[PATCH bpf-next 0/2] bpf: Add sock ops get netns helpers

[PATCH bpf-next 0/2] bpf: Add sock ops get netns helpers

[Lingpeng Chen]

Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
uniq connection because there may be multi net namespace.
For example, there may be a chance that netns a and netns b all
listen on 127.0.0.1:8080 and the client with same port 40782
connect to them. Without netns number, sock ops program
can't distinguish them.
Using bpf_sock_ops_get_netns helpers to get current connection
netns number to distinguish connections.

Lingpeng Chen (2):
  bpf: Add sock ops get netns helpers
  bpf: Sync uapi bpf.h to tools/

 include/uapi/linux/bpf.h       |  8 +++++++-
 net/core/filter.c              | 18 ++++++++++++++++++
 tools/include/uapi/linux/bpf.h |  8 +++++++-
 3 files changed, 32 insertions(+), 2 deletions(-)


-- 
2.17.1

[PATCH bpf-next 1/2] bpf: Add sock ops get netns helpers

[Lingpeng Chen]

Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
uniq connection because there may be multi net namespace.
For example, there may be a chance that netns a and netns b all
listen on 127.0.0.1:8080 and the client with same port 40782
connect to them. Without netns number, sock ops program
can't distinguish them.
Using bpf_sock_ops_get_netns helpers to get current connection
netns number to distinguish connections.

Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
---
 include/uapi/linux/bpf.h |  8 +++++++-
 net/core/filter.c        | 18 ++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index f1d74a2bd234..b15a55051232 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2892,6 +2892,11 @@ union bpf_attr {
  *		Obtain the 64bit jiffies
  *	Return
  *		The 64 bit jiffies
+ * u32 bpf_sock_ops_get_netns(struct bpf_sock_ops *bpf_socket)
+ *  Description
+ *      Obtain netns id of sock
+ * Return
+ *      The current netns inum
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -3012,7 +3017,8 @@ union bpf_attr {
 	FN(probe_read_kernel_str),	\
 	FN(tcp_send_ack),		\
 	FN(send_signal_thread),		\
-	FN(jiffies64),
+	FN(jiffies64),		\
+	FN(sock_ops_get_netns),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
diff --git a/net/core/filter.c b/net/core/filter.c
index 792e3744b915..b7f33f20e8fb 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4421,6 +4421,22 @@ static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = {
 	.arg2_type	= ARG_ANYTHING,
 };
 
+BPF_CALL_1(bpf_sock_ops_get_netns, struct bpf_sock_ops_kern *, bpf_sock)
+{
+	struct sock *sk = bpf_sock->sk;
+
+	if (!IS_ENABLED(CONFIG_NET_NS))
+		return 0;
+	return sk->sk_net.net->ns.inum;
+}
+
+static const struct bpf_func_proto bpf_sock_ops_get_netns_proto = {
+	.func		= bpf_sock_ops_get_netns,
+	.gpl_only	= false,
+	.ret_type	= RET_INTEGER,
+	.arg1_type	= ARG_PTR_TO_CTX,
+};
+
 const struct ipv6_bpf_stub *ipv6_bpf_stub __read_mostly;
 EXPORT_SYMBOL_GPL(ipv6_bpf_stub);
 
@@ -6218,6 +6234,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 	case BPF_FUNC_tcp_sock:
 		return &bpf_tcp_sock_proto;
 #endif /* CONFIG_INET */
+	case BPF_FUNC_sock_ops_get_netns:
+		return &bpf_sock_ops_get_netns_proto;
 	default:
 		return bpf_base_func_proto(func_id);
 	}
-- 
2.17.1

[PATCH bpf-next 2/2] bpf: Sync uapi bpf.h to tools/

[Lingpeng Chen]

This patch sync uapi bpf.h to tools/.

Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
---
 tools/include/uapi/linux/bpf.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index f1d74a2bd234..b15a55051232 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2892,6 +2892,11 @@ union bpf_attr {
  *		Obtain the 64bit jiffies
  *	Return
  *		The 64 bit jiffies
+ * u32 bpf_sock_ops_get_netns(struct bpf_sock_ops *bpf_socket)
+ *  Description
+ *      Obtain netns id of sock
+ * Return
+ *      The current netns inum
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -3012,7 +3017,8 @@ union bpf_attr {
 	FN(probe_read_kernel_str),	\
 	FN(tcp_send_ack),		\
 	FN(send_signal_thread),		\
-	FN(jiffies64),
+	FN(jiffies64),		\
+	FN(sock_ops_get_netns),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
-- 
2.17.1

Re: [PATCH bpf-next 1/2] bpf: Add sock ops get netns helpers

[Petar Penkov]

On Thu, Feb 6, 2020 at 12:36 AM Lingpeng Chen <forrest0579@gmail.com> wrote:
>
> Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
> uniq connection because there may be multi net namespace.
> For example, there may be a chance that netns a and netns b all
> listen on 127.0.0.1:8080 and the client with same port 40782
> connect to them. Without netns number, sock ops program
> can't distinguish them.
> Using bpf_sock_ops_get_netns helpers to get current connection
> netns number to distinguish connections.
>
> Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
> ---
>  include/uapi/linux/bpf.h |  8 +++++++-
>  net/core/filter.c        | 18 ++++++++++++++++++
>  2 files changed, 25 insertions(+), 1 deletion(-)
>
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index f1d74a2bd234..b15a55051232 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -2892,6 +2892,11 @@ union bpf_attr {
>   *             Obtain the 64bit jiffies
>   *     Return
>   *             The 64 bit jiffies
> + * u32 bpf_sock_ops_get_netns(struct bpf_sock_ops *bpf_socket)
Should this return u64 instead? Also, would it make sense here to add
a 'u64 flags' field to allow some extensibility of this helper
function, consistent with some other helpers. Initially, we can reject
any flags with:
if (unlikely(flags))
        return -EINVAL;

Last, I was hoping we could add a regression test for this helper.

Thanks,
Petar

> + *  Description
> + *      Obtain netns id of sock
> + * Return
> + *      The current netns inum
>   */
>  #define __BPF_FUNC_MAPPER(FN)          \
>         FN(unspec),                     \
> @@ -3012,7 +3017,8 @@ union bpf_attr {
>         FN(probe_read_kernel_str),      \
>         FN(tcp_send_ack),               \
>         FN(send_signal_thread),         \
> -       FN(jiffies64),
> +       FN(jiffies64),          \
> +       FN(sock_ops_get_netns),
>
>  /* integer value in 'imm' field of BPF_CALL instruction selects which helper
>   * function eBPF program intends to call
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 792e3744b915..b7f33f20e8fb 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -4421,6 +4421,22 @@ static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = {
>         .arg2_type      = ARG_ANYTHING,
>  };
>
> +BPF_CALL_1(bpf_sock_ops_get_netns, struct bpf_sock_ops_kern *, bpf_sock)
> +{
> +       struct sock *sk = bpf_sock->sk;
> +
> +       if (!IS_ENABLED(CONFIG_NET_NS))
> +               return 0;
> +       return sk->sk_net.net->ns.inum;
> +}
> +
> +static const struct bpf_func_proto bpf_sock_ops_get_netns_proto = {
> +       .func           = bpf_sock_ops_get_netns,
> +       .gpl_only       = false,
> +       .ret_type       = RET_INTEGER,
> +       .arg1_type      = ARG_PTR_TO_CTX,
> +};
> +
>  const struct ipv6_bpf_stub *ipv6_bpf_stub __read_mostly;
>  EXPORT_SYMBOL_GPL(ipv6_bpf_stub);
>
> @@ -6218,6 +6234,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>         case BPF_FUNC_tcp_sock:
>                 return &bpf_tcp_sock_proto;
>  #endif /* CONFIG_INET */
> +       case BPF_FUNC_sock_ops_get_netns:
> +               return &bpf_sock_ops_get_netns_proto;
>         default:
>                 return bpf_base_func_proto(func_id);
>         }
> --
> 2.17.1
>

Re: [PATCH bpf-next 1/2] bpf: Add sock ops get netns helpers

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 3017 bytes --]

