All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH bpf-next v2] bpf: allow BPF read access to qdisc pkt_len
@ 2018-12-03  1:18 Willem de Bruijn
  2018-12-03  7:48 ` Song Liu
  2018-12-03 20:44 ` Daniel Borkmann
  0 siblings, 2 replies; 3+ messages in thread
From: Willem de Bruijn @ 2018-12-03  1:18 UTC (permalink / raw)
  To: netdev
  Cc: ast, daniel, peterpenkov96, vladum, liu.song.a23, Petar Penkov,
	Willem de Bruijn

From: Petar Penkov <ppenkov@google.com>

The pkt_len field in qdisc_skb_cb stores the skb length as it will
appear on the wire after segmentation. For byte accounting, this value
is more accurate than skb->len. It is computed on entry to the TC
layer, so only valid there.

Allow read access to this field from BPF tc classifier and action
programs. The implementation is analogous to tc_classid, aside from
restricting to read access.

To distinguish it from skb->len and self-describe export as wire_len.

Changes v1->v2
  - Rename pkt_len to wire_len

Signed-off-by: Petar Penkov <ppenkov@google.com>
Signed-off-by: Vlad Dumitrescu <vladum@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
---
 include/uapi/linux/bpf.h                    |  1 +
 net/core/filter.c                           | 16 +++++++++++
 tools/include/uapi/linux/bpf.h              |  1 +
 tools/testing/selftests/bpf/test_verifier.c | 32 +++++++++++++++++++++
 4 files changed, 50 insertions(+)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 8050caea7495..0183b8e70a9e 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2497,6 +2497,7 @@ struct __sk_buff {
 	__u32 data_meta;
 	struct bpf_flow_keys *flow_keys;
 	__u64 tstamp;
+	__u32 wire_len;
 };
 
 struct bpf_tunnel_key {
diff --git a/net/core/filter.c b/net/core/filter.c
index bd0df75dc7b6..3d54af4c363d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5773,6 +5773,7 @@ static bool sk_filter_is_valid_access(int off, int size,
 	case bpf_ctx_range(struct __sk_buff, flow_keys):
 	case bpf_ctx_range_till(struct __sk_buff, family, local_port):
 	case bpf_ctx_range(struct __sk_buff, tstamp):
+	case bpf_ctx_range(struct __sk_buff, wire_len):
 		return false;
 	}
 
@@ -5797,6 +5798,7 @@ static bool cg_skb_is_valid_access(int off, int size,
 	case bpf_ctx_range(struct __sk_buff, tc_classid):
 	case bpf_ctx_range(struct __sk_buff, data_meta):
 	case bpf_ctx_range(struct __sk_buff, flow_keys):
+	case bpf_ctx_range(struct __sk_buff, wire_len):
 		return false;
 	case bpf_ctx_range(struct __sk_buff, data):
 	case bpf_ctx_range(struct __sk_buff, data_end):
@@ -5843,6 +5845,7 @@ static bool lwt_is_valid_access(int off, int size,
 	case bpf_ctx_range(struct __sk_buff, data_meta):
 	case bpf_ctx_range(struct __sk_buff, flow_keys):
 	case bpf_ctx_range(struct __sk_buff, tstamp):
+	case bpf_ctx_range(struct __sk_buff, wire_len):
 		return false;
 	}
 
@@ -6273,6 +6276,7 @@ static bool sk_skb_is_valid_access(int off, int size,
 	case bpf_ctx_range(struct __sk_buff, data_meta):
 	case bpf_ctx_range(struct __sk_buff, flow_keys):
 	case bpf_ctx_range(struct __sk_buff, tstamp):
+	case bpf_ctx_range(struct __sk_buff, wire_len):
 		return false;
 	}
 
@@ -6360,6 +6364,7 @@ static bool flow_dissector_is_valid_access(int off, int size,
 	case bpf_ctx_range(struct __sk_buff, data_meta):
 	case bpf_ctx_range_till(struct __sk_buff, family, local_port):
 	case bpf_ctx_range(struct __sk_buff, tstamp):
+	case bpf_ctx_range(struct __sk_buff, wire_len):
 		return false;
 	}
 
