?