netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH bpf-next v2 0/6] Allow updating sockmap / sockhash from BPF
@ 2020-08-20 13:57 Lorenz Bauer
  2020-08-20 13:57 ` [PATCH bpf-next v2 1/6] net: sk_msg: simplify sk_psock initialization Lorenz Bauer
                   ` (5 more replies)
  0 siblings, 6 replies; 10+ messages in thread
From: Lorenz Bauer @ 2020-08-20 13:57 UTC (permalink / raw)
  To: jakub, john.fastabend, Alexei Starovoitov, Daniel Borkmann
  Cc: kernel-team, Lorenz Bauer, netdev, bpf

We're currently building a control plane for our BPF socket dispatch
work. As part of that, we have a need to create a copy of an existing
sockhash, to allow us to change the keys. I previously proposed allowing
privileged userspace to look up sockets, which doesn't work due to
security concerns (see [1]).

In follow up discussions during BPF office hours we identified bpf_iter
as a possible solution: instead of accessing sockets from user space
we can iterate the source sockhash, and insert the values into a new
map. Enabling this requires two pieces: the ability to iterate
sockmap and sockhash, as well as being able to call map_update_elem
from BPF.

This patch set implements the latter: it's now possible to update
sockmap from BPF context. As a next step, we can implement bpf_iter
for sockmap.

Changes in v2:
- Fix warning in patch #2 (Jakub K)
- Renamed override_map_arg_type (John)
- Only allow updating sockmap from known safe contexts (John)
- Use __s64 for sockmap updates from user space (Yonghong)
- Various small test fixes around test macros and such (Yonghong)

Thank your for your reviews!

1: https://lore.kernel.org/bpf/20200310174711.7490-1-lmb@cloudflare.com/

Lorenz Bauer (6):
  net: sk_msg: simplify sk_psock initialization
  bpf: sockmap: merge sockmap and sockhash update functions
  bpf: sockmap: call sock_map_update_elem directly
  bpf: override the meaning of ARG_PTR_TO_MAP_VALUE for sockmap and
    sockhash
  bpf: sockmap: allow update from BPF
  selftests: bpf: test sockmap update from BPF

 include/linux/bpf.h                           |   7 +
 include/linux/skmsg.h                         |  17 ---
 kernel/bpf/syscall.c                          |   5 +-
 kernel/bpf/verifier.c                         |  78 +++++++++-
 net/core/skmsg.c                              |  34 ++++-
 net/core/sock_map.c                           | 137 ++++++++----------
 net/ipv4/tcp_bpf.c                            |  13 +-
 net/ipv4/udp_bpf.c                            |   9 +-
 .../selftests/bpf/prog_tests/sockmap_basic.c  |  71 +++++++++
 .../selftests/bpf/progs/test_sockmap_copy.c   |  48 ++++++
 10 files changed, 301 insertions(+), 118 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/test_sockmap_copy.c

-- 
2.25.1


^ permalink raw reply	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2020-08-20 16:19 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-08-20 13:57 [PATCH bpf-next v2 0/6] Allow updating sockmap / sockhash from BPF Lorenz Bauer
2020-08-20 13:57 ` [PATCH bpf-next v2 1/6] net: sk_msg: simplify sk_psock initialization Lorenz Bauer
2020-08-20 13:57 ` [PATCH bpf-next v2 2/6] bpf: sockmap: merge sockmap and sockhash update functions Lorenz Bauer
2020-08-20 13:57 ` [PATCH bpf-next v2 3/6] bpf: sockmap: call sock_map_update_elem directly Lorenz Bauer
2020-08-20 13:57 ` [PATCH bpf-next v2 4/6] bpf: override the meaning of ARG_PTR_TO_MAP_VALUE for sockmap and sockhash Lorenz Bauer
2020-08-20 16:10   ` Yonghong Song
2020-08-20 16:15     ` Lorenz Bauer
2020-08-20 16:18       ` Yonghong Song
2020-08-20 13:57 ` [PATCH bpf-next v2 5/6] bpf: sockmap: allow update from BPF Lorenz Bauer
2020-08-20 13:57 ` [PATCH bpf-next v2 6/6] selftests: bpf: test sockmap " Lorenz Bauer

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).