From patchwork Fri Jun 7 14:11:03 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Iago_L=C3=B3pez_Galeiras?= X-Patchwork-Id: 1111875 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=kinvolk.io Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=kinvolk.io header.i=@kinvolk.io header.b="lK8ebs9w"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45L4Fl2jyWz9sNR for ; Sat, 8 Jun 2019 00:11:23 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729515AbfFGOLT (ORCPT ); Fri, 7 Jun 2019 10:11:19 -0400 Received: from mail-ed1-f66.google.com ([209.85.208.66]:41233 "EHLO mail-ed1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727840AbfFGOLO (ORCPT ); Fri, 7 Jun 2019 10:11:14 -0400 Received: by mail-ed1-f66.google.com with SMTP id p15so3221466eds.8 for ; Fri, 07 Jun 2019 07:11:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kinvolk.io; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=uGMgJuq5yq87nZc1iXSw3rrA6LJaXGUavU0uLXBD7Zs=; b=lK8ebs9wXyOkapYE4RhrzhhvvopPOCQRlCoKg2ti+4ihvpij2HIRb7/+Yr0erau6p9 cyqsPXRZ7B+d7ZH5g9nNJCSDVnktTXsAHfLBZBxdt1QKwvvgN9C83/mhO5xUqdhnV5WR KtmW5MgHYBkcM4SbMiAgMPxcG9Ijc6fhHKzNU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=uGMgJuq5yq87nZc1iXSw3rrA6LJaXGUavU0uLXBD7Zs=; b=FSoeF6LwAZZMuDD9BWoQie0Mr4uiCRE1KY+VAQT/SaAbu/QISQ7vSyUX4jn4ZVV9/Z O11XibT8UMLTK5MotoWF6JuUEQZFs8SNNuE4rHPCDZ7BaIcm5fvNxgDBb7hnP9QU1S6/ LVXoZeQuLbGeZYUuVriG6lBbiXMss1+IoD9oD+NPEgRbvz1XT2xFNqqDm4TZJoQNwF2P fwKoZv3QQZts1QnXHBczWWi/datR9vyMTTl2kDYw1/wvGn7YpKntwZnbsDAQ2182BE5P WdFvcbGma2+dQlIGmizsKAYRRXsxfa3IHcBby5UVovWsFATb1EQEJ/rn0UGx9bBQDQoX Uj3g== X-Gm-Message-State: APjAAAXa9rslSQJKbexn5qSvf8RSe0Da+C//H7PzFcURICpq8r6ZTvjl WLdIaf06yqHZigTDdkkZKbSgxA== X-Google-Smtp-Source: APXvYqyV7eDm48xD9GpGkIo3m2th7JJi7gj60MYEFlgRiR95zHoQVGVsfxVNPQcKzrUIzJ0gBZrR4g== X-Received: by 2002:a17:906:3098:: with SMTP id 24mr22761119ejv.106.1559916672400; Fri, 07 Jun 2019 07:11:12 -0700 (PDT) Received: from locke-xps13.fritz.box (dslb-002-205-069-198.002.205.pools.vodafone-ip.de. [2.205.69.198]) by smtp.gmail.com with ESMTPSA id a40sm546116edd.1.2019.06.07.07.11.11 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Fri, 07 Jun 2019 07:11:11 -0700 (PDT) From: =?utf-8?q?Iago_L=C3=B3pez_Galeiras?= To: john.fastabend@gmail.com, ast@kernel.org, daniel@iogearbox.net Cc: alban@kinvolk.io, krzesimir@kinvolk.io, bpf@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, =?utf-8?q?Iago_?= =?utf-8?q?L=C3=B3pez_Galeiras?= Subject: [PATCH bpf-next v5 1/4] bpf: sock ops: add netns ino and dev in bpf context Date: Fri, 7 Jun 2019 16:11:03 +0200 Message-Id: <20190607141106.32148-2-iago@kinvolk.io> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190607141106.32148-1-iago@kinvolk.io> References: <20190607141106.32148-1-iago@kinvolk.io> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Alban Crequy sockops programs can now access the network namespace inode and device via (struct bpf_sock_ops)->netns_ino and ->netns_dev. This can be useful to apply different policies on different network namespaces. In the unlikely case where network namespaces are not compiled in (CONFIG_NET_NS=n), the verifier will return netns_dev as usual and will return 0 for netns_ino. The generated BPF bytecode for netns_ino is loading the correct inode number at the time of execution. However, the generated BPF bytecode