Hi Lingpeng,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on bpf-next/master]
[also build test ERROR on bpf/master]
[cannot apply to v5.5]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system. BTW, we also suggest to use '--base' option to specify the
base tree in git format-patch, please see https://stackoverflow.com/a/37406982]

url:    https://github.com/0day-ci/linux/commits/Lingpeng-Chen/bpf-Add-sock-ops-get-netns-helpers/20200207-212755
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
config: h8300-randconfig-a001-20200207 (attached as .config)
compiler: h8300-linux-gcc (GCC) 7.5.0
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        GCC_VERSION=7.5.0 make.cross ARCH=h8300 

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   In file included from arch/h8300/include/asm/atomic.h:7:0,
                    from include/linux/atomic.h:7,
                    from include/asm-generic/bitops/lock.h:5,
                    from arch/h8300/include/asm/bitops.h:170,
                    from include/linux/bitops.h:26,
                    from include/linux/kernel.h:12,
                    from include/linux/list.h:9,
                    from include/linux/module.h:12,
                    from net/core/filter.c:20:
   net/core/filter.c: In function 'bpf_clear_redirect_map':
   arch/h8300/include/asm/cmpxchg.h:54:3: warning: value computed is not used [-Wunused-value]
     ((__typeof__(*(ptr)))__cmpxchg_local_generic((ptr),   \
     ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
               (unsigned long)(o), \
               ~~~~~~~~~~~~~~~~~~~~~
               (unsigned long)(n), \
               ~~~~~~~~~~~~~~~~~~~~~
               sizeof(*(ptr))))
               ~~~~~~~~~~~~~~~~
   include/asm-generic/cmpxchg.h:106:28: note: in expansion of macro 'cmpxchg_local'
    #define cmpxchg(ptr, o, n) cmpxchg_local((ptr), (o), (n))
                               ^~~~~~~~~~~~~
   net/core/filter.c:3516:4: note: in expansion of macro 'cmpxchg'
       cmpxchg(&ri->map, map, NULL);
       ^~~~~~~
   net/core/filter.c: In function '____bpf_sock_ops_get_netns':
>> net/core/filter.c:4430:19: error: 'possible_net_t {aka struct <anonymous>}' has no member named 'net'
     return sk->sk_net.net->ns.inum;
                      ^

vim +4430 net/core/filter.c

  4423	
  4424	BPF_CALL_1(bpf_sock_ops_get_netns, struct bpf_sock_ops_kern *, bpf_sock)
  4425	{
  4426		struct sock *sk = bpf_sock->sk;
  4427	
  4428		if (!IS_ENABLED(CONFIG_NET_NS))
  4429			return 0;
> 4430		return sk->sk_net.net->ns.inum;
  4431	}
  4432	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 20701 bytes --]

Re: [PATCH bpf-next 1/2] bpf: Add sock ops get netns helpers

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 3091 bytes --]

Hi Lingpeng,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on bpf-next/master]
[also build test ERROR on bpf/master]
[cannot apply to v5.5]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system. BTW, we also suggest to use '--base' option to specify the
base tree in git format-patch, please see https://stackoverflow.com/a/37406982]

url:    https://github.com/0day-ci/linux/commits/Lingpeng-Chen/bpf-Add-sock-ops-get-netns-helpers/20200207-212755
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
config: h8300-randconfig-a001-20200207 (attached as .config)
compiler: h8300-linux-gcc (GCC) 7.5.0
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        GCC_VERSION=7.5.0 make.cross ARCH=h8300 

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   In file included from arch/h8300/include/asm/atomic.h:7:0,
                    from include/linux/atomic.h:7,
                    from include/asm-generic/bitops/lock.h:5,
                    from arch/h8300/include/asm/bitops.h:170,
                    from include/linux/bitops.h:26,
                    from include/linux/kernel.h:12,
                    from include/linux/list.h:9,
                    from include/linux/module.h:12,
                    from net/core/filter.c:20:
   net/core/filter.c: In function 'bpf_clear_redirect_map':
   arch/h8300/include/asm/cmpxchg.h:54:3: warning: value computed is not used [-Wunused-value]
     ((__typeof__(*(ptr)))__cmpxchg_local_generic((ptr),   \
     ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
               (unsigned long)(o), \
               ~~~~~~~~~~~~~~~~~~~~~
               (unsigned long)(n), \
               ~~~~~~~~~~~~~~~~~~~~~
               sizeof(*(ptr))))
               ~~~~~~~~~~~~~~~~
   include/asm-generic/cmpxchg.h:106:28: note: in expansion of macro 'cmpxchg_local'
    #define cmpxchg(ptr, o, n) cmpxchg_local((ptr), (o), (n))
                               ^~~~~~~~~~~~~
   net/core/filter.c:3516:4: note: in expansion of macro 'cmpxchg'
       cmpxchg(&ri->map, map, NULL);
       ^~~~~~~
   net/core/filter.c: In function '____bpf_sock_ops_get_netns':
>> net/core/filter.c:4430:19: error: 'possible_net_t {aka struct <anonymous>}' has no member named 'net'
     return sk->sk_net.net->ns.inum;
                      ^

vim +4430 net/core/filter.c

  4423	
  4424	BPF_CALL_1(bpf_sock_ops_get_netns, struct bpf_sock_ops_kern *, bpf_sock)
  4425	{
  4426		struct sock *sk = bpf_sock->sk;
  4427	
  4428		if (!IS_ENABLED(CONFIG_NET_NS))
  4429			return 0;
> 4430		return sk->sk_net.net->ns.inum;
  4431	}
  4432	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 20701 bytes --]

[PATCH v2 bpf-next 0/3] bpf: Add sock_ops_get_netns helpers

[Lingpeng Chen]

Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
uniq connection because there may be multi net namespace.
For example, there may be a chance that netns a and netns b all
listen on 127.0.0.1:8080 and the client with same port 40782
connect to them. Without netns number, sock ops program
can't distinguish them.
Using bpf_sock_ops_get_netns helpers to get current connection
netns number to distinguish connections.

Changes in v2:
- Return u64 instead of u32 for sock_ops_get_netns
- Fix build bug when CONFIG_NET_NS not set
- Add selftest for sock_ops_get_netns

Lingpeng Chen (3):
  bpf: Add sock ops get netns helpers
  bpf: Sync uapi bpf.h to tools/
  selftests/bpf: add selftest for sock_ops_get_netns helper

 include/uapi/linux/bpf.h                      |  8 +++-
 net/core/filter.c                             | 19 ++++++++
 tools/include/uapi/linux/bpf.h                |  8 +++-
 .../selftests/bpf/progs/test_tcpbpf_kern.c    | 11 +++++
 .../testing/selftests/bpf/test_tcpbpf_user.c  | 46 ++++++++++++++++++-
 5 files changed, 89 insertions(+), 3 deletions(-)


base-commit bb6d3fb354c5 ("Linux 5.6-rc1")
-- 
2.20.1

[PATCH v2 bpf-next 1/3] bpf: Add sock ops get netns helpers

[Lingpeng Chen]

Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
uniq connection because there may be multi net namespace.
For example, there may be a chance that netns a and netns b all
listen on 127.0.0.1:8080 and the client with same port 40782
connect to them. Without netns number, sock ops program
can't distinguish them.
Using bpf_sock_ops_get_netns helpers to get current connection
netns number to distinguish connections.

Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
---
 include/uapi/linux/bpf.h |  8 +++++++-
 net/core/filter.c        | 19 +++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index f1d74a2bd234..3573907d15e0 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2892,6 +2892,11 @@ union bpf_attr {
  *		Obtain the 64bit jiffies
  *	Return
  *		The 64 bit jiffies
+ * u64 bpf_sock_ops_get_netns(struct bpf_sock_ops *bpf_socket)
+ *  Description
+ *      Obtain netns id of sock
+ * Return
+ *      The current netns inum
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -3012,7 +3017,8 @@ union bpf_attr {
 	FN(probe_read_kernel_str),	\
 	FN(tcp_send_ack),		\
 	FN(send_signal_thread),		\
-	FN(jiffies64),
+	FN(jiffies64),			\
+	FN(sock_ops_get_netns),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
diff --git a/net/core/filter.c b/net/core/filter.c
index c180871e606d..f8e946aa46fc 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4421,6 +4421,23 @@ static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = {
 	.arg2_type	= ARG_ANYTHING,
 };
 
+BPF_CALL_1(bpf_sock_ops_get_netns, struct bpf_sock_ops_kern *, bpf_sock)
+{
+#ifdef CONFIG_NET_NS
+	struct sock *sk = bpf_sock->sk;
+
+	return (u64)sk->sk_net.net->ns.inum;
+#endif
+	return 0;
+}
+
+static const struct bpf_func_proto bpf_sock_ops_get_netns_proto = {
+	.func		= bpf_sock_ops_get_netns,
+	.gpl_only	= false,
+	.ret_type	= RET_INTEGER,
+	.arg1_type	= ARG_PTR_TO_CTX,
+};
+
 const struct ipv6_bpf_stub *ipv6_bpf_stub __read_mostly;
 EXPORT_SYMBOL_GPL(ipv6_bpf_stub);
 
@@ -6218,6 +6235,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 	case BPF_FUNC_tcp_sock:
 		return &bpf_tcp_sock_proto;
 #endif /* CONFIG_INET */
+	case BPF_FUNC_sock_ops_get_netns:
+		return &bpf_sock_ops_get_netns_proto;
 	default:
 		return bpf_base_func_proto(func_id);
 	}
-- 
2.20.1

[PATCH v2 bpf-next 2/3] bpf: Sync uapi bpf.h to tools/

[Lingpeng Chen]

This patch sync uapi bpf.h to tools/.

Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
---
 tools/include/uapi/linux/bpf.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index f1d74a2bd234..3573907d15e0 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2892,6 +2892,11 @@ union bpf_attr {
  *		Obtain the 64bit jiffies
  *	Return
  *		The 64 bit jiffies
+ * u64 bpf_sock_ops_get_netns(struct bpf_sock_ops *bpf_socket)
+ *  Description
+ *      Obtain netns id of sock
+ * Return
+ *      The current netns inum
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -3012,7 +3017,8 @@ union bpf_attr {
 	FN(probe_read_kernel_str),	\
 	FN(tcp_send_ack),		\
 	FN(send_signal_thread),		\
-	FN(jiffies64),
+	FN(jiffies64),			\
+	FN(sock_ops_get_netns),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
-- 
2.20.1

[PATCH v2 bpf-next 3/3] selftests/bpf: add selftest for sock_ops_get_netns helper

[Lingpeng Chen]

adding selftest for new bpf helper function sock_ops_get_netns

Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
---
 .../selftests/bpf/progs/test_tcpbpf_kern.c    | 11 +++++
 .../testing/selftests/bpf/test_tcpbpf_user.c  | 46 ++++++++++++++++++-
 2 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
index 1f1966e86e9f..044967f70432 100644
--- a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
@@ -28,6 +28,13 @@ struct {
 	__type(value, int);
 } sockopt_results SEC(".maps");
 
+struct {
+	__uint(type, BPF_MAP_TYPE_ARRAY);
+	__uint(max_entries, 1);
+	__type(key, __u32);
+	__type(value, __u64);
+} netns_number SEC(".maps");
+
 static inline void update_event_map(int event)
 {
 	__u32 key = 0;
@@ -61,6 +68,7 @@ int bpf_testcb(struct bpf_sock_ops *skops)
 	int rv = -1;
 	int v = 0;
 	int op;
+	__u64 netns_inum;
 
 	op = (int) skops->op;
 
@@ -144,6 +152,9 @@ int bpf_testcb(struct bpf_sock_ops *skops)
 		__u32 key = 0;
 
 		bpf_map_update_elem(&sockopt_results, &key, &v, BPF_ANY);
+
+		netns_inum = bpf_sock_ops_get_netns(skops);
+		bpf_map_update_elem(&netns_number, &key, &netns_inum, BPF_ANY);
 		break;
 	default:
 		rv = -1;
diff --git a/tools/testing/selftests/bpf/test_tcpbpf_user.c b/tools/testing/selftests/bpf/test_tcpbpf_user.c
index 3ae127620463..77a344f41310 100644
--- a/tools/testing/selftests/bpf/test_tcpbpf_user.c
+++ b/tools/testing/selftests/bpf/test_tcpbpf_user.c
@@ -76,6 +76,41 @@ int verify_sockopt_result(int sock_map_fd)
 	return ret;
 }
 
+int verify_netns(__u64 netns_inum)
+{
+	char buf1[40];
+	char buf2[40];
+	int ret = 0;
+	ssize_t len = 0;
+
+	len = readlink("/proc/self/ns/net", buf1, 39);
+	sprintf(buf2, "net:[%llu]", netns_inum);
+
+	if (len <= 0) {
+		printf("FAILED: readlink /proc/self/ns/net");
+		return ret;
+	}
+
+	if (strncmp(buf1, buf2, len)) {
+		printf("FAILED: netns don't match");
+		ret = 1;
+	}
+	return ret;
+}
+
+int verify_netns_result(int netns_map_fd)
+{
+	__u32 key = 0;
+	__u64 res = 0;
+	int ret = 0;
+	int rv;
+
+	rv = bpf_map_lookup_elem(netns_map_fd, &key, &res);
+	EXPECT_EQ(0, rv, "d");
+
+	return verify_netns(res);
+}
+
 static int bpf_find_map(const char *test, struct bpf_object *obj,
 			const char *name)
 {
@@ -92,7 +127,7 @@ static int bpf_find_map(const char *test, struct bpf_object *obj,
 int main(int argc, char **argv)
 {
 	const char *file = "test_tcpbpf_kern.o";
-	int prog_fd, map_fd, sock_map_fd;
+	int prog_fd, map_fd, sock_map_fd, netns_map_fd;
 	struct tcpbpf_globals g = {0};
 	const char *cg_path = "/foo";
 	int error = EXIT_FAILURE;
@@ -137,6 +172,10 @@ int main(int argc, char **argv)
 	if (sock_map_fd < 0)
 		goto err;
 
+	netns_map_fd = bpf_find_map(__func__, obj, "netns_number");
+	if (netns_map_fd < 0)
+		goto err;
+
 retry_lookup:
 	rv = bpf_map_lookup_elem(map_fd, &key, &g);
 	if (rv != 0) {
@@ -161,6 +200,11 @@ int main(int argc, char **argv)
 		goto err;
 	}
 
+	if (verify_netns_result(netns_map_fd)) {
+		printf("FAILED: Wrong netns stats\n");
+		goto err;
+	}
+
 	printf("PASSED!\n");
 	error = 0;
 err:
-- 
2.20.1

Re: [PATCH v2 bpf-next 1/3] bpf: Add sock ops get netns helpers

[Daniel Borkmann]

On 2/18/20 10:15 AM, Lingpeng Chen wrote:
> Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
> uniq connection because there may be multi net namespace.
> For example, there may be a chance that netns a and netns b all
> listen on 127.0.0.1:8080 and the client with same port 40782
> connect to them. Without netns number, sock ops program
> can't distinguish them.
> Using bpf_sock_ops_get_netns helpers to get current connection
> netns number to distinguish connections.
> 
> Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
> ---
>   include/uapi/linux/bpf.h |  8 +++++++-
>   net/core/filter.c        | 19 +++++++++++++++++++
>   2 files changed, 26 insertions(+), 1 deletion(-)
> 
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index f1d74a2bd234..3573907d15e0 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -2892,6 +2892,11 @@ union bpf_attr {
>    *		Obtain the 64bit jiffies
>    *	Return
>    *		The 64 bit jiffies
> + * u64 bpf_sock_ops_get_netns(struct bpf_sock_ops *bpf_socket)

Nit: newline before the new helper signature starts above.

> + *  Description
> + *      Obtain netns id of sock
> + * Return
> + *      The current netns inum
>    */
>   #define __BPF_FUNC_MAPPER(FN)		\
>   	FN(unspec),			\
> @@ -3012,7 +3017,8 @@ union bpf_attr {
>   	FN(probe_read_kernel_str),	\
>   	FN(tcp_send_ack),		\
>   	FN(send_signal_thread),		\
> -	FN(jiffies64),
> +	FN(jiffies64),			\
> +	FN(sock_ops_get_netns),

Please name this something more generic like FN(get_netns_id) or such. Definitely
without the 'sock_ops' part so this can be remapped to various other prog types
for the *_func_proto().

