Pinning map and libbpf

Pinning map and libbpf

[Eric Leblond]

Hi,

I've just added an libbpf bpf_pin_obj call to a working setup and this
did cause bpf_map_lookup_elem() call to fail and return a value even if
the set is empty.

The maps structure is the following:

struct bpf_map_def SEC("maps") ipv4_drop = {
    .type = BPF_MAP_TYPE_HASH,
    .key_size = sizeof(__u32),
    .value_size = sizeof(__u32),
    .max_entries = 32768,
};

Is there something I should change ?

I'm using 4.18. 

BR,
-- 
Eric Leblond <eric@regit.org>

Re: Pinning map and libbpf

[Justin Azoff]

This sounds similar to an issue I ran into when I was getting pinning
working for libflowbypass.  At one point I was pinning the map but not
loading it properly again on startup.  This caused a 2nd map with the
same name to be created.  This meant anything using the pinned map on
the bpf filesystem saw one set of values, but the app was running with
it's own private non-pinned map.

If you do a 'bpftool map list' when the app is stopped, you should see
your pinned map. If you start the app back up and 'bpftool map list'
now lists 2 maps, that would be your problem as well.  If nothing
else, 'bpftool map list' and 'bpftool map dump' may also help debug
this, since they should be able to confirm that the map is empty too.

On Thu, Nov 15, 2018 at 12:57 PM Eric Leblond <eric@regit.org> wrote:
>
> Hi,
>
> I've just added an libbpf bpf_pin_obj call to a working setup and this
> did cause bpf_map_lookup_elem() call to fail and return a value even if
> the set is empty.
>
> The maps structure is the following:
>
> struct bpf_map_def SEC("maps") ipv4_drop = {
>     .type = BPF_MAP_TYPE_HASH,
>     .key_size = sizeof(__u32),
>     .value_size = sizeof(__u32),
>     .max_entries = 32768,
> };
>
> Is there something I should change ?
>
> I'm using 4.18.
>
> BR,
> --
> Eric Leblond <eric@regit.org>
>


-- 
- Justin

Re: Pinning map and libbpf

[Eric Leblond]

Hello,

On Fri, 2018-11-16 at 10:43 -0600, Justin Azoff wrote:
> This sounds similar to an issue I ran into when I was getting pinning
> working for libflowbypass.  At one point I was pinning the map but
> not
> loading it properly again on startup.  This caused a 2nd map with the
> same name to be created.  This meant anything using the pinned map on
> the bpf filesystem saw one set of values, but the app was running
> with
> it's own private non-pinned map.
> 
> If you do a 'bpftool map list' when the app is stopped, you should
> see
> your pinned map. If you start the app back up and 'bpftool map list'
> now lists 2 maps, that would be your problem as well.  If nothing
> else, 'bpftool map list' and 'bpftool map dump' may also help debug
> this, since they should be able to confirm that the map is empty too.

This is not that. I just did the following test:
 * reboot
 * start on 4.18 (4.18.0-2-amd64 #1 SMP Debian 4.18.10-2 (2018-11-02)
   x86_64 GNU/Linux)
 * mount bpf fs
 * start suricata that create and pin the ipv4_drop map
 * do a ssh connection
 * check log generated by sniffing the traffic 

Result:
 * no SSH connection logged by Suricata
 * no packet seen by suricata (received by AF_PACKET) 

If I do the same tests with 4.17 kernel, then I've got a SSH logs and
Suricata sees packets.

On 4.18, I've got:
# sudo bpftool map dump pinned /sys/fs/bpf/ipv4_drop 
Found 0 elements

I've just seen now that even if I don't pin the map then I've got an
all block filter on 4.18.

Adding a 'return -1' at the start of the eBPF code is switching the
eBPF to pass so it seems it is the bpf map lookup that is causing the
error.

I'm going continue to investigate to see if I find something 

BR,


> On Thu, Nov 15, 2018 at 12:57 PM Eric Leblond <eric@regit.org> wrote:
> > Hi,
> > 
> > I've just added an libbpf bpf_pin_obj call to a working setup and
> > this
> > did cause bpf_map_lookup_elem() call to fail and return a value
> > even if
> > the set is empty.
> > 
> > The maps structure is the following:
> > 
> > struct bpf_map_def SEC("maps") ipv4_drop = {
> >     .type = BPF_MAP_TYPE_HASH,
> >     .key_size = sizeof(__u32),
> >     .value_size = sizeof(__u32),
> >     .max_entries = 32768,
> > };
> > 
> > Is there something I should change ?
> > 
> > I'm using 4.18.
> > 
> > BR,
> > --
> > Eric Leblond <eric@regit.org>
> > 
> 
> 
-- 
Eric Leblond <eric@regit.org>