for netns_dev is loading an immediate value determined at BPF-load-time by looking at the initial network namespace. In practice, this works because all netns currently use the same virtual device. If this was to change, this code would need to be updated too. Co-authored-by: Iago López Galeiras Signed-off-by: Alban Crequy Signed-off-by: Iago López Galeiras --- Changes since v1: - add netns_dev (review from Alexei) Changes since v2: - replace __u64 by u64 in kernel code (review from Y Song) - remove unneeded #else branch: program would be rejected in is_valid_access (review from Y Song) - allow partial reads ( #include #include +#include +#include /** * sk_filter_trim_cap - run a packet through a socket filter @@ -6822,6 +6824,15 @@ static bool sock_ops_is_valid_access(int off, int size, } } else { switch (off) { + case bpf_ctx_range(struct bpf_sock_ops, netns_dev): + bpf_ctx_record_field_size(info, sizeof(u64)); + if (!bpf_ctx_narrow_access_ok(off, size, sizeof(u64))) + return false; + break; + case offsetof(struct bpf_sock_ops, netns_ino): + if (size != sizeof(u64)) + return false; + break; case bpf_ctx_range_till(struct bpf_sock_ops, bytes_received, bytes_acked): if (size != sizeof(__u64)) @@ -7739,6 +7750,11 @@ static u32 sock_addr_convert_ctx_access(enum bpf_access_type type, return insn - insn_buf; } +static struct ns_common *sockops_netns_cb(void *private_data) +{ + return &init_net.ns; +} + static u32 sock_ops_convert_ctx_access(enum bpf_access_type type, const struct bpf_insn *si, struct bpf_insn *insn_buf, @@ -7747,6 +7763,10 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type, { struct bpf_insn *insn = insn_buf; int off; + struct inode *ns_inode; + struct path ns_path; + u64 netns_dev; + void *res; /* Helper macro for adding read access to tcp_sock or sock fields. */ #define SOCK_OPS_GET_FIELD(BPF_FIELD, OBJ_FIELD, OBJ) \ @@ -7993,6 +8013,53 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type, SOCK_OPS_GET_OR_SET_FIELD(sk_txhash, sk_txhash, struct sock, type); break; + + case bpf_ctx_range(struct bpf_sock_ops, netns_dev): + /* We get the netns_dev at BPF-load-time and not at + * BPF-exec-time. We assume that netns_dev is a constant. + */ + res = ns_get_path_cb(&ns_path, sockops_netns_cb, NULL); + if (IS_ERR(res)) { + netns_dev = 0; + } else { + ns_inode = ns_path.dentry->d_inode; + netns_dev = new_encode_dev(ns_inode->i_sb->s_dev); + } + *target_size = 8; + *insn++ = BPF_MOV64_IMM(si->dst_reg, netns_dev); + break; + + case offsetof(struct bpf_sock_ops, netns_ino): +#ifdef CONFIG_NET_NS + /* Loading: sk_ops->sk->__sk_common.skc_net.net->ns.inum + * Type: (struct bpf_sock_ops_kern *) + * ->(struct sock *) + * ->(struct sock_common) + * .possible_net_t + * .(struct net *) + * ->(struct ns_common) + * .(unsigned int) + */ + BUILD_BUG_ON(offsetof(struct sock, __sk_common) != 0); + BUILD_BUG_ON(offsetof(possible_net_t, net) != 0); + *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( + struct bpf_sock_ops_kern, sk), + si->dst_reg, si->src_reg, + offsetof(struct bpf_sock_ops_kern, sk)); + *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( + possible_net_t, net), + si->dst_reg, si->dst_reg, + offsetof(struct sock_common, skc_net)); + *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( + struct ns_common, inum), + si->dst_reg, si->dst_reg, + offsetof(struct net, ns) + + offsetof(struct ns_common, inum)); +#else + *insn++ = BPF_MOV64_IMM(si->dst_reg, 0); +#endif + break; + } return insn - insn_buf; } From patchwork Fri Jun 7 14:11:04 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Iago_L=C3=B3pez_Galeiras?