Re: [PATCH bpf-next v9 0/5] New BPF helpers to accelerate synproxy

[Andrii Nakryiko <andrii.nakryiko@gmail.com>]

On Tue, May 3, 2022 at 10:14 AM Maxim Mikityanskiy <maximmi@nvidia.com> wrote:
>
> The first patch of this series is a documentation fix.
>
> The second patch allows BPF helpers to accept memory regions of fixed
> size without doing runtime size checks.
>
> The two next patches add new functionality that allows XDP to
> accelerate iptables synproxy.
>
> v1 of this series [1] used to include a patch that exposed conntrack
> lookup to BPF using stable helpers. It was superseded by series [2] by
> Kumar Kartikeya Dwivedi, which implements this functionality using
> unstable helpers.
>
> The third patch adds new helpers to issue and check SYN cookies without
> binding to a socket, which is useful in the synproxy scenario.
>
> The fourth patch adds a selftest, which includes an XDP program and a
> userspace control application. The XDP program uses socketless SYN
> cookie helpers and queries conntrack status instead of socket status.
> The userspace control application allows to tune parameters of the XDP
> program. This program also serves as a minimal example of usage of the
> new functionality.
>
> The last patch exposes the new helpers to TC BPF.
>
> The draft of the new functionality was presented on Netdev 0x15 [3].
>
> v2 changes:
>
> Split into two series, submitted bugfixes to bpf, dropped the conntrack
> patches, implemented the timestamp cookie in BPF using bpf_loop, dropped
> the timestamp cookie patch.
>
> v3 changes:
>
> Moved some patches from bpf to bpf-next, dropped the patch that changed
> error codes, split the new helpers into IPv4/IPv6, added verifier
> functionality to accept memory regions of fixed size.
>
> v4 changes:
>
> Converted the selftest to the test_progs runner. Replaced some
> deprecated functions in xdp_synproxy userspace helper.
>
> v5 changes:
>
> Fixed a bug in the selftest. Added questionable functionality to support
> new helpers in TC BPF, added selftests for it.
>
> v6 changes:
>
> Wrap the new helpers themselves into #ifdef CONFIG_SYN_COOKIES, replaced
> fclose with pclose and fixed the MSS for IPv6 in the selftest.
>
> v7 changes:
>
> Fixed the off-by-one error in indices, changed the section name to
> "xdp", added missing kernel config options to vmtest in CI.
>
> v8 changes:
>
> Properly rebased, dropped the first patch (the same change was applied
> by someone else), updated the cover letter.
>
> v9 changes:
>
> Fixed selftests for no_alu32.
>
> [1]: https://lore.kernel.org/bpf/20211020095815.GJ28644@breakpoint.cc/t/
> [2]: https://lore.kernel.org/bpf/20220114163953.1455836-1-memxor@gmail.com/
> [3]: https://netdevconf.info/0x15/session.html?Accelerating-synproxy-with-XDP
>
> Maxim Mikityanskiy (5):
>   bpf: Fix documentation of th_len in bpf_tcp_{gen,check}_syncookie
>   bpf: Allow helpers to accept pointers with a fixed size
>   bpf: Add helpers to issue and check SYN cookies in XDP
>   bpf: Add selftests for raw syncookie helpers
>   bpf: Allow the new syncookie helpers to work with SKBs
>

Is it expected that your selftests will fail on s390x? Please check [0]

  [0] https://github.com/kernel-patches/bpf/runs/6277764463?check_suite_focus=true#step:6:6130

>  include/linux/bpf.h                           |  10 +
>  include/net/tcp.h                             |   1 +
>  include/uapi/linux/bpf.h                      |  88 +-
>  kernel/bpf/verifier.c                         |  26 +-
>  net/core/filter.c                             | 128 +++
>  net/ipv4/tcp_input.c                          |   3 +-
>  scripts/bpf_doc.py                            |   4 +
>  tools/include/uapi/linux/bpf.h                |  88 +-
>  tools/testing/selftests/bpf/.gitignore        |   1 +
>  tools/testing/selftests/bpf/Makefile          |   5 +-
>  .../selftests/bpf/prog_tests/xdp_synproxy.c   | 144 +++
>  .../selftests/bpf/progs/xdp_synproxy_kern.c   | 819 ++++++++++++++++++
>  tools/testing/selftests/bpf/xdp_synproxy.c    | 466 ++++++++++
>  13 files changed, 1761 insertions(+), 22 deletions(-)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c
>  create mode 100644 tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c
>  create mode 100644 tools/testing/selftests/bpf/xdp_synproxy.c
>
> --
> 2.30.2
>