From: Lingpeng Chen <forrest0579@gmail.com>
To: bpf <bpf@vger.kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
John Fastabend <john.fastabend@gmail.com>,
"David S . Miller" <davem@davemloft.net>,
netdev@vger.kernel.org, Petar Penkov <ppenkov.kernel@gmail.com>,
Lingpeng Chen <forrest0579@gmail.com>
Subject: [PATCH v3 bpf-next 1/3] bpf: Add get_netns_id helper function for sock_ops
Date: Thu, 20 Feb 2020 07:10:52 +0000 [thread overview]
Message-ID: <20200220071054.12499-2-forrest0579@gmail.com> (raw)
In-Reply-To: <20200220071054.12499-1-forrest0579@gmail.com>
Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
uniq connection because there may be multi net namespace.
For example, there may be a chance that netns a and netns b all
listen on 127.0.0.1:8080 and the client with same port 40782
connect to them. Without netns number, sock ops program
can't distinguish them.
Using bpf_get_netns_id helper to get current connection
netns id to distinguish connections.
Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
---
include/uapi/linux/bpf.h | 9 ++++++++-
net/core/filter.c | 20 ++++++++++++++++++++
2 files changed, 28 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index f1d74a2bd234..e79082f78b74 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2892,6 +2892,12 @@ union bpf_attr {
* Obtain the 64bit jiffies
* Return
* The 64 bit jiffies
+ *
+ * u64 bpf_get_netns_id(struct bpf_sock_ops *bpf_socket)
+ * Description
+ * Obtain netns id of sock
+ * Return
+ * The current netns inum
*/
#define __BPF_FUNC_MAPPER(FN) \
FN(unspec), \
@@ -3012,7 +3018,8 @@ union bpf_attr {
FN(probe_read_kernel_str), \
FN(tcp_send_ack), \
FN(send_signal_thread), \
- FN(jiffies64),
+ FN(jiffies64), \
+ FN(get_netns_id),
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
* function eBPF program intends to call
diff --git a/net/core/filter.c b/net/core/filter.c
index c180871e606d..5302ec9f7c0d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4421,6 +4421,24 @@ static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = {
.arg2_type = ARG_ANYTHING,
};
+BPF_CALL_1(bpf_get_netns_id_sock_ops, struct bpf_sock_ops_kern *, bpf_sock)
+{
+#ifdef CONFIG_NET_NS
+ struct sock *sk = bpf_sock->sk;
+
+ return (u64)sk->sk_net.net->ns.inum;
+#else
+ return 0;
+#endif
+}
+
+static const struct bpf_func_proto bpf_get_netns_id_sock_ops_proto = {
+ .func = bpf_get_netns_id_sock_ops,
+ .gpl_only = false,
+ .ret_type = RET_INTEGER,
+ .arg1_type = ARG_PTR_TO_CTX,
+};
+
const struct ipv6_bpf_stub *ipv6_bpf_stub __read_mostly;
EXPORT_SYMBOL_GPL(ipv6_bpf_stub);
@@ -6218,6 +6236,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
case BPF_FUNC_tcp_sock:
return &bpf_tcp_sock_proto;
#endif /* CONFIG_INET */
+ case BPF_FUNC_get_netns_id:
+ return &bpf_get_netns_id_sock_ops_proto;
default:
return bpf_base_func_proto(func_id);
}
--
2.20.1
next prev parent reply other threads:[~2020-02-20 7:11 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-06 8:35 [PATCH bpf-next 0/2] bpf: Add sock ops get netns helpers Lingpeng Chen
2020-02-06 8:35 ` [PATCH bpf-next 1/2] " Lingpeng Chen
2020-02-06 18:48 ` Petar Penkov
2020-02-08 0:14 ` kbuild test robot
2020-02-06 8:35 ` [PATCH bpf-next 2/2] bpf: Sync uapi bpf.h to tools/ Lingpeng Chen
2020-02-18 9:15 ` [PATCH v2 bpf-next 0/3] bpf: Add sock_ops_get_netns helpers Lingpeng Chen
2020-02-18 9:15 ` [PATCH v2 bpf-next 1/3] bpf: Add sock ops get netns helpers Lingpeng Chen
2020-02-20 0:04 ` Daniel Borkmann
2020-02-20 7:10 ` [PATCH v3 bpf-next 0/3] bpf: Add get_netns_id helper for sock_ops Lingpeng Chen
2020-02-20 7:10 ` Lingpeng Chen [this message]
2020-02-24 23:48 ` [PATCH v3 bpf-next 1/3] bpf: Add get_netns_id helper function " Song Liu
2020-02-25 4:45 ` [PATCH v4 bpf-next 0/3] bpf: Add get_netns_id helper " Lingpeng Chen
2020-02-25 4:45 ` [PATCH v4 bpf-next 1/3] bpf: Add get_netns_id helper function " Lingpeng Chen
2020-02-25 5:54 ` Song Liu
2020-02-25 4:45 ` [PATCH v4 bpf-next 2/3] bpf: Sync uapi bpf.h to tools/ Lingpeng Chen
2020-02-25 4:45 ` [PATCH v4 bpf-next 3/3] selftests/bpf: add selftest for get_netns_id helper Lingpeng Chen
2020-02-25 6:13 ` Andrii Nakryiko
[not found] ` <CAH+Qyb+rQeebkb1TtLuNHPLmf-VRLqj1yvsHXtaqfzHKMA4azQ@mail.gmail.com>
2020-02-25 17:13 ` Andrii Nakryiko
[not found] ` <CAH+Qyb+-Q7OSrobdojRiep5cmnzwfMnGJ2HPfjvEPiTPtse+LQ@mail.gmail.com>
2020-02-26 4:35 ` Andrii Nakryiko
2020-03-02 8:23 ` [PATCH v4 bpf-next 0/3] bpf: Add get_netns_id helper for sock_ops Forrest Chen
2020-02-20 7:10 ` [PATCH v3 bpf-next 2/3] bpf: Sync uapi bpf.h to tools/ Lingpeng Chen
2020-02-24 23:49 ` Song Liu
2020-02-20 7:10 ` [PATCH v3 bpf-next 3/3] selftests/bpf: add selftest for get_netns_id helper Lingpeng Chen
2020-02-24 23:55 ` Song Liu
2020-02-18 9:15 ` [PATCH v2 bpf-next 2/3] bpf: Sync uapi bpf.h to tools/ Lingpeng Chen
2020-02-18 9:15 ` [PATCH v2 bpf-next 3/3] selftests/bpf: add selftest for sock_ops_get_netns helper Lingpeng Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200220071054.12499-2-forrest0579@gmail.com \
--to=forrest0579@gmail.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=john.fastabend@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=ppenkov.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).