From patchwork Fri Sep 21 17:10:32 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Joe Stringer X-Patchwork-Id: 973325 Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=wand.net.nz Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="iDqzUQnE"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 42H0VN43Xdz9sB5 for ; Sat, 22 Sep 2018 03:10:52 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390766AbeIUXAi (ORCPT ); Fri, 21 Sep 2018 19:00:38 -0400 Received: from mail-yw1-f68.google.com ([209.85.161.68]:47093 "EHLO mail-yw1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390180AbeIUXAi (ORCPT ); Fri, 21 Sep 2018 19:00:38 -0400 Received: by mail-yw1-f68.google.com with SMTP id j131-v6so5446492ywc.13 for ; Fri, 21 Sep 2018 10:10:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id; bh=PqQH2Lccx2Rgyx7PYl8di0bbOBMM+f/eozOW6XvhlgQ=; b=iDqzUQnEKJyXm5wL/NZpi01tiGmFF+7UqKTcngXfwW+yZv5qx1gpHmCGG2Ph95jjlN RYDiAQjiE1avjP0reqnEFdIfiwYy8WhJnmxNGDpddtxBhdjXEl48kVGWIN4SE6YCFfad nMsvTU8OuMeWkDT892Imzk1EoFi3tRsUv/SNWTnf/Ee0zKf1jZ6FfvLzlxOV4DQTuYyV v0yejNWPIbrI2OWOXT2NuOYUgajGe16Wsg+rsJSdCM8BZA+JOgGrNr3QeM76knruruTX sSu39tdtmIssoHv2rVOo5SXppch+sdL0SBTW2+ueGVay5MIzcjb8Rh5OHBt+qX7ocjr6 wZzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id; bh=PqQH2Lccx2Rgyx7PYl8di0bbOBMM+f/eozOW6XvhlgQ=; b=TALUtPYShI6ufIO84ogTNL1FHWKzCo+5viay6PNVXw9vCu5E7ZNZdwfke9e//muPiz NlLYHwwNf6g/NgPkY+an3S1MyjtLLkxETUYXK6mskmUPA/Aln3Mz2TPaG9G0UzjpLkHk nzQ8tEFaTG4Wwg4ZR13HEFxiddROjbirOfmT2W/jfQ7YeQk9Mxq9r+PJ924T+kLXYveA kYuPjPgK3iiXJS5qFbx2riEsDfQjuh7Q7vR3gBDRNeKtNvAG3auwoABAbgNXdvOiBFW9 5G/ZJoSFgdwnv3JvCepQFfDt5DZbUKS6cNL7lCPptdR/m+Ec/FBsGPJJbhGkddKwLny9 t9Vw== X-Gm-Message-State: APzg51B39T/I5h90bAG+VnRljHzHx/EzOS4zEKH9s3JGNbDM3UVrBPDb /GW2/09YttwqEtOLbd5dJaI= X-Google-Smtp-Source: ANB0Vdae7koD1QA7x66tyHtiFMxzFs5fOiE0+e4oQ9bW+fBc7v1AQrhsIv3ASrYwYeea0Z2Zgr9UBw== X-Received: by 2002:a0d:e283:: with SMTP id l125-v6mr20554767ywe.242.1537549849788; Fri, 21 Sep 2018 10:10:49 -0700 (PDT) Received: from localhost.localdomain ([99.0.85.34]) by smtp.gmail.com with ESMTPSA id h10-v6sm9930972ywa.35.2018.09.21.10.10.48 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 21 Sep 2018 10:10:49 -0700 (PDT) From: Joe Stringer To: ast@kernel.org Cc: netdev@vger.kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, tgraf@suug.ch, kafai@fb.com, nitin.hande@gmail.com, mauricio.vasquez@polito.it Subject: [PATCHv2 bpf-next 00/11] Add socket lookup support Date: Fri, 21 Sep 2018 10:10:32 -0700 Message-Id: <20180921171043.20823-1-joe@wand.net.nz> X-Mailer: git-send-email 2.17.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This series proposes a new helper for the BPF API which allows BPF programs to perform lookups for sockets in a network namespace. This would allow programs to determine early on in processing whether the stack is expecting to receive the packet, and perform some action (eg drop, forward somewhere) based on this information. The series is structured roughly into: * Misc refactor * Add the socket pointer type * Add reference tracking to ensure that socket references are freed * Extend the BPF API to add sk_lookup_xxx() / sk_release() functions * Add tests/documentation The helper proposed in this series includes a parameter for a tuple which must be filled in by the caller to determine the socket to look up. The simplest case would be filling with the contents of the packet, ie mapping the packet's 5-tuple into the parameter. In common cases, it may alternatively be useful to reverse the direction of the tuple and perform a lookup, to find the socket that initiates this connection; and if the BPF program ever performs a form of IP address translation, it may further be useful to be able to look up arbitrary tuples that are not based upon the packet, but instead based on state held in BPF maps or hardcoded in the BPF program. Currently, access into the socket's fields are limited to those which are otherwise already accessible, and are restricted to read-only access. Changes since v1: * Limit netns_id field to 32 bits * Reuse reg_type_mismatch() in more places * Reduce the number of passes at convert_ctx_access() * Replace ptr_id defensive coding when releasing reference state with an internal error (-EFAULT) * Rework 'struct bpf_sock_tuple' to allow passing a packet pointer * Allow direct packet access from helper * Fix compile error with CONFIG_IPV6 enabled * Improve commit messages Changes since RFC: * Split up sk_lookup() into sk_lookup_tcp(), sk_lookup_udp(). * Only take references on the socket when necessary. * Make sk_release() only free the socket reference in this case. * Fix some runtime reference leaks: * Disallow BPF_LD_[ABS|IND] instructions while holding a reference. * Disallow bpf_tail_call() while holding a reference. * Prevent the same instruction being used for reference and other pointer type. * Simplify locating copies of a reference during helper calls by caching the pointer id from the caller. * Fix kbuild compilation warnings with particular configs. * Improve code comments describing the new verifier pieces. * Testing courtesy of Nitin * Rebase This tree is also available at: https://github.com/joestringer/linux/commits/submit/sk-lookup-v2 Joe Stringer (11): bpf: Add iterator for spilled registers bpf: Simplify ptr_min_max_vals adjustment bpf: Generalize ptr_or_null regs check bpf: Add PTR_TO_SOCKET verifier type bpf: Macrofy stack state copy bpf: Add reference tracking to verifier bpf: Add helper to retrieve socket in BPF selftests/bpf: Add tests for reference tracking libbpf: Support loading individual progs selftests/bpf: Add C tests for reference tracking Documentation: Describe bpf reference tracking Documentation/networking/filter.txt | 64 ++ include/linux/bpf.h | 17 + include/linux/bpf_verifier.h | 37 +- include/uapi/linux/bpf.h | 57 +- kernel/bpf/verifier.c | 594 ++++++++++++++---- net/core/filter.c | 179 +++++- tools/include/uapi/linux/bpf.h | 57 +- tools/lib/bpf/libbpf.c | 4 +- tools/lib/bpf/libbpf.h | 3 + tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/bpf_helpers.h | 12 + tools/testing/selftests/bpf/test_progs.c | 38 ++ .../selftests/bpf/test_sk_lookup_kern.c | 137 ++++ tools/testing/selftests/bpf/test_verifier.c | 373 ++++++++++- 14 files changed, 1441 insertions(+), 133 deletions(-) create mode 100644 tools/testing/selftests/bpf/test_sk_lookup_kern.c