= X-Patchwork-Id: 1111876 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=kinvolk.io Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=kinvolk.io header.i=@kinvolk.io header.b="j5fa4Xr7"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45L4Fq07Rqz9sNm for ; Sat, 8 Jun 2019 00:11:27 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729505AbfFGOLS (ORCPT ); Fri, 7 Jun 2019 10:11:18 -0400 Received: from mail-ed1-f66.google.com ([209.85.208.66]:40096 "EHLO mail-ed1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729458AbfFGOLP (ORCPT ); Fri, 7 Jun 2019 10:11:15 -0400 Received: by mail-ed1-f66.google.com with SMTP id k8so2085688eds.7 for ; Fri, 07 Jun 2019 07:11:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kinvolk.io; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Xp4rSZI5WhV+6Sat4AULJy3MtrPBifsfu9gUED/8PtM=; b=j5fa4Xr7EV3n7eHh1YEh37F4gLNUjhYvDUz4lIuHeMDiEgRSAkv6SQOiAxlkqObRJs jPFxqQI4VqeibG3Mb/hOzrk2jSsXV46nL/yVFNtre5PROvxr3dwiMwLpacpOipTz70EQ IMFUGoSJBNeL82mmABWec4P0UZrCcMTylCJSI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Xp4rSZI5WhV+6Sat4AULJy3MtrPBifsfu9gUED/8PtM=; b=eNSKqOTriXINMNlqKXGy8gdbTU6fFMJyUroIgXZGyadzCUYmIMNUeA+/8oTH1oQ9jZ dZ5/57eZdxk6DnZhY7Ppquizjzs1Fl4e2wub4qIjKpfORoXtySTZuHe0+tIupdGNTa9i /oh1oqI63mS6bo3F1G/FDxqrj6k2mKdHQAzdFJWB1SDhQM/i4qw3v7UHWX3jsRcGUAUj mlbgE6YG8f1aTiDETrHZpkSRBxZtn6mqcaA5DrD/595/Mq5JpQQss/CtlasutkXf+soy tAiXRefZmJLnnCof61sZIVlwPjt0/Hf5vfjYoGzbIvJTOgrYhV1mQCrzYWnIL+Xv2Iqr wDVQ== X-Gm-Message-State: APjAAAVZJZcVm31NRIgQcIBf7ERUfXn2kFtiIPhF6iFzeIdJdjQGo9fI HLNbIRJJWHntyBTV1LalztT2gw== X-Google-Smtp-Source: APXvYqy8+1YsywtSTa+c9W9VfssePeLtB7JQ8mgPOuXAxMPPEaW6jzftMhXPMHpXDCzCrK7FZDDhzw== X-Received: by 2002:a50:ec8e:: with SMTP id e14mr17918728edr.153.1559916673628; Fri, 07 Jun 2019 07:11:13 -0700 (PDT) Received: from locke-xps13.fritz.box (dslb-002-205-069-198.002.205.pools.vodafone-ip.de. [2.205.69.198]) by smtp.gmail.com with ESMTPSA id a40sm546116edd.1.2019.06.07.07.11.12 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Fri, 07 Jun 2019 07:11:13 -0700 (PDT) From: =?utf-8?q?Iago_L=C3=B3pez_Galeiras?= To: john.fastabend@gmail.com, ast@kernel.org, daniel@iogearbox.net Cc: alban@kinvolk.io, krzesimir@kinvolk.io, bpf@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH bpf-next v5 2/4] bpf: sync bpf.h to tools/ for bpf_sock_ops->netns* Date: Fri, 7 Jun 2019 16:11:04 +0200 Message-Id: <20190607141106.32148-3-iago@kinvolk.io> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190607141106.32148-1-iago@kinvolk.io> References: <20190607141106.32148-1-iago@kinvolk.io> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Alban Crequy The change in struct bpf_sock_ops is synchronised from: include/uapi/linux/bpf.h to: tools/include/uapi/linux/bpf.h Signed-off-by: Alban Crequy --- Changes since v2: - standalone patch for the sync (requested by Y Song) Changes since v4: - add netns_dev comment on uapi header (review from Y Song) --- tools/include/uapi/linux/bpf.