>   
>   /* integer value in 'imm' field of BPF_CALL instruction selects which helper
>    * function eBPF program intends to call
> diff --git a/net/core/filter.c b/net/core/filter.c
> index c180871e606d..f8e946aa46fc 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -4421,6 +4421,23 @@ static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = {
>   	.arg2_type	= ARG_ANYTHING,
>   };
>   
> +BPF_CALL_1(bpf_sock_ops_get_netns, struct bpf_sock_ops_kern *, bpf_sock)
> +{
> +#ifdef CONFIG_NET_NS
> +	struct sock *sk = bpf_sock->sk;
> +
> +	return (u64)sk->sk_net.net->ns.inum;
> +#endif
> +	return 0;
> +}
> +
> +static const struct bpf_func_proto bpf_sock_ops_get_netns_proto = {
> +	.func		= bpf_sock_ops_get_netns,
> +	.gpl_only	= false,
> +	.ret_type	= RET_INTEGER,
> +	.arg1_type	= ARG_PTR_TO_CTX,
> +};
> +
>   const struct ipv6_bpf_stub *ipv6_bpf_stub __read_mostly;
>   EXPORT_SYMBOL_GPL(ipv6_bpf_stub);
>   
> @@ -6218,6 +6235,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>   	case BPF_FUNC_tcp_sock:
>   		return &bpf_tcp_sock_proto;
>   #endif /* CONFIG_INET */
> +	case BPF_FUNC_sock_ops_get_netns:
> +		return &bpf_sock_ops_get_netns_proto;
>   	default:
>   		return bpf_base_func_proto(func_id);
>   	}
> 

[PATCH v3 bpf-next 0/3] bpf: Add get_netns_id helper for sock_ops

[Lingpeng Chen]

Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
uniq connection because there may be multi net namespace.
For example, there may be a chance that netns a and netns b all
listen on 127.0.0.1:8080 and the client with same port 40782
connect to them. Without netns number, sock ops program
can't distinguish them.
Using bpf_get_netns_id helpers to get current connection
netns number to distinguish connections.

Changes in v3:
- rename sock_ops_get_netns to get_netns_id

Changes in v2:
- Return u64 instead of u32 for sock_ops_get_netns
- Fix build bug when CONFIG_NET_NS not set
- Add selftest for sock_ops_get_netns

Lingpeng Chen (3):
  bpf: Add get_netns_id helper function for sock_ops
  bpf: Sync uapi bpf.h to tools/
  selftests/bpf: add selftest for get_netns_id helper

 include/uapi/linux/bpf.h                      |  9 +++-
 net/core/filter.c                             | 20 ++++++++
 tools/include/uapi/linux/bpf.h                |  9 +++-
 .../selftests/bpf/progs/test_tcpbpf_kern.c    | 11 +++++
 .../testing/selftests/bpf/test_tcpbpf_user.c  | 46 ++++++++++++++++++-
 5 files changed, 92 insertions(+), 3 deletions(-)


base-commit bb6d3fb354c5 ("Linux 5.6-rc1")
-- 
2.20.1

[PATCH v3 bpf-next 1/3] bpf: Add get_netns_id helper function for sock_ops

[Lingpeng Chen]

Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
uniq connection because there may be multi net namespace.
For example, there may be a chance that netns a and netns b all
listen on 127.0.0.1:8080 and the client with same port 40782
connect to them. Without netns number, sock ops program
can't distinguish them.
Using bpf_get_netns_id helper to get current connection
netns id to distinguish connections.

Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
---
 include/uapi/linux/bpf.h |  9 ++++++++-
 net/core/filter.c        | 20 ++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index f1d74a2bd234..e79082f78b74 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2892,6 +2892,12 @@ union bpf_attr {
  *		Obtain the 64bit jiffies
  *	Return
  *		The 64 bit jiffies
+ *
+ * u64 bpf_get_netns_id(struct bpf_sock_ops *bpf_socket)
+ *  Description
+ *      Obtain netns id of sock
+ * Return
+ *      The current netns inum
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -3012,7 +3018,8 @@ union bpf_attr {
 	FN(probe_read_kernel_str),	\
 	FN(tcp_send_ack),		\
 	FN(send_signal_thread),		\
-	FN(jiffies64),
+	FN(jiffies64),			\
+	FN(get_netns_id),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
diff --git a/net/core/filter.c b/net/core/filter.c
index c180871e606d..5302ec9f7c0d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4421,6 +4421,24 @@ static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = {
 	.arg2_type	= ARG_ANYTHING,
 };
 
+BPF_CALL_1(bpf_get_netns_id_sock_ops, struct bpf_sock_ops_kern *, bpf_sock)
+{
+#ifdef CONFIG_NET_NS
+	struct sock *sk = bpf_sock->sk;
+
+	return (u64)sk->sk_net.net->ns.inum;
+#else
+	return 0;
+#endif
+}
+
+static const struct bpf_func_proto bpf_get_netns_id_sock_ops_proto = {
+	.func		= bpf_get_netns_id_sock_ops,
+	.gpl_only	= false,
+	.ret_type	= RET_INTEGER,
+	.arg1_type	= ARG_PTR_TO_CTX,
+};
+
 const struct ipv6_bpf_stub *ipv6_bpf_stub __read_mostly;
 EXPORT_SYMBOL_GPL(ipv6_bpf_stub);
 
@@ -6218,6 +6236,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 	case BPF_FUNC_tcp_sock:
 		return &bpf_tcp_sock_proto;
 #endif /* CONFIG_INET */
+	case BPF_FUNC_get_netns_id:
+		return &bpf_get_netns_id_sock_ops_proto;
 	default:
 		return bpf_base_func_proto(func_id);
 	}
-- 
2.20.1

[PATCH v3 bpf-next 2/3] bpf: Sync uapi bpf.h to tools/

[Lingpeng Chen]

This patch sync uapi bpf.h to tools/.

Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
---
 tools/include/uapi/linux/bpf.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index f1d74a2bd234..e79082f78b74 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2892,6 +2892,12 @@ union bpf_attr {
  *		Obtain the 64bit jiffies
  *	Return
  *		The 64 bit jiffies
+ *
+ * u64 bpf_get_netns_id(struct bpf_sock_ops *bpf_socket)
+ *  Description
+ *      Obtain netns id of sock
+ * Return
+ *      The current netns inum
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -3012,7 +3018,8 @@ union bpf_attr {
 	FN(probe_read_kernel_str),	\
 	FN(tcp_send_ack),		\
 	FN(send_signal_thread),		\
-	FN(jiffies64),
+	FN(jiffies64),			\
+	FN(get_netns_id),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
-- 
2.20.1

[PATCH v3 bpf-next 3/3] selftests/bpf: add selftest for get_netns_id helper

[Lingpeng Chen]

adding selftest for new bpf helper function get_netns_id

Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
---
 .../selftests/bpf/progs/test_tcpbpf_kern.c    | 11 +++++
 .../testing/selftests/bpf/test_tcpbpf_user.c  | 46 ++++++++++++++++++-
 2 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
index 1f1966e86e9f..d7d851ddd2cc 100644
--- a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
@@ -28,6 +28,13 @@ struct {
 	__type(value, int);
 } sockopt_results SEC(".maps");
 
+struct {
+	__uint(type, BPF_MAP_TYPE_ARRAY);
+	__uint(max_entries, 1);
+	__type(key, __u32);
+	__type(value, __u64);
+} netns_number SEC(".maps");
+
 static inline void update_event_map(int event)
 {
 	__u32 key = 0;
@@ -61,6 +68,7 @@ int bpf_testcb(struct bpf_sock_ops *skops)
 	int rv = -1;
 	int v = 0;
 	int op;
+	__u64 netns_id;
 
 	op = (int) skops->op;
 
@@ -144,6 +152,9 @@ int bpf_testcb(struct bpf_sock_ops *skops)
 		__u32 key = 0;
 
 		bpf_map_update_elem(&sockopt_results, &key, &v, BPF_ANY);
+
+		netns_id = bpf_get_netns_id(skops);
+		bpf_map_update_elem(&netns_number, &key, &netns_id, BPF_ANY);
 		break;
 	default:
 		rv = -1;
diff --git a/tools/testing/selftests/bpf/test_tcpbpf_user.c b/tools/testing/selftests/bpf/test_tcpbpf_user.c
index 3ae127620463..fef2f4d77ecc 100644
--- a/tools/testing/selftests/bpf/test_tcpbpf_user.c
+++ b/tools/testing/selftests/bpf/test_tcpbpf_user.c
@@ -76,6 +76,41 @@ int verify_sockopt_result(int sock_map_fd)
 	return ret;
 }
 
