From: Jakub Sitnicki <jakub@cloudflare.com>
To: bpf@vger.kernel.org
Cc: netdev@vger.kernel.org, kernel-team@cloudflare.com,
Lorenz Bauer <lmb@cloudflare.com>,
Marek Majkowski <marek@cloudflare.com>,
Stanislav Fomichev <sdf@google.com>
Subject: [PATCH bpf-next 0/8] Link-based program attachment to network namespaces
Date: Wed, 27 May 2020 19:08:32 +0200 [thread overview]
Message-ID: <20200527170840.1768178-1-jakub@cloudflare.com> (raw)
One of the pieces of feedback from recent review of BPF hooks for socket
lookup [0] was that new program types should use bpf_link-based attachment.
Unlike with cgroups-attached programs, there is no existing infrastructure
for using bpf_links with network namespaces. It is also not as simple as
updating a single bpf_prog pointer, like in case of direct program
attachment.
Due to that I've split out this work into its own series.
Series is organized as so:
Patches 1-4 prepare a space in struct net to keep state for attached BPF
programs, and massage the code in flow_dissector to make it attach type
agnostic to finally move under kernel/bpf/.
Patch 5, the most important one, introduces new bpf_link link type for
attaching to network namespace. As opposed to cgroups, we can't hold a
ref count on struct net from a bpf_link, so we get by with just RCU
protection.
I'd be grateful if someone more experienced using RCU could give this
patch a look. It is not exactly the textbook application of it.
Patches 6-8 make libbpf and bpftool aware of the new link type and add
tests to check that link create/update/query API works as intended.
Thanks to Lorenz and Marek for early feedback & reviews.
-jkbs
Cc: Lorenz Bauer <lmb@cloudflare.com>
Cc: Marek Majkowski <marek@cloudflare.com>
Cc: Stanislav Fomichev <sdf@google.com>
[0] https://lore.kernel.org/bpf/20200511185218.1422406-1-jakub@cloudflare.com/
Jakub Sitnicki (8):
flow_dissector: Don't grab update-side lock on prog detach from
pre_exit
flow_dissector: Pull locking up from prog attach callback
net: Introduce netns_bpf for BPF programs attached to netns
flow_dissector: Move out netns_bpf prog callbacks
bpf: Add link-based BPF program attachment to network namespace
libbpf: Add support for bpf_link-based netns attachment
bpftool: Support link show for netns-attached links
selftests/bpf: Add tests for attaching bpf_link to netns
include/linux/bpf-netns.h | 64 +++
include/linux/skbuff.h | 26 -
include/net/flow_dissector.h | 6 +
include/net/net_namespace.h | 4 +-
include/net/netns/bpf.h | 18 +
include/uapi/linux/bpf.h | 5 +
kernel/bpf/Makefile | 1 +
kernel/bpf/net_namespace.c | 387 ++++++++++++++
kernel/bpf/syscall.c | 10 +-
net/core/filter.c | 1 +
net/core/flow_dissector.c | 124 +----
tools/bpf/bpftool/link.c | 19 +
tools/include/uapi/linux/bpf.h | 5 +
tools/lib/bpf/libbpf.c | 20 +-
tools/lib/bpf/libbpf.h | 2 +
tools/lib/bpf/libbpf.map | 1 +
.../bpf/prog_tests/flow_dissector_reattach.c | 500 +++++++++++++++++-
17 files changed, 1026 insertions(+), 167 deletions(-)
create mode 100644 include/linux/bpf-netns.h
create mode 100644 include/net/netns/bpf.h
create mode 100644 kernel/bpf/net_namespace.c
--
2.25.4
next reply other threads:[~2020-05-27 17:08 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-27 17:08 Jakub Sitnicki [this message]
2020-05-27 17:08 ` [PATCH bpf-next 1/8] flow_dissector: Don't grab update-side lock on prog detach from pre_exit Jakub Sitnicki
2020-05-27 17:35 ` sdf
2020-05-27 17:08 ` [PATCH bpf-next 2/8] flow_dissector: Pull locking up from prog attach callback Jakub Sitnicki
2020-05-27 17:35 ` sdf
2020-05-27 17:08 ` [PATCH bpf-next 3/8] net: Introduce netns_bpf for BPF programs attached to netns Jakub Sitnicki
2020-05-27 17:40 ` sdf
2020-05-27 19:31 ` Jakub Sitnicki
2020-05-27 20:36 ` sdf
2020-05-27 17:08 ` [PATCH bpf-next 4/8] flow_dissector: Move out netns_bpf prog callbacks Jakub Sitnicki
2020-05-27 17:08 ` [PATCH bpf-next 5/8] bpf: Add link-based BPF program attachment to network namespace Jakub Sitnicki
2020-05-27 17:48 ` sdf
2020-05-27 19:54 ` Jakub Sitnicki
2020-05-27 20:38 ` sdf
2020-05-28 10:34 ` Jakub Sitnicki
2020-05-27 20:53 ` sdf
2020-05-28 11:03 ` Jakub Sitnicki
2020-05-28 16:09 ` sdf
2020-05-28 2:54 ` kbuild test robot
2020-06-04 23:38 ` Nick Desaulniers
2020-06-05 14:41 ` Jakub Sitnicki
2020-05-28 5:56 ` Andrii Nakryiko
2020-05-28 12:26 ` Jakub Sitnicki
2020-05-28 18:09 ` Andrii Nakryiko
2020-05-28 18:48 ` Alexei Starovoitov
2020-05-28 13:30 ` Jakub Sitnicki
2020-05-27 17:08 ` [PATCH bpf-next 6/8] libbpf: Add support for bpf_link-based netns attachment Jakub Sitnicki
2020-05-28 5:59 ` Andrii Nakryiko
2020-05-28 13:05 ` Jakub Sitnicki
2020-05-27 17:08 ` [PATCH bpf-next 7/8] bpftool: Support link show for netns-attached links Jakub Sitnicki
2020-05-28 6:02 ` Andrii Nakryiko
2020-05-28 13:10 ` Jakub Sitnicki
2020-05-27 17:08 ` [PATCH bpf-next 8/8] selftests/bpf: Add tests for attaching bpf_link to netns Jakub Sitnicki
2020-05-28 6:08 ` Andrii Nakryiko
2020-05-28 13:29 ` Jakub Sitnicki
2020-05-28 18:31 ` Andrii Nakryiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200527170840.1768178-1-jakub@cloudflare.com \
--to=jakub@cloudflare.com \
--cc=bpf@vger.kernel.org \
--cc=kernel-team@cloudflare.com \
--cc=lmb@cloudflare.com \
--cc=marek@cloudflare.com \
--cc=netdev@vger.kernel.org \
--cc=sdf@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).