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 63e0cf66f01a..41f54ac3db95 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -3261,6 +3261,12 @@ struct bpf_sock_ops { __u32 sk_txhash; __u64 bytes_received; __u64 bytes_acked; + /* + * netns_dev might be zero if there's an error getting it + * when loading the BPF program. This is very unlikely. + */ + __u64 netns_dev; + __u64 netns_ino; }; /* Definitions for bpf_sock_ops_cb_flags */ From patchwork Fri Jun 7 14:11:05 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Iago_L=C3=B3pez_Galeiras?= X-Patchwork-Id: 1111874 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=kinvolk.io Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=kinvolk.io header.i=@kinvolk.io header.b="hYmpl/RJ"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45L4Fg3YnLz9sNR for ; Sat, 8 Jun 2019 00:11:19 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729488AbfFGOLR (ORCPT ); Fri, 7 Jun 2019 10:11:17 -0400 Received: from mail-ed1-f66.google.com ([209.85.208.66]:41242 "EHLO mail-ed1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729465AbfFGOLQ (ORCPT ); Fri, 7 Jun 2019 10:11:16 -0400 Received: by mail-ed1-f66.google.com with SMTP id p15so3221637eds.8 for ; Fri, 07 Jun 2019 07:11:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kinvolk.io; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=11EhXksDgdLmWhW501RogfILPsFHkHJiIn4iFOtsvjs=; b=hYmpl/RJIdtBL+tsRx46QDZM7ntWEZeAb9P3BhBKmYfHgIuLyh9vvmb9zYXwPIVTat dKl6Ldm0GyqhJeZkADC8h+04FfW+VTO+LTu9Ns56Dr11icJr10317+FdshImeHEJaDn3 jOxE9gYyRaoqV8HHHUAEaWJQqrScNxcW7TZMM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=11EhXksDgdLmWhW501RogfILPsFHkHJiIn4iFOtsvjs=; b=pvMxupynpz35V7B18E16Pae/S/NRQllt5/SxTh86/IcutrEuE5FK/QEjUyIxWPV7/3 ++FqCtAmbzyhAxisD/rn8+30ZvuWGLhE/mjE0UdfYEGlaNzeRoEgSk05syfiMCyElo2w TVGH4kfB/uDppDsdT/gacrmGiXw0hZB87qBAVpLRjllM8+oVqgBgekfLpq0vmJUnLRU7 rDNdy+Ani1o2vay8yPLwXLiCPvcoNYjJGzcMjLmQjwNxivsAR2os6ho58mPnT55Grxa4 bl5iLEBwqQ125pJ8PgpH7FZZYmackbamRGBXvAqbhSyr+Vbhld7RPS9yc9zU1Y7P77nH sz+A== X-Gm-Message-State: APjAAAUkLAO+jY6wqOpoPQ7cMZJRAmZ3C02CEXBbM4V4nfZdHOAunnnw hzYSUsw7o2AABSKsBSkYUpwEMw== X-Google-Smtp-Source: APXvYqz2740/Zq7SORSpBbmq18iS12DgOvm5oFAPmO/N4K7hGYYvdn+cIQ/hX/Zj7omaxLUCzzTvrQ== X-Received: by 2002:a17:906:4cc3:: with SMTP id q3mr22467661ejt.27.1559916674717; Fri, 07 Jun 2019 07:11:14 -0700 (PDT) Received: from locke-xps13.fritz.box (dslb-002-205-069-198.002.205.pools.vodafone-ip.de. [2.205.69.198]) by smtp.gmail.com with ESMTPSA id a40sm546116edd.1.2019.06.07.07.11.13 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Fri, 07 Jun 2019 07:11:14 -0700 (PDT) From: =?utf-8?q?Iago_L=C3=B3pez_Galeiras?= To: john.fastabend@gmail.com, ast@kernel.org, daniel@iogearbox.net Cc: alban@kinvolk.io, krzesimir@kinvolk.io, bpf@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH bpf-next v5 3/4] selftests: bpf: read netns_ino from struct bpf_sock_ops Date: Fri, 7 Jun 2019 16:11:05 +0200 Message-Id: <20190607141106.32148-4-iago@kinvolk.io> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190607141106.32148-1-iago@kinvolk.io> References: <20190607141106.32148-1-iago@kinvolk.io> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Alban Crequy This shows how a sockops program could be restricted to a specific network namespace. The sockops program looks at the current netns via (struct bpf_sock_ops)->netns_ino and checks if the value matches the configuration in the new BPF map "sock_netns". The test program ./test_sockmap accepts a new parameter "--netns"; the default value is the current netns found by stat() on /proc/self/ns/net, so the previous tests still pass: sudo ./test_sockmap ... Summary: 412 PASSED 0 FAILED ... Summary: 824 PASSED 0 FAILED I run my additional test in the following way: NETNS=$(readlink /proc/self/ns/net | sed 's/^net:\[\(.