bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH bpf-next V4 0/5] bpf: New approach for BPF MTU handling
@ 2020-10-27 16:26 Jesper Dangaard Brouer
  2020-10-27 16:26 ` [PATCH bpf-next V4 1/5] bpf: Remove MTU check in __bpf_skb_max_len Jesper Dangaard Brouer
                   ` (4 more replies)
  0 siblings, 5 replies; 11+ messages in thread
From: Jesper Dangaard Brouer @ 2020-10-27 16:26 UTC (permalink / raw)
  To: bpf
  Cc: Jesper Dangaard Brouer, netdev, Daniel Borkmann,
	Alexei Starovoitov, maze, lmb, shaun, Lorenzo Bianconi, marek,
	John Fastabend, Jakub Kicinski, eyal.birger

This patchset drops all the MTU checks in TC BPF-helpers that limits
growing the packet size. This is done because these BPF-helpers doesn't
take redirect into account, which can result in their MTU check being done
against the wrong netdev.

The new approach is to give BPF-programs knowledge about the MTU on a
netdev (via ifindex) and fib route lookup level. Meaning some BPF-helpers
are added and extended to make it possible to do MTU checks in the
BPF-code.

If BPF-prog doesn't comply with the MTU then the packet will eventually
get dropped as some other layer. In some cases the existing kernel MTU
checks will drop the packet, but there are also cases where BPF can bypass
these checks. Specifically doing TC-redirect from ingress step
(sch_handle_ingress) into egress code path (basically calling
dev_queue_xmit()). It is left up to driver code to handle these kind of
MTU violations.

One advantage of this approach is that it ingress-to-egress BPF-prog can
send information via packet data. With the MTU checks removed in the
helpers, and also not done in skb_do_redirect() call, this allows for an
ingress BPF-prog to communicate with an egress BPF-prog via packet data,
as long as egress BPF-prog remove this prior to transmitting packet.

This patchset is primarily focused on TC-BPF, but I've made sure that the
MTU BPF-helpers also works for XDP BPF-programs.

V2: Change BPF-helper API from lookup to check.
V3: Drop enforcement of MTU in net-core, leave it to drivers.
V4: Keep sanity limit + netdev "up" checks + rename BPF-helper.

---

Jesper Dangaard Brouer (5):
      bpf: Remove MTU check in __bpf_skb_max_len
      bpf: bpf_fib_lookup return MTU value as output when looked up
      bpf: add BPF-helper for MTU checking
      bpf: drop MTU check when doing TC-BPF redirect to ingress
      bpf: make it possible to identify BPF redirected SKBs


 include/linux/netdevice.h      |   31 +++++++-
 include/uapi/linux/bpf.h       |   81 +++++++++++++++++++-
 net/core/dev.c                 |   21 +----
 net/core/filter.c              |  163 ++++++++++++++++++++++++++++++++++++----
 net/sched/Kconfig              |    1 
 tools/include/uapi/linux/bpf.h |   81 +++++++++++++++++++-
 6 files changed, 339 insertions(+), 39 deletions(-)

--


^ permalink raw reply	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2020-10-30 19:24 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-27 16:26 [PATCH bpf-next V4 0/5] bpf: New approach for BPF MTU handling Jesper Dangaard Brouer
2020-10-27 16:26 ` [PATCH bpf-next V4 1/5] bpf: Remove MTU check in __bpf_skb_max_len Jesper Dangaard Brouer
2020-10-30 19:24   ` John Fastabend
2020-10-27 16:26 ` [PATCH bpf-next V4 2/5] bpf: bpf_fib_lookup return MTU value as output when looked up Jesper Dangaard Brouer
2020-10-27 17:15   ` David Ahern
2020-10-30 17:01     ` Jesper Dangaard Brouer
2020-10-28 12:49   ` Dan Carpenter
2020-10-30 14:35     ` Jesper Dangaard Brouer
2020-10-27 16:27 ` [PATCH bpf-next V4 3/5] bpf: add BPF-helper for MTU checking Jesper Dangaard Brouer
2020-10-27 16:27 ` [PATCH bpf-next V4 4/5] bpf: drop MTU check when doing TC-BPF redirect to ingress Jesper Dangaard Brouer
2020-10-27 16:27 ` [PATCH bpf-next V4 5/5] bpf: make it possible to identify BPF redirected SKBs Jesper Dangaard Brouer

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).