@@ -6685,6 +6690,17 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
 					      bpf_target_off(struct sk_buff,
 							     tstamp, 8,
 							     target_size));
+		break;
+
+	case offsetof(struct __sk_buff, wire_len):
+		BUILD_BUG_ON(FIELD_SIZEOF(struct qdisc_skb_cb, pkt_len) != 4);
+
+		off = si->off;
+		off -= offsetof(struct __sk_buff, wire_len);
+		off += offsetof(struct sk_buff, cb);
+		off += offsetof(struct qdisc_skb_cb, pkt_len);
+		*target_size = 4;
+		*insn++ = BPF_LDX_MEM(BPF_W, si->dst_reg, si->src_reg, off);
 	}
 
 	return insn - insn_buf;
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 8050caea7495..0183b8e70a9e 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2497,6 +2497,7 @@ struct __sk_buff {
 	__u32 data_meta;
 	struct bpf_flow_keys *flow_keys;
 	__u64 tstamp;
+	__u32 wire_len;
 };
 
 struct bpf_tunnel_key {
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index c3b038f26ece..b4b4a3f93639 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -14033,6 +14033,38 @@ static struct bpf_test tests[] = {
 		.result_unpriv = REJECT,
 		.result = ACCEPT,
 	},
+	{
+		"check wire_len is not readable by sockets",
+		.insns = {
+			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+				    offsetof(struct __sk_buff, wire_len)),
+			BPF_EXIT_INSN(),
+		},
+		.errstr = "invalid bpf_context access",
+		.result = REJECT,
+	},
+	{
+		"check wire_len is readable by tc classifier",
+		.insns = {
+			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+				    offsetof(struct __sk_buff, wire_len)),
+			BPF_EXIT_INSN(),
+		},
+		.prog_type = BPF_PROG_TYPE_SCHED_CLS,
+		.result = ACCEPT,
+	},
+	{
+		"check wire_len is not writable by tc classifier",
+		.insns = {
+			BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
+				    offsetof(struct __sk_buff, wire_len)),
+			BPF_EXIT_INSN(),
+		},
+		.prog_type = BPF_PROG_TYPE_SCHED_CLS,
+		.errstr = "invalid bpf_context access",
+		.errstr_unpriv = "R1 leaks addr",
+		.result = REJECT,
+	},
 };
 
 static int probe_filter_length(const struct bpf_insn *fp)
-- 
2.20.0.rc1.387.gf8505762e3-goog

^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next v2] bpf: allow BPF read access to qdisc pkt_len
  2018-12-03  1:18 [PATCH bpf-next v2] bpf: allow BPF read access to qdisc pkt_len Willem de Bruijn
@ 2018-12-03  7:48 ` Song Liu
  2018-12-03 20:44 ` Daniel Borkmann
  1 sibling, 0 replies; 3+ messages in thread
From: Song Liu @ 2018-12-03  7:48 UTC (permalink / raw)
  To: Willem de Bruijn
  Cc: Networking, Alexei Starovoitov, Daniel Borkmann, Petar Penkov,
	vladum, Petar Penkov, Willem de Bruijn

On Sun, Dec 2, 2018 at 5:18 PM Willem de Bruijn
<willemdebruijn.kernel@gmail.com> wrote:
>
> From: Petar Penkov <ppenkov@google.com>
>
> The pkt_len field in qdisc_skb_cb stores the skb length as it will
> appear on the wire after segmentation. For byte accounting, this value
> is more accurate than skb->len. It is computed on entry to the TC
> layer, so only valid there.
>
> Allow read access to this field from BPF tc classifier and action
> programs. The implementation is analogous to tc_classid, aside from
> restricting to read access.
>
> To distinguish it from skb->len and self-describe export as wire_len.
>
> Changes v1->v2
>   - Rename pkt_len to wire_len
>
> Signed-off-by: Petar Penkov <ppenkov@google.com>
> Signed-off-by: Vlad Dumitrescu <vladum@google.com>
> Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Song Liu <songliubraving@fb.com>

