bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH bpf-next v3 0/6] Allow updating sockmap / sockhash from BPF
@ 2020-08-21 10:29 Lorenz Bauer
  2020-08-21 10:29 ` [PATCH bpf-next v3 1/6] net: sk_msg: simplify sk_psock initialization Lorenz Bauer
                   ` (6 more replies)
  0 siblings, 7 replies; 11+ messages in thread
From: Lorenz Bauer @ 2020-08-21 10:29 UTC (permalink / raw)
  To: jakub, john.fastabend, yhs, Alexei Starovoitov, Daniel Borkmann
  Cc: kernel-team, Lorenz Bauer, netdev, bpf

We're currently building a control plane for our BPF socket dispatch
work. As part of that, we have a need to create a copy of an existing
sockhash, to allow us to change the keys. I previously proposed allowing
privileged userspace to look up sockets, which doesn't work due to
security concerns (see [1]).

In follow up discussions during BPF office hours we identified bpf_iter
as a possible solution: instead of accessing sockets from user space
we can iterate the source sockhash, and insert the values into a new
map. Enabling this requires two pieces: the ability to iterate
sockmap and sockhash, as well as being able to call map_update_elem
from BPF.

This patch set implements the latter: it's now possible to update
sockmap from BPF context. As a next step, we can implement bpf_iter
for sockmap.

===

I've done some more fixups, and audited the safe contexts more
thoroughly. As a result I'm removing CGROUP_SKB, SK_MSG and SK_SKB
for now.

Changes in v3:
- Use CHECK as much as possible (Yonghong)
- Reject ARG_PTR_TO_MAP_VALUE_OR_NULL for sockmap (Yonghong)
- Remove CGROUP_SKB, SK_MSG, SK_SKB from safe contexts
- Test that the verifier rejects update from unsafe context

Changes in v2:
- Fix warning in patch #2 (Jakub K)
- Renamed override_map_arg_type (John)
- Only allow updating sockmap from known safe contexts (John)
- Use __s64 for sockmap updates from user space (Yonghong)
- Various small test fixes around test macros and such (Yonghong)

Thank your for your reviews!

1: https://lore.kernel.org/bpf/20200310174711.7490-1-lmb@cloudflare.com/

Lorenz Bauer (6):
  net: sk_msg: simplify sk_psock initialization
  bpf: sockmap: merge sockmap and sockhash update functions
  bpf: sockmap: call sock_map_update_elem directly
  bpf: override the meaning of ARG_PTR_TO_MAP_VALUE for sockmap and
    sockhash
  bpf: sockmap: allow update from BPF
  selftests: bpf: test sockmap update from BPF

 include/linux/bpf.h                           |   7 +
 include/linux/skmsg.h                         |  17 ---
 kernel/bpf/syscall.c                          |   5 +-
 kernel/bpf/verifier.c                         |  73 +++++++++-
 net/core/skmsg.c                              |  34 ++++-
 net/core/sock_map.c                           | 137 ++++++++----------
 net/ipv4/tcp_bpf.c                            |  13 +-
 net/ipv4/udp_bpf.c                            |   9 +-
 .../selftests/bpf/prog_tests/sockmap_basic.c  |  78 ++++++++++
 .../bpf/progs/test_sockmap_invalid_update.c   |  23 +++
 .../selftests/bpf/progs/test_sockmap_update.c |  48 ++++++
 11 files changed, 326 insertions(+), 118 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/test_sockmap_invalid_update.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_sockmap_update.c

-- 
2.25.1


^ permalink raw reply	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2020-08-21 22:23 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-21 10:29 [PATCH bpf-next v3 0/6] Allow updating sockmap / sockhash from BPF Lorenz Bauer
2020-08-21 10:29 ` [PATCH bpf-next v3 1/6] net: sk_msg: simplify sk_psock initialization Lorenz Bauer
2020-08-21 10:29 ` [PATCH bpf-next v3 2/6] bpf: sockmap: merge sockmap and sockhash update functions Lorenz Bauer
2020-08-21 10:29 ` [PATCH bpf-next v3 3/6] bpf: sockmap: call sock_map_update_elem directly Lorenz Bauer
2020-08-21 10:29 ` [PATCH bpf-next v3 4/6] bpf: override the meaning of ARG_PTR_TO_MAP_VALUE for sockmap and sockhash Lorenz Bauer
2020-08-21 15:46   ` Yonghong Song
2020-08-21 10:29 ` [PATCH bpf-next v3 5/6] bpf: sockmap: allow update from BPF Lorenz Bauer
2020-08-21 15:47   ` Yonghong Song
2020-08-21 10:29 ` [PATCH bpf-next v3 6/6] selftests: bpf: test sockmap " Lorenz Bauer
2020-08-21 16:13   ` Yonghong Song
2020-08-21 22:23 ` [PATCH bpf-next v3 0/6] Allow updating sockmap / sockhash " Alexei Starovoitov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).