+int verify_netns(__u64 netns_id)
+{
+	char buf1[40];
+	char buf2[40];
+	int ret = 0;
+	ssize_t len = 0;
+
+	len = readlink("/proc/self/ns/net", buf1, 39);
+	sprintf(buf2, "net:[%llu]", netns_id);
+
+	if (len <= 0) {
+		printf("FAILED: readlink /proc/self/ns/net");
+		return ret;
+	}
+
+	if (strncmp(buf1, buf2, len)) {
+		printf("FAILED: netns don't match");
+		ret = 1;
+	}
+	return ret;
+}
+
+int verify_netns_result(int netns_map_fd)
+{
+	__u32 key = 0;
+	__u64 res = 0;
+	int ret = 0;
+	int rv;
+
+	rv = bpf_map_lookup_elem(netns_map_fd, &key, &res);
+	EXPECT_EQ(0, rv, "d");
+
+	return verify_netns(res);
+}
+
 static int bpf_find_map(const char *test, struct bpf_object *obj,
 			const char *name)
 {
@@ -92,7 +127,7 @@ static int bpf_find_map(const char *test, struct bpf_object *obj,
 int main(int argc, char **argv)
 {
 	const char *file = "test_tcpbpf_kern.o";
-	int prog_fd, map_fd, sock_map_fd;
+	int prog_fd, map_fd, sock_map_fd, netns_map_fd;
 	struct tcpbpf_globals g = {0};
 	const char *cg_path = "/foo";
 	int error = EXIT_FAILURE;
@@ -137,6 +172,10 @@ int main(int argc, char **argv)
 	if (sock_map_fd < 0)
 		goto err;
 
+	netns_map_fd = bpf_find_map(__func__, obj, "netns_number");
+	if (netns_map_fd < 0)
+		goto err;
+
 retry_lookup:
 	rv = bpf_map_lookup_elem(map_fd, &key, &g);
 	if (rv != 0) {
@@ -161,6 +200,11 @@ int main(int argc, char **argv)
 		goto err;
 	}
 
+	if (verify_netns_result(netns_map_fd)) {
+		printf("FAILED: Wrong netns stats\n");
+		goto err;
+	}
+
 	printf("PASSED!\n");
 	error = 0;
 err:
-- 
2.20.1

Re: [PATCH v3 bpf-next 1/3] bpf: Add get_netns_id helper function for sock_ops

[Song Liu]

On Wed, Feb 19, 2020 at 11:11 PM Lingpeng Chen <forrest0579@gmail.com> wrote:
>
> Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
> uniq connection because there may be multi net namespace.
> For example, there may be a chance that netns a and netns b all
> listen on 127.0.0.1:8080 and the client with same port 40782
> connect to them. Without netns number, sock ops program
> can't distinguish them.
> Using bpf_get_netns_id helper to get current connection
> netns id to distinguish connections.
>
> Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
> ---
>  include/uapi/linux/bpf.h |  9 ++++++++-
>  net/core/filter.c        | 20 ++++++++++++++++++++
>  2 files changed, 28 insertions(+), 1 deletion(-)
>
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index f1d74a2bd234..e79082f78b74 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -2892,6 +2892,12 @@ union bpf_attr {
>   *             Obtain the 64bit jiffies
>   *     Return
>   *             The 64 bit jiffies
> + *
> + * u64 bpf_get_netns_id(struct bpf_sock_ops *bpf_socket)
> + *  Description
> + *      Obtain netns id of sock
> + * Return
> + *      The current netns inum
>   */
>  #define __BPF_FUNC_MAPPER(FN)          \
>         FN(unspec),                     \
> @@ -3012,7 +3018,8 @@ union bpf_attr {
>         FN(probe_read_kernel_str),      \
>         FN(tcp_send_ack),               \
>         FN(send_signal_thread),         \
> -       FN(jiffies64),
> +       FN(jiffies64),                  \
> +       FN(get_netns_id),
>
>  /* integer value in 'imm' field of BPF_CALL instruction selects which helper
>   * function eBPF program intends to call
> diff --git a/net/core/filter.c b/net/core/filter.c
> index c180871e606d..5302ec9f7c0d 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -4421,6 +4421,24 @@ static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = {
>         .arg2_type      = ARG_ANYTHING,
>  };
>
> +BPF_CALL_1(bpf_get_netns_id_sock_ops, struct bpf_sock_ops_kern *, bpf_sock)

I guess we only need bpf_get_netns_id,

> +{
> +#ifdef CONFIG_NET_NS
> +       struct sock *sk = bpf_sock->sk;
> +
> +       return (u64)sk->sk_net.net->ns.inum;
> +#else
> +       return 0;
> +#endif
> +}
> +
> +static const struct bpf_func_proto bpf_get_netns_id_sock_ops_proto = {
and bpf_get_netns_id_proto.

> +       .func           = bpf_get_netns_id_sock_ops,
> +       .gpl_only       = false,
> +       .ret_type       = RET_INTEGER,
> +       .arg1_type      = ARG_PTR_TO_CTX,
> +};
> +
>  const struct ipv6_bpf_stub *ipv6_bpf_stub __read_mostly;
>  EXPORT_SYMBOL_GPL(ipv6_bpf_stub);
>
> @@ -6218,6 +6236,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>         case BPF_FUNC_tcp_sock:
>                 return &bpf_tcp_sock_proto;
>  #endif /* CONFIG_INET */
> +       case BPF_FUNC_get_netns_id:
> +               return &bpf_get_netns_id_sock_ops_proto;
>         default:
>                 return bpf_base_func_proto(func_id);
>         }
> --
> 2.20.1
>

Re: [PATCH v3 bpf-next 2/3] bpf: Sync uapi bpf.h to tools/

[Song Liu]

On Wed, Feb 19, 2020 at 11:11 PM Lingpeng Chen <forrest0579@gmail.com> wrote:
>
> This patch sync uapi bpf.h to tools/.
>
> Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>

Acked-by: Song Liu <songliubraving@fb.com>

Re: [PATCH v3 bpf-next 3/3] selftests/bpf: add selftest for get_netns_id helper

[Song Liu]

On Wed, Feb 19, 2020 at 11:12 PM Lingpeng Chen <forrest0579@gmail.com> wrote:
>
> adding selftest for new bpf helper function get_netns_id
>
> Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>

Acked-by: Song Liu <songliubraving@fb.com>

[PATCH v4 bpf-next 0/3] bpf: Add get_netns_id helper for sock_ops

[Lingpeng Chen]

Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
uniq connection because there may be multi net namespace.
For example, there may be a chance that netns a and netns b all
listen on 127.0.0.1:8080 and the client with same port 40782
connect to them. Without netns number, sock ops program
can't distinguish them.
Using bpf_get_netns_id helpers to get current connection
netns number to distinguish connections.

Changes in v4:
- rename get_netns_id_sock_ops to get_getns_id
- rebase from bpf-next

Changes in v3:
- rename sock_ops_get_netns to get_netns_id

Changes in v2:
- Return u64 instead of u32 for sock_ops_get_netns
- Fix build bug when CONFIG_NET_NS not set
- Add selftest for sock_ops_get_netns

Lingpeng Chen (3):
  bpf: Add get_netns_id helper function for sock_ops
  bpf: Sync uapi bpf.h to tools/
  selftests/bpf: add selftest for get_netns_id helper

 include/uapi/linux/bpf.h                      |  9 +++-
 net/core/filter.c                             | 20 ++++++++
 tools/include/uapi/linux/bpf.h                |  9 +++-
 .../selftests/bpf/progs/test_tcpbpf_kern.c    | 11 +++++
 .../testing/selftests/bpf/test_tcpbpf_user.c  | 46 ++++++++++++++++++-
 5 files changed, 92 insertions(+), 3 deletions(-)


base-commit e0360423d020
("selftests/bpf: Run SYN cookies with reuseport BPF test only for TCP")
-- 
2.20.1

[PATCH v4 bpf-next 1/3] bpf: Add get_netns_id helper function for sock_ops

[Lingpeng Chen]

Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
uniq connection because there may be multi net namespace.
For example, there may be a chance that netns a and netns b all
listen on 127.0.0.1:8080 and the client with same port 40782
connect to them. Without netns number, sock ops program
can't distinguish them.
Using bpf_get_netns_id helper to get current connection
netns id to distinguish connections.

Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
---
 include/uapi/linux/bpf.h |  9 ++++++++-
 net/core/filter.c        | 20 ++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 906e9f2752db..c53178f7585e 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2909,6 +2909,12 @@ union bpf_attr {
  *		of sizeof(struct perf_branch_entry).
  *
  *		**-ENOENT** if architecture does not support branch records.
+ *
+ * u64 bpf_get_netns_id(struct bpf_sock_ops *bpf_socket)
+ *  Description
+ *      Obtain netns id of sock
+ * Return
+ *      The current netns inum
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -3030,7 +3036,8 @@ union bpf_attr {
 	FN(tcp_send_ack),		\
 	FN(send_signal_thread),		\
 	FN(jiffies64),			\
-	FN(read_branch_records),
+	FN(read_branch_records),	\
+	FN(get_netns_id),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
diff --git a/net/core/filter.c b/net/core/filter.c
index 925b23de218b..98536b0eecb6 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4421,6 +4421,24 @@ static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = {
 	.arg2_type	= ARG_ANYTHING,
 };
 
+BPF_CALL_1(bpf_get_netns_id, struct bpf_sock_ops_kern *, bpf_sock)
+{
+#ifdef CONFIG_NET_NS
+	struct sock *sk = bpf_sock->sk;
+
+	return (u64)sk->sk_net.net->ns.inum;
+#else
+	return 0;
+#endif
+}
+
+static const struct bpf_func_proto bpf_get_netns_id_proto = {
+	.func		= bpf_get_netns_id,
+	.gpl_only	= false,
+	.ret_type	= RET_INTEGER,
+	.arg1_type	= ARG_PTR_TO_CTX,
+};
+
 const struct ipv6_bpf_stub *ipv6_bpf_stub __read_mostly;
 EXPORT_SYMBOL_GPL(ipv6_bpf_stub);
 
@@ -6218,6 +6236,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 	case BPF_FUNC_tcp_sock:
 		return &bpf_tcp_sock_proto;
 #endif /* CONFIG_INET */
+	case BPF_FUNC_get_netns_id:
+		return &bpf_get_netns_id_proto;
 	default:
 		return bpf_base_func_proto(func_id);
 	}
-- 
2.20.1

[PATCH v4 bpf-next 2/3] bpf: Sync uapi bpf.h to tools/

[Lingpeng Chen]

This patch sync uapi bpf.h to tools/.

Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
Acked-by: Song Liu <songliubraving@fb.com>
---
 tools/include/uapi/linux/bpf.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 906e9f2752db..c53178f7585e 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2909,6 +2909,12 @@ union bpf_attr {
  *		of sizeof(struct perf_branch_entry).
  *
  *		**-ENOENT** if architecture does not support branch records.
+ *
+ * u64 bpf_get_netns_id(struct bpf_sock_ops *bpf_socket)
+ *  Description
+ *      Obtain netns id of sock
+ * Return
+ *      The current netns inum
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -3030,7 +3036,8 @@ union bpf_attr {
 	FN(tcp_send_ack),		\
 	FN(send_signal_thread),		\
 	FN(jiffies64),			\
-	FN(read_branch_records),
+	FN(read_branch_records),	\
+	FN(get_netns_id),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
-- 
2.20.1

[PATCH v4 bpf-next 3/3] selftests/bpf: add selftest for get_netns_id helper

[Lingpeng Chen]

adding selftest for new bpf helper function get_netns_id

Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
Acked-by: Song Liu <songliubraving@fb.com>
---
 .../selftests/bpf/progs/test_tcpbpf_kern.c    | 11 +++++
 .../testing/selftests/bpf/test_tcpbpf_user.c  | 46 ++++++++++++++++++-
 2 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
index 1f1966e86e9f..d7d851ddd2cc 100644
--- a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
@@ -28,6 +28,13 @@ struct {
 	__type(value, int);
 } sockopt_results SEC(".maps");
 
+struct {
+	__uint(type, BPF_MAP_TYPE_ARRAY);
+	__uint(max_entries, 1);
+	__type(key, __u32);
+	__type(value, __u64);
+} netns_number SEC(".maps");
+
 static inline void update_event_map(int event)
 {
 	__u32 key = 0;
@@ -61,6 +68,7 @@ int bpf_testcb(struct bpf_sock_ops *skops)
 	int rv = -1;
 	int v = 0;
 	int op;
+	__u64 netns_id;
 
 	op = (int) skops->op;
 
@@ -144,6 +152,9 @@ int bpf_testcb(struct bpf_sock_ops *skops)
 		__u32 key = 0;
 
 		bpf_map_update_elem(&sockopt_results, &key, &v, BPF_ANY);
+
+		netns_id = bpf_get_netns_id(skops);
+		bpf_map_update_elem(&netns_number, &key, &netns_id, BPF_ANY);
 		break;
 	default:
 		rv = -1;
diff --git a/tools/testing/selftests/bpf/test_tcpbpf_user.c b/tools/testing/selftests/bpf/test_tcpbpf_user.c
index 3ae127620463..fef2f4d77ecc 100644
--- a/tools/testing/selftests/bpf/test_tcpbpf_user.c
+++ b/tools/testing/selftests/bpf/test_tcpbpf_user.c
@@ -76,6 +76,41 @@ int verify_sockopt_result(int sock_map_fd)
 	return ret;
 }
 
+int verify_netns(__u64 netns_id)
+{
+	char buf1[40];
+	char buf2[40];
+	int ret = 0;
+	ssize_t len = 0;
+
+	len = readlink("/proc/self/ns/net", buf1, 39);
+	sprintf(buf2, "net:[%llu]", netns_id);
+
+	if (len <= 0) {
+		printf("FAILED: readlink /proc/self/ns/net");
+		return ret;
+	}
+
+	if (strncmp(buf1, buf2, len)) {
+		printf("FAILED: netns don't match");
+		ret = 1;
+	}
+	return ret;
+}
+
+int verify_netns_result(int netns_map_fd)
+{
+	__u32 key = 0;
+	__u64 res = 0;
+	int ret = 0;
+	int rv;
+
+	rv = bpf_map_lookup_elem(netns_map_fd, &key, &res);
+	EXPECT_EQ(0, rv, "d");
+
+	return verify_netns(res);
+}
+
 static int bpf_find_map(const char *test, struct bpf_object *obj,
 			const char *name)
 {
@@ -92,7 +127,7 @@ static int bpf_find_map(const char *test, struct bpf_object *obj,
 int main(int argc, char **argv)
 {
 	const char *file = "test_tcpbpf_kern.o";
-	int prog_fd, map_fd, sock_map_fd;
+	int prog_fd, map_fd, sock_map_fd, netns_map_fd;
 	struct tcpbpf_globals g = {0};
 	const char *cg_path = "/foo";
 	int error = EXIT_FAILURE;
@@ -137,6 +172,10 @@ int main(int argc, char **argv)
 	if (sock_map_fd < 0)
 		goto err;
 
+	netns_map_fd = bpf_find_map(__func__, obj, "netns_number");
+	if (netns_map_fd < 0)
+		goto err;
+
 retry_lookup:
 	rv = bpf_map_lookup_elem(map_fd, &key, &g);
 	if (rv != 0) {
@@ -161,6 +200,11 @@ int main(int argc, char **argv)
 		goto err;
 	}
 
+	if (verify_netns_result(netns_map_fd)) {
+		printf("FAILED: Wrong netns stats\n");
+		goto err;
+	}
+
 	printf("PASSED!\n");
 	error = 0;
 err:
-- 
2.20.1

Re: [PATCH v4 bpf-next 1/3] bpf: Add get_netns_id helper function for sock_ops

[Song Liu]

On Mon, Feb 24, 2020 at 8:46 PM Lingpeng Chen <forrest0579@gmail.com> wrote:
>
> Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
> uniq connection because there may be multi net namespace.
> For example, there may be a chance that netns a and netns b all
> listen on 127.0.0.1:8080 and the client with same port 40782
> connect to them. Without netns number, sock ops program
> can't distinguish them.
> Using bpf_get_netns_id helper to get current connection
> netns id to distinguish connections.
>
> Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>

Acked-by: Song Liu <songliubraving@fb.com>

Re: [PATCH v4 bpf-next 3/3] selftests/bpf: add selftest for get_netns_id helper

[Andrii Nakryiko]

On Mon, Feb 24, 2020 at 8:47 PM Lingpeng Chen <forrest0579@gmail.com> wrote:
>
> adding selftest for new bpf helper function get_netns_id
>
> Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
> Acked-by: Song Liu <songliubraving@fb.com>
> ---

It would be nice if this selftests becomes part of test_progs. That
way it would be exercised regularly, both by committers, as well as by
automated CI in libbpf's Github repo. Using global variables and BPF
skeleton would also clean up both BPF and user-space code.

