From: Stanislav Fomichev <sdf@google.com>
To: Gilad Sever <gilad9366@gmail.com>
Cc: dsahern@kernel.org, martin.lau@linux.dev, daniel@iogearbox.net,
john.fastabend@gmail.com, ast@kernel.org, andrii@kernel.org,
song@kernel.org, yhs@fb.com, kpsingh@kernel.org,
haoluo@google.com, jolsa@kernel.org, davem@davemloft.net,
edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
mykolal@fb.com, shuah@kernel.org, hawk@kernel.org,
joe@wand.net.nz, eyal.birger@gmail.com,
shmulik.ladkani@gmail.com, bpf@vger.kernel.org,
netdev@vger.kernel.org, linux-kselftest@vger.kernel.org
Subject: Re: [PATCH bpf,v2 0/4] Socket lookup BPF API from tc/xdp ingress does not respect VRF bindings.
Date: Thu, 20 Apr 2023 09:42:26 -0700 [thread overview]
Message-ID: <ZEFrcoG+QS/PRbew@google.com> (raw)
In-Reply-To: <20230420145041.508434-1-gilad9366@gmail.com>
On 04/20, Gilad Sever wrote:
> When calling socket lookup from L2 (tc, xdp), VRF boundaries aren't
> respected. This patchset fixes this by regarding the incoming device's
> VRF attachment when performing the socket lookups from tc/xdp.
>
> The first two patches are coding changes which facilitate this fix by
> factoring out the tc helper's logic which was shared with cg/sk_skb
> (which operate correctly).
Why is not relevant for cgroup/egress? Is it already running with
the correct device?
Also, do we really need all this refactoring and separate paths?
Can we just add that bpf_l2_sdif part to the existing code?
It will trigger for tc, but I'm assuming it will be a no-op for cgroup
path?
And regarding bpf_l2_sdif: seems like it's really generic and should
probably be called something like dev_sdif?
> The third patch contains the actual bugfix.
>
> The fourth patch adds bpf tests for these lookup functions.
> ---
> v2: Fixed uninitialized var in test patch (4).
>
> Gilad Sever (4):
> bpf: factor out socket lookup functions for the TC hookpoint.
> bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC
> hookpoint
> bpf: fix bpf socket lookup from tc/xdp to respect socket VRF bindings
> selftests/bpf: Add tc_socket_lookup tests
>
> net/core/filter.c | 132 +++++--
> .../bpf/prog_tests/tc_socket_lookup.c | 341 ++++++++++++++++++
> .../selftests/bpf/progs/tc_socket_lookup.c | 73 ++++
> 3 files changed, 525 insertions(+), 21 deletions(-)
> create mode 100644 tools/testing/selftests/bpf/prog_tests/tc_socket_lookup.c
> create mode 100644 tools/testing/selftests/bpf/progs/tc_socket_lookup.c
>
> --
> 2.34.1
>
next prev parent reply other threads:[~2023-04-20 16:42 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-20 14:50 [PATCH bpf,v2 0/4] Socket lookup BPF API from tc/xdp ingress does not respect VRF bindings Gilad Sever
2023-04-20 14:50 ` [PATCH bpf,v2 1/4] bpf: factor out socket lookup functions for the TC hookpoint Gilad Sever
2023-04-20 14:50 ` [PATCH bpf,v2 2/4] bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via " Gilad Sever
2023-04-20 14:50 ` [PATCH bpf,v2 3/4] bpf: fix bpf socket lookup from tc/xdp to respect socket VRF bindings Gilad Sever
2023-04-20 14:50 ` [PATCH bpf,v2 4/4] selftests/bpf: Add tc_socket_lookup tests Gilad Sever
2023-04-20 16:44 ` Stanislav Fomichev
2023-04-21 17:01 ` Daniel Borkmann
2023-04-23 9:31 ` Gilad Sever
2023-04-24 17:06 ` Stanislav Fomichev
2023-04-20 16:42 ` Stanislav Fomichev [this message]
2023-04-23 11:41 ` [PATCH bpf,v2 0/4] Socket lookup BPF API from tc/xdp ingress does not respect VRF bindings Gilad Sever
2023-04-24 17:06 ` Stanislav Fomichev
2023-04-25 1:39 ` David Ahern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZEFrcoG+QS/PRbew@google.com \
--to=sdf@google.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=eyal.birger@gmail.com \
--cc=gilad9366@gmail.com \
--cc=haoluo@google.com \
--cc=hawk@kernel.org \
--cc=joe@wand.net.nz \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=mykolal@fb.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=shmulik.ladkani@gmail.com \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.