From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: bpf@vger.kernel.org, netdev@vger.kernel.org,
netfilter-devel@vger.kernel.org,
"Alexei Starovoitov" <ast@kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Martin KaFai Lau" <kafai@fb.com>,
"Song Liu" <songliubraving@fb.com>, "Yonghong Song" <yhs@fb.com>,
"John Fastabend" <john.fastabend@gmail.com>,
"Maxim Mikityanskiy" <maximmi@nvidia.com>,
"Florian Westphal" <fw@strlen.de>,
"Jesper Dangaard Brouer" <brouer@redhat.com>,
"Toke Høiland-Jørgensen" <toke@redhat.com>
Subject: Re: [PATCH bpf-next v4 07/10] net/netfilter: Add unstable CT lookup helpers for XDP and TC-BPF
Date: Fri, 17 Dec 2021 09:18:19 +0100 [thread overview]
Message-ID: <YbxHy7yLwMQ7L0mN@salvia> (raw)
In-Reply-To: <20211217015031.1278167-8-memxor@gmail.com>
On Fri, Dec 17, 2021 at 07:20:28AM +0530, Kumar Kartikeya Dwivedi wrote:
> This change adds conntrack lookup helpers using the unstable kfunc call
> interface for the XDP and TC-BPF hooks. The primary usecase is
> implementing a synproxy in XDP, see Maxim's patchset at [0].
>
> Export get_net_ns_by_id as nf_conntrack needs to call it.
>
> Note that we search for acquire, release, and null returning kfuncs in
> the intersection of those sets and main set.
>
> This implies that the kfunc_btf_id_list acq_set, rel_set, null_set may
> contain BTF ID not in main set, this is explicitly allowed and
> recommended (to save on definining more and more sets), since
> check_kfunc_call verifier operation would filter out the invalid BTF ID
> fairly early, so later checks for acquire, release, and ret_type_null
> kfunc will only consider allowed BTF IDs for that program that are
> allowed in main set. This is why the nf_conntrack_acq_ids set has BTF
> IDs for both xdp and tc hook kfuncs.
>
> [0]: https://lore.kernel.org/bpf/20211019144655.3483197-1-maximmi@nvidia.com
>
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---
> include/linux/btf.h | 2 +
> kernel/bpf/btf.c | 1 +
> net/core/filter.c | 24 +++
> net/core/net_namespace.c | 1 +
> net/netfilter/nf_conntrack_core.c | 278 ++++++++++++++++++++++++++++++
Toke proposed to move it to net/netfilter/nf_conntrack_bpf.c
next prev parent reply other threads:[~2021-12-17 8:18 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-17 1:50 [PATCH bpf-next v4 00/10] Introduce unstable CT lookup helpers Kumar Kartikeya Dwivedi
2021-12-17 1:50 ` [PATCH bpf-next v4 01/10] bpf: Refactor bpf_check_mod_kfunc_call Kumar Kartikeya Dwivedi
2021-12-17 1:50 ` [PATCH bpf-next v4 02/10] bpf: Remove DEFINE_KFUNC_BTF_ID_SET Kumar Kartikeya Dwivedi
2021-12-17 1:50 ` [PATCH bpf-next v4 03/10] bpf: Extend kfunc with PTR_TO_CTX, PTR_TO_MEM argument support Kumar Kartikeya Dwivedi
2021-12-19 2:17 ` Alexei Starovoitov
2021-12-19 3:21 ` Kumar Kartikeya Dwivedi
2021-12-17 1:50 ` [PATCH bpf-next v4 04/10] bpf: Introduce mem, size argument pair support for kfunc Kumar Kartikeya Dwivedi
2021-12-19 2:19 ` Alexei Starovoitov
2021-12-19 2:53 ` Kumar Kartikeya Dwivedi
2021-12-17 1:50 ` [PATCH bpf-next v4 05/10] bpf: Add reference tracking support to kfunc Kumar Kartikeya Dwivedi
2021-12-19 2:22 ` Alexei Starovoitov
2021-12-19 3:01 ` Kumar Kartikeya Dwivedi
2021-12-19 3:54 ` Alexei Starovoitov
2021-12-19 4:38 ` Kumar Kartikeya Dwivedi
2021-12-19 4:50 ` Alexei Starovoitov
2021-12-17 1:50 ` [PATCH bpf-next v4 06/10] bpf: Track provenance for pointers formed from referenced PTR_TO_BTF_ID Kumar Kartikeya Dwivedi
2021-12-19 2:28 ` Alexei Starovoitov
2021-12-19 3:18 ` Kumar Kartikeya Dwivedi
2021-12-19 4:00 ` Alexei Starovoitov
2021-12-19 4:33 ` Kumar Kartikeya Dwivedi
2021-12-19 5:05 ` Alexei Starovoitov
2021-12-19 5:25 ` Kumar Kartikeya Dwivedi
2021-12-19 17:43 ` Alexei Starovoitov
2021-12-19 18:10 ` Kumar Kartikeya Dwivedi
2021-12-19 19:08 ` Alexei Starovoitov
2021-12-19 19:56 ` Kumar Kartikeya Dwivedi
2021-12-19 21:26 ` Alexei Starovoitov
2021-12-19 21:54 ` Kumar Kartikeya Dwivedi
2021-12-17 1:50 ` [PATCH bpf-next v4 07/10] net/netfilter: Add unstable CT lookup helpers for XDP and TC-BPF Kumar Kartikeya Dwivedi
2021-12-17 8:18 ` Pablo Neira Ayuso [this message]
2021-12-17 8:40 ` Kumar Kartikeya Dwivedi
2021-12-17 1:50 ` [PATCH bpf-next v4 08/10] selftests/bpf: Add test for unstable CT lookup API Kumar Kartikeya Dwivedi
2021-12-17 1:50 ` [PATCH bpf-next v4 09/10] selftests/bpf: Add test_verifier support to fixup kfunc call insns Kumar Kartikeya Dwivedi
2021-12-17 1:50 ` [PATCH bpf-next v4 10/10] selftests/bpf: Extend kfunc selftests Kumar Kartikeya Dwivedi
2021-12-17 9:36 ` [PATCH bpf-next v4 00/10] Introduce unstable CT lookup helpers Kumar Kartikeya Dwivedi
2021-12-17 16:40 ` Andrii Nakryiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YbxHy7yLwMQ7L0mN@salvia \
--to=pablo@netfilter.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=brouer@redhat.com \
--cc=daniel@iogearbox.net \
--cc=fw@strlen.de \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=maximmi@nvidia.com \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=songliubraving@fb.com \
--cc=toke@redhat.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.