From: David Ahern <dsa@cumulusnetworks.com>
To: netdev@vger.kernel.org
Cc: daniel@zonque.org, ast@fb.com, daniel@iogearbox.net,
David Ahern <dsa@cumulusnetworks.com>
Subject: [PATCH net-next 0/3] Add bpf support to set sk_bound_dev_if
Date: Tue, 25 Oct 2016 15:30:10 -0700 [thread overview]
Message-ID: <1477434613-3169-1-git-send-email-dsa@cumulusnetworks.com> (raw)
The recently added VRF support in Linux leverages the bind-to-device
API for programs to specify an L3 domain for a socket. While
SO_BINDTODEVICE has been around for ages, not every ipv4/ipv6 capable
program has support for it. Even for those programs that do support it,
the API requires processes to be started as root (CAP_NET_RAW) which
is not desirable from a general security perspective.
This patch set leverages Daniel Mack's work to attach bpf programs to
a cgroup:
https://www.mail-archive.com/netdev@vger.kernel.org/msg134028.html
to provide a capability to set sk_bound_dev_if for all AF_INET{6}
sockets opened by a process in a cgroup when the sockets are allocated.
This capability enables running any program in a VRF context and is key
to deploying Management VRF, a fundamental configuration for networking
gear, with any Linux OS installation.
David Ahern (3):
bpf: Refactor cgroups code in prep for new type
bpf: Add new cgroups prog type to enable sock modifications
samples: bpf: add userspace example for modifying sk_bound_dev_if
include/linux/filter.h | 2 +-
include/uapi/linux/bpf.h | 15 +++++++
kernel/bpf/cgroup.c | 36 ++++++++++++++---
kernel/bpf/syscall.c | 32 +++++++++------
net/core/filter.c | 92 +++++++++++++++++++++++++++++++++++++++++++
net/core/sock.c | 7 ++++
samples/bpf/Makefile | 2 +
samples/bpf/bpf_helpers.h | 2 +
samples/bpf/test_cgrp2_sock.c | 84 +++++++++++++++++++++++++++++++++++++++
9 files changed, 253 insertions(+), 19 deletions(-)
create mode 100644 samples/bpf/test_cgrp2_sock.c
--
2.1.4
next reply other threads:[~2016-10-25 22:31 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-10-25 22:30 David Ahern [this message]
2016-10-25 22:30 ` [PATCH net-next 1/3] bpf: Refactor cgroups code in prep for new type David Ahern
2016-10-25 23:01 ` Daniel Borkmann
2016-10-25 23:04 ` David Ahern
2016-10-25 22:30 ` [PATCH net-next 2/3] bpf: Add new cgroups prog type to enable sock modifications David Ahern
2016-10-25 23:28 ` Daniel Borkmann
2016-10-26 1:55 ` Alexei Starovoitov
2016-10-26 2:38 ` David Ahern
2016-10-26 2:05 ` David Ahern
2016-10-26 8:33 ` Daniel Borkmann
2016-10-26 15:44 ` David Ahern
[not found] ` <CAF2d9jhE0OHgWrDfHwYzRk2tDbnmK_=ZdgFd2-ccpbTjdQzqmQ@mail.gmail.com>
2016-10-26 20:42 ` David Ahern
2016-10-25 23:39 ` Eric Dumazet
2016-10-26 2:21 ` David Ahern
2016-10-26 2:48 ` Eric Dumazet
2016-10-26 3:09 ` David Ahern
2016-10-26 8:41 ` Thomas Graf
2016-10-26 16:08 ` David Ahern
2016-10-26 18:57 ` Thomas Graf
2016-10-25 22:30 ` [PATCH net-next 3/3] samples: bpf: add userspace example for modifying sk_bound_dev_if David Ahern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1477434613-3169-1-git-send-email-dsa@cumulusnetworks.com \
--to=dsa@cumulusnetworks.com \
--cc=ast@fb.com \
--cc=daniel@iogearbox.net \
--cc=daniel@zonque.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.