It seems like this test runs Python script for server, but doesn't
seem like that server is doing anything complicated, so writing that
in C shouldn't be a problem as well. Thoughts?

>  .../selftests/bpf/progs/test_tcpbpf_kern.c    | 11 +++++
>  .../testing/selftests/bpf/test_tcpbpf_user.c  | 46 ++++++++++++++++++-
>  2 files changed, 56 insertions(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
> index 1f1966e86e9f..d7d851ddd2cc 100644
> --- a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
> +++ b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
> @@ -28,6 +28,13 @@ struct {
>         __type(value, int);
>  } sockopt_results SEC(".maps");
>
> +struct {
> +       __uint(type, BPF_MAP_TYPE_ARRAY);
> +       __uint(max_entries, 1);
> +       __type(key, __u32);
> +       __type(value, __u64);
> +} netns_number SEC(".maps");
> +
>  static inline void update_event_map(int event)
>  {
>         __u32 key = 0;
> @@ -61,6 +68,7 @@ int bpf_testcb(struct bpf_sock_ops *skops)
>         int rv = -1;
>         int v = 0;
>         int op;
> +       __u64 netns_id;
>
>         op = (int) skops->op;
>
> @@ -144,6 +152,9 @@ int bpf_testcb(struct bpf_sock_ops *skops)
>                 __u32 key = 0;
>
>                 bpf_map_update_elem(&sockopt_results, &key, &v, BPF_ANY);
> +
> +               netns_id = bpf_get_netns_id(skops);
> +               bpf_map_update_elem(&netns_number, &key, &netns_id, BPF_ANY);
>                 break;
>         default:
>                 rv = -1;
> diff --git a/tools/testing/selftests/bpf/test_tcpbpf_user.c b/tools/testing/selftests/bpf/test_tcpbpf_user.c
> index 3ae127620463..fef2f4d77ecc 100644
> --- a/tools/testing/selftests/bpf/test_tcpbpf_user.c
> +++ b/tools/testing/selftests/bpf/test_tcpbpf_user.c
> @@ -76,6 +76,41 @@ int verify_sockopt_result(int sock_map_fd)
>         return ret;
>  }
>
> +int verify_netns(__u64 netns_id)
> +{
> +       char buf1[40];
> +       char buf2[40];
> +       int ret = 0;
> +       ssize_t len = 0;
> +
> +       len = readlink("/proc/self/ns/net", buf1, 39);
> +       sprintf(buf2, "net:[%llu]", netns_id);
> +
> +       if (len <= 0) {
> +               printf("FAILED: readlink /proc/self/ns/net");
> +               return ret;
> +       }
> +
> +       if (strncmp(buf1, buf2, len)) {
> +               printf("FAILED: netns don't match");
> +               ret = 1;
> +       }
> +       return ret;
> +}
> +
> +int verify_netns_result(int netns_map_fd)
> +{
> +       __u32 key = 0;
> +       __u64 res = 0;
> +       int ret = 0;
> +       int rv;
> +
> +       rv = bpf_map_lookup_elem(netns_map_fd, &key, &res);
> +       EXPECT_EQ(0, rv, "d");
> +
> +       return verify_netns(res);
> +}
> +
>  static int bpf_find_map(const char *test, struct bpf_object *obj,
>                         const char *name)
>  {
> @@ -92,7 +127,7 @@ static int bpf_find_map(const char *test, struct bpf_object *obj,
>  int main(int argc, char **argv)
>  {
>         const char *file = "test_tcpbpf_kern.o";
> -       int prog_fd, map_fd, sock_map_fd;
> +       int prog_fd, map_fd, sock_map_fd, netns_map_fd;
>         struct tcpbpf_globals g = {0};
>         const char *cg_path = "/foo";
>         int error = EXIT_FAILURE;
> @@ -137,6 +172,10 @@ int main(int argc, char **argv)
>         if (sock_map_fd < 0)
>                 goto err;
>
> +       netns_map_fd = bpf_find_map(__func__, obj, "netns_number");
> +       if (netns_map_fd < 0)
> +               goto err;
> +
>  retry_lookup:
>         rv = bpf_map_lookup_elem(map_fd, &key, &g);
>         if (rv != 0) {
> @@ -161,6 +200,11 @@ int main(int argc, char **argv)
>                 goto err;
>         }
>
> +       if (verify_netns_result(netns_map_fd)) {
> +               printf("FAILED: Wrong netns stats\n");
> +               goto err;
> +       }
> +
>         printf("PASSED!\n");
>         error = 0;
>  err:
> --
> 2.20.1
>

Re: [PATCH v4 bpf-next 3/3] selftests/bpf: add selftest for get_netns_id helper

[Andrii Nakryiko]

On Mon, Feb 24, 2020 at 11:20 PM Forrest Chen <forrest0579@gmail.com> wrote:
>
> > It would be nice if this selftests becomes part of test_progs.
>
> You mean the whole tests of tcpbpf or only the changes I made in this test?
> If you mean the whole tests of tcpbpf, I think we could fire another thread
> to do this?

Yeah, I meant entire tcpbpf test.