*\)\]$/\1/') CGR=/sys/fs/cgroup/unified/user.slice/user-1000.slice/session-5.scope/ sudo ./test_sockmap --cgroup $CGR --netns $NETNS & cat /sys/kernel/debug/tracing/trace_pipe echo foo | nc -l 127.0.0.1 8080 & echo bar | nc 127.0.0.1 8080 => the connection goes through the sockmap When testing with a wrong $NETNS, I get the trace_pipe log: > not binding connection on netns 4026531992 Signed-off-by: Alban Crequy --- Changes since v1: - tools/include/uapi/linux/bpf.h: update with netns_dev - tools/testing/selftests/bpf/test_sockmap_kern.h: print debugs with both netns_dev and netns_ino Changes since v2: - update commitmsg to refer to netns_ino --- tools/testing/selftests/bpf/test_sockmap.c | 38 +++++++++++++++++-- .../testing/selftests/bpf/test_sockmap_kern.h | 22 +++++++++++ 2 files changed, 57 insertions(+), 3 deletions(-) diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c index 3845144e2c91..5a1b9c96fca1 100644 --- a/tools/testing/selftests/bpf/test_sockmap.c +++ b/tools/testing/selftests/bpf/test_sockmap.c @@ -2,6 +2,7 @@ // Copyright (c) 2017-2018 Covalent IO, Inc. http://covalent.io #include #include +#include #include #include #include @@ -21,6 +22,7 @@ #include #include #include +#include #include #include @@ -63,8 +65,8 @@ int s1, s2, c1, c2, p1, p2; int test_cnt; int passed; int failed; -int map_fd[8]; -struct bpf_map *maps[8]; +int map_fd[9]; +struct bpf_map *maps[9]; int prog_fd[11]; int txmsg_pass; @@ -84,6 +86,7 @@ int txmsg_ingress; int txmsg_skb; int ktls; int peek_flag; +uint64_t netns_opt; static const struct option long_options[] = { {"help", no_argument, NULL, 'h' }, @@ -111,6 +114,7 @@ static const struct option long_options[] = { {"txmsg_skb", no_argument, &txmsg_skb, 1 }, {"ktls", no_argument, &ktls, 1 }, {"peek", no_argument, &peek_flag, 1 }, + {"netns", required_argument, NULL, 'n'}, {0, 0, NULL, 0 } }; @@ -1585,6 +1589,7 @@ char *map_names[] = { "sock_bytes", "sock_redir_flags", "sock_skb_opts", + "sock_netns", }; int prog_attach_type[] = { @@ -1619,6 +1624,8 @@ static int populate_progs(char *bpf_file) struct bpf_object *obj; int i = 0; long err; + struct stat netns_sb; + uint64_t netns_ino; obj = bpf_object__open(bpf_file); err = libbpf_get_error(obj); @@ -1655,6 +1662,28 @@ static int populate_progs(char *bpf_file) } } + if (netns_opt == 0) { + err = stat("/proc/self/ns/net", &netns_sb); + if (err) { + fprintf(stderr, + "ERROR: cannot stat network namespace: %ld (%s)\n", + err, strerror(errno)); + return -1; + } + netns_ino = netns_sb.st_ino; + } else { + netns_ino = netns_opt; + } + i = 1; + err = bpf_map_update_elem(map_fd[8], &netns_ino, &i, BPF_ANY); + if (err) { + fprintf(stderr, + "ERROR: bpf_map_update_elem (netns): %ld (%s)\n", + err, strerror(errno)); + return -1; + } + + return 0; } @@ -1738,7 +1767,7 @@ int main(int argc, char **argv) if (argc < 2) return test_suite(-1); - while ((opt = getopt_long(argc, argv, ":dhvc:r:i:l:t:p:q:", + while ((opt = getopt_long(argc, argv, ":dhvc:r:i:l:t:p:q:n:", long_options, &longindex)) != -1) { switch (opt) { case 's': @@ -1805,6 +1834,9 @@ int main(int argc, char **argv) return -1; } break; + case 'n': + netns_opt = strtoull(optarg, NULL, 10); + break; case 0: break; case 'h': diff --git a/tools/testing/selftests/bpf/test_sockmap_kern.h b/tools/testing/selftests/bpf/test_sockmap_kern.h index e7639f66a941..317406dad6cf 100644 --- a/tools/testing/selftests/bpf/test_sockmap_kern.h +++ b/tools/testing/selftests/bpf/test_sockmap_kern.h @@ -91,6 +91,13 @@ struct bpf_map_def SEC("maps") sock_skb_opts = { .max_entries = 1 }; +struct bpf_map_def SEC("maps") sock_netns = { + .type = BPF_MAP_TYPE_HASH, + .key_size = sizeof(__u64), + .value_size = sizeof(int), + .max_entries = 16 +}; + SEC("sk_skb1") int bpf_prog1(struct __sk_buff *skb) { @@ -132,9 +139,24 @@ int bpf_sockmap(struct bpf_sock_ops *skops) { __u32 lport, rport; int op, err = 0, index, key, ret; + int i = 0; + __u64 netns_dev, netns_ino; + int *allowed; op = (int) skops->op; + netns_dev = skops->netns_dev; + netns_ino = skops->netns_ino; + bpf_printk("bpf_sockmap: netns_dev = %lu netns_ino = %lu\n", + netns_dev, netns_ino); + + // Only allow sockmap connection on the configured network namespace + allowed = bpf_map_lookup_elem(&sock_netns, &netns_ino); + if (allowed == NULL || *allowed == 0) { + bpf_printk("not binding connection on netns_ino %lu\n", + netns_ino); + return 0; + } switch (op) { case BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB: From patchwork Fri Jun 7 14:11:06 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Iago_L=C3=B3pez_Galeiras?= X-Patchwork-Id: 1111877 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=kinvolk.io Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=kinvolk.io header.i=@kinvolk.io header.b="A52/UPha"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 45L4Fy41xKz9sNy for ; Sat, 8 Jun 2019 00:11:34 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729536AbfFGOLa (ORCPT ); Fri, 7 Jun 2019 10:11:30 -0400 Received: from mail-ed1-f66.google.com ([209.85.208.66]:36181 "EHLO mail-ed1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729473AbfFGOLR (ORCPT ); Fri, 7 Jun 2019 10:11:17 -0400 Received: by mail-ed1-f66.google.com with SMTP id a8so3252638edx.3 for ; Fri, 07 Jun 2019 07:11:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kinvolk.io; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=a4BYbY0H/gJ/SBV0pW9HBq0oWfzuEg4LxLjaui3637c=; b=A52/UPhaDFmKTtTG9exlP6gH+yrRJmVwrdz56ohUfKW1gwkj+x4/Dq2PHUdpuj6YZT 3/pvcYZolg2Xqok2Jijpnu95I/Og/Kfeehoz+bDcnwAmyAxlDjhYJnx0Xz2dbAz90qQP Fa2uO6BTJrDA/X2hHq0xwrOt4Te63fRj1iUjA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=a4BYbY0H/gJ/SBV0pW9HBq0oWfzuEg4LxLjaui3637c=; b=UnLugwDS2Q/GQF/V7c7rgsfzSCuaOg3FbCCuJbhXZXhwZhpSxj2lJ7+WQfRNAQqntT 09NICUmihU/YCHDwmT0JLasrWo6FLkUfjoDycBr12tEIEUSTC2u4Vk9RAnkRLTg43BYe oht2cs+dAHWsTjGoK4/LBh6cp7SQV+66l+P6pHglAzkviRXxKGmlDuGW8qgE7cyX9kWP tDBlUueMPzAGuGI6XLTO3JyQvtiLPPWcy7Mmg1qvHOZQNg4AkJmC2p1vP2OFN/sivqnS JzAmnWDpoc2B0/0UxSB1ZbHa7NqSBs3pqzLadC+96RDLD3nXP4iPErHyjIttMsrXT3xN WKxg== X-Gm-Message-State: APjAAAVWF3rDCLBq4QMjqmUUYpWnROUMbKDOQzIpdx/FHcynhSdb8+3p xVbObAzXGbKhvPQLL5XV/gq4Ow== X-Google-Smtp-Source: APXvYqwLVNr+7w9/STmzWhSBQ6bLcxrBsjntrXkA1h+OPVqNKlLghZ1xop6URIiy5ZgptgoOzJHl7A== X-Received: by 2002:a17:906:7388:: with SMTP id f8mr47614254ejl.231.1559916675852; Fri, 07 Jun 2019 07:11:15 -0700 (PDT) Received: from locke-xps13.fritz.box (dslb-002-205-069-198.002.205.pools.vodafone-ip.de. [2.205.69.198]) by smtp.gmail.com with ESMTPSA id a40sm546116edd.1.2019.06.07.07.11.14 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Fri, 07 Jun 2019 07:11:15 -0700 (PDT) From: =?utf-8?q?Iago_L=C3=B3pez_Galeiras?