> ---
>  include/uapi/linux/bpf.h                    |  1 +
>  net/core/filter.c                           | 16 +++++++++++
>  tools/include/uapi/linux/bpf.h              |  1 +
>  tools/testing/selftests/bpf/test_verifier.c | 32 +++++++++++++++++++++
>  4 files changed, 50 insertions(+)
>
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index 8050caea7495..0183b8e70a9e 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -2497,6 +2497,7 @@ struct __sk_buff {
>         __u32 data_meta;
>         struct bpf_flow_keys *flow_keys;
>         __u64 tstamp;
> +       __u32 wire_len;
>  };
>
>  struct bpf_tunnel_key {
> diff --git a/net/core/filter.c b/net/core/filter.c
> index bd0df75dc7b6..3d54af4c363d 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -5773,6 +5773,7 @@ static bool sk_filter_is_valid_access(int off, int size,
>         case bpf_ctx_range(struct __sk_buff, flow_keys):
>         case bpf_ctx_range_till(struct __sk_buff, family, local_port):
>         case bpf_ctx_range(struct __sk_buff, tstamp):
> +       case bpf_ctx_range(struct __sk_buff, wire_len):
>                 return false;
>         }
>
> @@ -5797,6 +5798,7 @@ static bool cg_skb_is_valid_access(int off, int size,
>         case bpf_ctx_range(struct __sk_buff, tc_classid):
>         case bpf_ctx_range(struct __sk_buff, data_meta):
>         case bpf_ctx_range(struct __sk_buff, flow_keys):
> +       case bpf_ctx_range(struct __sk_buff, wire_len):
>                 return false;
>         case bpf_ctx_range(struct __sk_buff, data):
>         case bpf_ctx_range(struct __sk_buff, data_end):
> @@ -5843,6 +5845,7 @@ static bool lwt_is_valid_access(int off, int size,
>         case bpf_ctx_range(struct __sk_buff, data_meta):
>         case bpf_ctx_range(struct __sk_buff, flow_keys):
>         case bpf_ctx_range(struct __sk_buff, tstamp):
> +       case bpf_ctx_range(struct __sk_buff, wire_len):
>                 return false;
>         }
>
> @@ -6273,6 +6276,7 @@ static bool sk_skb_is_valid_access(int off, int size,
>         case bpf_ctx_range(struct __sk_buff, data_meta):
>         case bpf_ctx_range(struct __sk_buff, flow_keys):
>         case bpf_ctx_range(struct __sk_buff, tstamp):
> +       case bpf_ctx_range(struct __sk_buff, wire_len):
>                 return false;
>         }
>
> @@ -6360,6 +6364,7 @@ static bool flow_dissector_is_valid_access(int off, int size,
>         case bpf_ctx_range(struct __sk_buff, data_meta):
>         case bpf_ctx_range_till(struct __sk_buff, family, local_port):
>         case bpf_ctx_range(struct __sk_buff, tstamp):
> +       case bpf_ctx_range(struct __sk_buff, wire_len):
>                 return false;
>         }
>
> @@ -6685,6 +6690,17 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
>                                               bpf_target_off(struct sk_buff,
>                                                              tstamp, 8,
>                                                              target_size));
> +               break;
> +
> +       case offsetof(struct __sk_buff, wire_len):
> +               BUILD_BUG_ON(FIELD_SIZEOF(struct qdisc_skb_cb, pkt_len) != 4);
> +
> +               off = si->off;
> +               off -= offsetof(struct __sk_buff, wire_len);
> +               off += offsetof(struct sk_buff, cb);
> +               off += offsetof(struct qdisc_skb_cb, pkt_len);
> +               *target_size = 4;
> +               *insn++ = BPF_LDX_MEM(BPF_W, si->dst_reg, si->src_reg, off);
>         }
>
>         return insn - insn_buf;
> diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
> index 8050caea7495..0183b8e70a9e 100644
> --- a/tools/include/uapi/linux/bpf.h
> +++ b/tools/include/uapi/linux/bpf.h
> @@ -2497,6 +2497,7 @@ struct __sk_buff {
>         __u32 data_meta;
>         struct bpf_flow_keys *flow_keys;
>         __u64 tstamp;
> +       __u32 wire_len;
>  };
>
>  struct bpf_tunnel_key {
> diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
> index c3b038f26ece..b4b4a3f93639 100644
> --- a/tools/testing/selftests/bpf/test_verifier.c
> +++ b/tools/testing/selftests/bpf/test_verifier.c
> @@ -14033,6 +14033,38 @@ static struct bpf_test tests[] = {
>                 .result_unpriv = REJECT,
>                 .result = ACCEPT,
>         },
> +       {
> +               "check wire_len is not readable by sockets",
> +               .insns = {
> +                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
> +                                   offsetof(struct __sk_buff, wire_len)),
> +                       BPF_EXIT_INSN(),
> +               },
> +               .errstr = "invalid bpf_context access",
> +               .result = REJECT,
> +       },
> +       {
> +               "check wire_len is readable by tc classifier",
> +               .insns = {
> +                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
> +                                   offsetof(struct __sk_buff, wire_len)),
> +                       BPF_EXIT_INSN(),
> +               },
> +               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
> +               .result = ACCEPT,
> +       },
> +       {
> +               "check wire_len is not writable by tc classifier",
> +               .insns = {
> +                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
> +                                   offsetof(struct __sk_buff, wire_len)),
> +                       BPF_EXIT_INSN(),
> +               },
> +               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
> +               .errstr = "invalid bpf_context access",
> +               .errstr_unpriv = "R1 leaks addr",
> +               .result = REJECT,
> +       },
>  };
>
>  static int probe_filter_length(const struct bpf_insn *fp)
> --
> 2.20.0.rc1.387.gf8505762e3-goog
>

