From patchwork Wed May 9 21:06:58 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Joe Stringer X-Patchwork-Id: 911185 Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=wand.net.nz Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="pwTNs0OT"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40h87h0Ywjz9s37 for ; Thu, 10 May 2018 07:07:28 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965539AbeEIVHY (ORCPT ); Wed, 9 May 2018 17:07:24 -0400 Received: from mail-ot0-f171.google.com ([74.125.82.171]:38562 "EHLO mail-ot0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S964849AbeEIVHX (ORCPT ); Wed, 9 May 2018 17:07:23 -0400 Received: by mail-ot0-f171.google.com with SMTP id n3-v6so5494587ota.5 for ; Wed, 09 May 2018 14:07:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id; bh=gTChgamI2ytB5aAN7ZkwLHmhxvu1ozXc7LCdwZ5OBBQ=; b=pwTNs0OTWhE7uYzMEQBbv1MUmOAdb7Sb+kBN4D24rubm3UlkJskRJ2sJBb+WyTO97a 8rVSNCE6vZLM4QwMBBAHwSgERr2LGv6H3OeqqiWfrvzGRRzw6CBtDVYfXZ5zfNIKHay0 Y9stICfCLRO4bi9JDL5Ia5y66I5pRxUaD4xIdd0JZ52PtfGUYlPqP085Y487fu2LIvWf gremO07meL9wRt6MTnufygYZ3/90XHMpVSx5s/WoYwc4Dpg/zqLrtckqhW8zW/ogbfPT XIVu8A8WzqQd6lqE2lLsQBXVI2kADnFFFhhtvRIIH60Bt0BJgx9l182xKLfEaizhodpG i42A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id; bh=gTChgamI2ytB5aAN7ZkwLHmhxvu1ozXc7LCdwZ5OBBQ=; b=jS0DqAsy+NYqxY5ExwHCJlyCXuq4PUYvzYIKk4lxvxuv6fuF37eqO4RbUTe9xWEYA6 Y0Bsx7aj1GaWk/F6nY1Hi+RdPsCKP8m73wXYeOp6uBnwG7x72MNiQVL6y144PKhd7r1Y PyPwCBwEQAwCAdW/GmWVH/JE2qbeOjbDpVODLBgsvmANQND4IcYXeFLU+vAjRCLdhG6V 5V3Gz3X07qyfjkZghu6hDXjov0cCWOWzV+O9REmvrjyFjgFPB4VxLCO0qG6UA54WT6gc ZN+73khmTAPSnSXRV33b/bsATqt3LOpZGLw+39Uf5Yy1grLU4a8qAwJVsUlFqIn6Y78P K3YQ== X-Gm-Message-State: ALQs6tAtG9I3P33d5t8XrFHX/f6mgXDSNfbvEBlaXbGi6SKKU9iAAX/Y v+5aS+y+7Rx7VCpkYvckKCI= X-Google-Smtp-Source: AB8JxZoFBkGGAhF64VXCuQtqfdlpystykS340+xIp8nhB8BmO6N10dtg2hkvIT/5QgldUVRAR1O88A== X-Received: by 2002:a9d:f8e:: with SMTP id d14-v6mr35036483otd.53.1525900042617; Wed, 09 May 2018 14:07:22 -0700 (PDT) Received: from allosaurus.lan ([99.0.85.34]) by smtp.gmail.com with ESMTPSA id h125-v6sm13612921oic.54.2018.05.09.14.07.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 09 May 2018 14:07:22 -0700 (PDT) From: Joe Stringer To: daniel@iogearbox.net Cc: netdev@vger.kernel.org, ast@kernel.org, john.fastabend@gmail.com, tgraf@suug.ch, kafai@fb.com Subject: [RFC bpf-next 00/11] Add socket lookup support Date: Wed, 9 May 2018 14:06:58 -0700 Message-Id: <20180509210709.7201-1-joe@wand.net.nz> X-Mailer: git-send-email 2.14.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This series proposes a new helper for the BPF API which allows BPF programs to perform lookups for sockets in a network namespace. This would allow programs to determine early on in processing whether the stack is expecting to receive the packet, and perform some action (eg drop, forward somewhere) based on this information. The series is structured roughly into: * Misc refactor * Add the socket pointer type * Add reference tracking to ensure that socket references are freed * Extend the BPF API to add sk_lookup() / sk_release() functions * Add tests/documentation The helper proposed in this series includes a parameter for a tuple which must be filled in by the caller to determine the socket to look up. The simplest case would be filling with the contents of the packet, ie mapping the packet's 5-tuple into the parameter. In common cases, it may alternatively be useful to reverse the direction of the tuple and perform a lookup, to find the socket that initiates this connection; and if the BPF program ever performs a form of IP address translation, it may further be useful to be able to look up arbitrary tuples that are not based upon the packet, but instead based on state held in BPF maps or hardcoded in the BPF program. Currently, access into the socket's fields are limited to those which are otherwise already accessible, and are restricted to read-only access. A few open points: * Currently, the lookup interface only returns either a valid socket or a NULL pointer. This means that if there is any kind of issue with the tuple, such as it provides an unsupported protocol number, or the socket can't be found, then we are unable to differentiate these cases from one another. One natural approach to improve this could be to return an ERR_PTR from the bpf_sk_lookup() helper. This would be more complicated but maybe it's worthwhile. * No ordering is defined between sockets. If the tuple could find multiple sockets, then it will arbitrarily return one. It is up to the caller to handle this. If we wish to handle this more reliably in future, we could encode an ordering preference in the flags field. * Currently this helper is only defined for TC hook point, but it should also be valid at XDP and perhaps some other hooks. Joe Stringer (11): bpf: Add iterator for spilled registers bpf: Simplify ptr_min_max_vals adjustment bpf: Generalize ptr_or_null regs check bpf: Add PTR_TO_SOCKET verifier type bpf: Macrofy stack state copy bpf: Add reference tracking to verifier bpf: Add helper to retrieve socket in BPF selftests/bpf: Add tests for reference tracking libbpf: Support loading individual progs selftests/bpf: Add C tests for reference tracking Documentation: Describe bpf reference tracking Documentation/networking/filter.txt | 64 +++ include/linux/bpf.h | 19 +- include/linux/bpf_verifier.h | 31 +- include/uapi/linux/bpf.h | 39 +- kernel/bpf/verifier.c | 548 ++++++++++++++++++---- net/core/filter.c | 132 +++++- tools/include/uapi/linux/bpf.h | 40 +- tools/lib/bpf/libbpf.c | 4 +- tools/lib/bpf/libbpf.h | 3 + tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/bpf_helpers.h | 7 + tools/testing/selftests/bpf/test_progs.c | 38 ++ tools/testing/selftests/bpf/test_sk_lookup_kern.c | 127 +++++ tools/testing/selftests/bpf/test_verifier.c | 373 ++++++++++++++- 14 files changed, 1299 insertions(+), 128 deletions(-) create mode 100644 tools/testing/selftests/bpf/test_sk_lookup_kern.c