= To: john.fastabend@gmail.com, ast@kernel.org, daniel@iogearbox.net Cc: alban@kinvolk.io, krzesimir@kinvolk.io, bpf@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH bpf-next v5 4/4] selftests: bpf: verifier: read netns_dev and netns_ino from struct bpf_sock_ops Date: Fri, 7 Jun 2019 16:11:06 +0200 Message-Id: <20190607141106.32148-5-iago@kinvolk.io> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190607141106.32148-1-iago@kinvolk.io> References: <20190607141106.32148-1-iago@kinvolk.io> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Alban Crequy Tested with: > $ sudo ./test_verifier > ... > #905/p sockops accessing bpf_sock_ops->netns_dev, ok OK > #906/p sockops accessing bpf_sock_ops->netns_ino, ok OK > ... > Summary: 1421 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Alban Crequy --- Changes since v1: - This is a new selftest (review from Song) Changes since v2: - test partial reads on netns_dev (review from Y Song) - split in two tests --- .../testing/selftests/bpf/verifier/var_off.c | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/tools/testing/selftests/bpf/verifier/var_off.c b/tools/testing/selftests/bpf/verifier/var_off.c index 8504ac937809..9e4c6c78eb9d 100644 --- a/tools/testing/selftests/bpf/verifier/var_off.c +++ b/tools/testing/selftests/bpf/verifier/var_off.c @@ -246,3 +246,56 @@ .result = ACCEPT, .prog_type = BPF_PROG_TYPE_LWT_IN, }, +{ + "sockops accessing bpf_sock_ops->netns_dev, ok", + .insns = { + BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev)), + + BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev)), + BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev) + 4), + + BPF_LDX_MEM(BPF_H, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev)), + BPF_LDX_MEM(BPF_H, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev) + 2), + BPF_LDX_MEM(BPF_H, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev) + 4), + BPF_LDX_MEM(BPF_H, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev) + 6), + + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev)), + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev) + 1), + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev) + 2), + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev) + 3), + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev) + 4), + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev) + 5), + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev) + 6), + BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_dev) + 7), + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, + .result = ACCEPT, + .prog_type = BPF_PROG_TYPE_SOCK_OPS, +}, +{ + "sockops accessing bpf_sock_ops->netns_ino, ok", + .insns = { + BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, offsetof(struct bpf_sock_ops, + netns_ino)), + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, + .result = ACCEPT, + .prog_type = BPF_PROG_TYPE_SOCK_OPS, +},