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next v2] bpf: allow BPF read access to qdisc pkt_len
  2018-12-03  1:18 [PATCH bpf-next v2] bpf: allow BPF read access to qdisc pkt_len Willem de Bruijn
  2018-12-03  7:48 ` Song Liu
@ 2018-12-03 20:44 ` Daniel Borkmann
  1 sibling, 0 replies; 3+ messages in thread
From: Daniel Borkmann @ 2018-12-03 20:44 UTC (permalink / raw)
  To: Willem de Bruijn, netdev
  Cc: ast, peterpenkov96, vladum, liu.song.a23, Petar Penkov, Willem de Bruijn

On 12/03/2018 02:18 AM, Willem de Bruijn wrote:
> From: Petar Penkov <ppenkov@google.com>
> 
> The pkt_len field in qdisc_skb_cb stores the skb length as it will
> appear on the wire after segmentation. For byte accounting, this value
> is more accurate than skb->len. It is computed on entry to the TC
> layer, so only valid there.
> 
> Allow read access to this field from BPF tc classifier and action
> programs. The implementation is analogous to tc_classid, aside from
> restricting to read access.
> 
> To distinguish it from skb->len and self-describe export as wire_len.
> 
> Changes v1->v2
>   - Rename pkt_len to wire_len
> 
> Signed-off-by: Petar Penkov <ppenkov@google.com>
> Signed-off-by: Vlad Dumitrescu <vladum@google.com>
> Signed-off-by: Willem de Bruijn <willemb@google.com>

Applied to bpf-next, thanks!

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-12-03 20:44 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-12-03  1:18 [PATCH bpf-next v2] bpf: allow BPF read access to qdisc pkt_len Willem de Bruijn
2018-12-03  7:48 ` Song Liu
2018-12-03 20:44 ` Daniel Borkmann

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.