>
> Andrii Nakryiko <andrii.nakryiko@gmail.com> 于2020年2月25日周二 下午2:13写道：
>>
>> On Mon, Feb 24, 2020 at 8:47 PM Lingpeng Chen <forrest0579@gmail.com> wrote:
>> >
>> > adding selftest for new bpf helper function get_netns_id
>> >
>> > Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
>> > Acked-by: Song Liu <songliubraving@fb.com>
>> > ---
>>
>> It would be nice if this selftests becomes part of test_progs. That
>> way it would be exercised regularly, both by committers, as well as by
>> automated CI in libbpf's Github repo. Using global variables and BPF
>> skeleton would also clean up both BPF and user-space code.
>>
>> It seems like this test runs Python script for server, but doesn't
>> seem like that server is doing anything complicated, so writing that
>> in C shouldn't be a problem as well. Thoughts?
>>
>> >  .../selftests/bpf/progs/test_tcpbpf_kern.c    | 11 +++++
>> >  .../testing/selftests/bpf/test_tcpbpf_user.c  | 46 ++++++++++++++++++-
>> >  2 files changed, 56 insertions(+), 1 deletion(-)
>> >
>> > diff --git a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
>> > index 1f1966e86e9f..d7d851ddd2cc 100644
>> > --- a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
>> > +++ b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
>> > @@ -28,6 +28,13 @@ struct {
>> >         __type(value, int);
>> >  } sockopt_results SEC(".maps");
>> >
>> > +struct {
>> > +       __uint(type, BPF_MAP_TYPE_ARRAY);
>> > +       __uint(max_entries, 1);
>> > +       __type(key, __u32);
>> > +       __type(value, __u64);
>> > +} netns_number SEC(".maps");
>> > +
>> >  static inline void update_event_map(int event)
>> >  {
>> >         __u32 key = 0;
>> > @@ -61,6 +68,7 @@ int bpf_testcb(struct bpf_sock_ops *skops)
>> >         int rv = -1;
>> >         int v = 0;
>> >         int op;
>> > +       __u64 netns_id;
>> >
>> >         op = (int) skops->op;
>> >
>> > @@ -144,6 +152,9 @@ int bpf_testcb(struct bpf_sock_ops *skops)
>> >                 __u32 key = 0;
>> >
>> >                 bpf_map_update_elem(&sockopt_results, &key, &v, BPF_ANY);
>> > +
>> > +               netns_id = bpf_get_netns_id(skops);
>> > +               bpf_map_update_elem(&netns_number, &key, &netns_id, BPF_ANY);
>> >                 break;
>> >         default:
>> >                 rv = -1;
>> > diff --git a/tools/testing/selftests/bpf/test_tcpbpf_user.c b/tools/testing/selftests/bpf/test_tcpbpf_user.c
>> > index 3ae127620463..fef2f4d77ecc 100644
>> > --- a/tools/testing/selftests/bpf/test_tcpbpf_user.c
>> > +++ b/tools/testing/selftests/bpf/test_tcpbpf_user.c
>> > @@ -76,6 +76,41 @@ int verify_sockopt_result(int sock_map_fd)
>> >         return ret;
>> >  }
>> >
>> > +int verify_netns(__u64 netns_id)
>> > +{
>> > +       char buf1[40];
>> > +       char buf2[40];
>> > +       int ret = 0;
>> > +       ssize_t len = 0;
>> > +
>> > +       len = readlink("/proc/self/ns/net", buf1, 39);
>> > +       sprintf(buf2, "net:[%llu]", netns_id);
>> > +
>> > +       if (len <= 0) {
>> > +               printf("FAILED: readlink /proc/self/ns/net");
>> > +               return ret;
>> > +       }
>> > +
>> > +       if (strncmp(buf1, buf2, len)) {
>> > +               printf("FAILED: netns don't match");
>> > +               ret = 1;
>> > +       }
>> > +       return ret;
>> > +}
>> > +
>> > +int verify_netns_result(int netns_map_fd)
>> > +{
>> > +       __u32 key = 0;
>> > +       __u64 res = 0;
>> > +       int ret = 0;
>> > +       int rv;
>> > +
>> > +       rv = bpf_map_lookup_elem(netns_map_fd, &key, &res);
>> > +       EXPECT_EQ(0, rv, "d");
>> > +
>> > +       return verify_netns(res);
>> > +}
>> > +
>> >  static int bpf_find_map(const char *test, struct bpf_object *obj,
>> >                         const char *name)
>> >  {
>> > @@ -92,7 +127,7 @@ static int bpf_find_map(const char *test, struct bpf_object *obj,
>> >  int main(int argc, char **argv)
>> >  {
>> >         const char *file = "test_tcpbpf_kern.o";
>> > -       int prog_fd, map_fd, sock_map_fd;
>> > +       int prog_fd, map_fd, sock_map_fd, netns_map_fd;
>> >         struct tcpbpf_globals g = {0};
>> >         const char *cg_path = "/foo";
>> >         int error = EXIT_FAILURE;
>> > @@ -137,6 +172,10 @@ int main(int argc, char **argv)
>> >         if (sock_map_fd < 0)
>> >                 goto err;
>> >
>> > +       netns_map_fd = bpf_find_map(__func__, obj, "netns_number");
>> > +       if (netns_map_fd < 0)
>> > +               goto err;
>> > +
>> >  retry_lookup:
>> >         rv = bpf_map_lookup_elem(map_fd, &key, &g);
>> >         if (rv != 0) {
>> > @@ -161,6 +200,11 @@ int main(int argc, char **argv)
>> >                 goto err;
>> >         }
>> >
>> > +       if (verify_netns_result(netns_map_fd)) {
>> > +               printf("FAILED: Wrong netns stats\n");
>> > +               goto err;
>> > +       }
>> > +
>> >         printf("PASSED!\n");
>> >         error = 0;
>> >  err:
>> > --
>> > 2.20.1
>> >
>
>
>
> --
> Beijing University of Posts and Telecommunications
> forrest0579@gmail.com
>
>

Re: [PATCH v4 bpf-next 3/3] selftests/bpf: add selftest for get_netns_id helper

[Andrii Nakryiko]

On Tue, Feb 25, 2020 at 5:20 PM Forrest Chen <forrest0579@gmail.com> wrote:
>
> Got it. So I think we could first merge this and refactor the tcpbpf test(or maybe also some other tests) in another thread, is that ok with you?

Sure, as long as there is a follow up.

Also, please make sure to reply inline.

>
> Andrii Nakryiko <andrii.nakryiko@gmail.com> 于2020年2月26日周三 上午1:13写道：
>>
>> On Mon, Feb 24, 2020 at 11:20 PM Forrest Chen <forrest0579@gmail.com> wrote:
>> >
>> > > It would be nice if this selftests becomes part of test_progs.
>> >
>> > You mean the whole tests of tcpbpf or only the changes I made in this test?
>> > If you mean the whole tests of tcpbpf, I think we could fire another thread
>> > to do this?
>>
>> Yeah, I meant entire tcpbpf test.
>>
>> >
>> > Andrii Nakryiko <andrii.nakryiko@gmail.com> 于2020年2月25日周二 下午2:13写道：
>> >>
>> >> On Mon, Feb 24, 2020 at 8:47 PM Lingpeng Chen <forrest0579@gmail.com> wrote:
>> >> >
>> >> > adding selftest for new bpf helper function get_netns_id
>> >> >
>> >> > Signed-off-by: Lingpeng Chen <forrest0579@gmail.com>
>> >> > Acked-by: Song Liu <songliubraving@fb.com>
>> >> > ---
>> >>
>> >> It would be nice if this selftests becomes part of test_progs. That
>> >> way it would be exercised regularly, both by committers, as well as by
>> >> automated CI in libbpf's Github repo. Using global variables and BPF
>> >> skeleton would also clean up both BPF and user-space code.
>> >>
>> >> It seems like this test runs Python script for server, but doesn't
>> >> seem like that server is doing anything complicated, so writing that
>> >> in C shouldn't be a problem as well. Thoughts?
>> >>
>> >> >  .../selftests/bpf/progs/test_tcpbpf_kern.c    | 11 +++++
>> >> >  .../testing/selftests/bpf/test_tcpbpf_user.c  | 46 ++++++++++++++++++-
>> >> >  2 files changed, 56 insertions(+), 1 deletion(-)
>> >> >

[...]

Re: [PATCH v4 bpf-next 0/3] bpf: Add get_netns_id helper for sock_ops

[Forrest Chen]

Find that all three commits are acked by the maintainer. Could we
merge this to the upstream? Or do we have any other comments?


Lingpeng Chen <forrest0579@gmail.com> 于2020年2月25日周二 下午12:46写道：
>
> Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
> uniq connection because there may be multi net namespace.
> For example, there may be a chance that netns a and netns b all
> listen on 127.0.0.1:8080 and the client with same port 40782
> connect to them. Without netns number, sock ops program
> can't distinguish them.
> Using bpf_get_netns_id helpers to get current connection
> netns number to distinguish connections.
>
> Changes in v4:
> - rename get_netns_id_sock_ops to get_getns_id
> - rebase from bpf-next
>
> Changes in v3:
> - rename sock_ops_get_netns to get_netns_id
>
> Changes in v2:
> - Return u64 instead of u32 for sock_ops_get_netns
> - Fix build bug when CONFIG_NET_NS not set
> - Add selftest for sock_ops_get_netns
>
> Lingpeng Chen (3):
>   bpf: Add get_netns_id helper function for sock_ops
>   bpf: Sync uapi bpf.h to tools/
>   selftests/bpf: add selftest for get_netns_id helper
>
>  include/uapi/linux/bpf.h                      |  9 +++-
>  net/core/filter.c                             | 20 ++++++++
>  tools/include/uapi/linux/bpf.h                |  9 +++-
>  .../selftests/bpf/progs/test_tcpbpf_kern.c    | 11 +++++
>  .../testing/selftests/bpf/test_tcpbpf_user.c  | 46 ++++++++++++++++++-
>  5 files changed, 92 insertions(+), 3 deletions(-)
>
>
> base-commit e0360423d020
> ("selftests/bpf: Run SYN cookies with reuseport BPF test only for TCP")
> --
> 2.20.1
>


-- 
Beijing University of Posts and Telecommunications
forrest0579@gmail.com