From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 058F8C282C4 for ; Tue, 12 Feb 2019 04:40:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C2FBA217FA for ; Tue, 12 Feb 2019 04:40:04 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="vdTIRsAk" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727458AbfBLEkD (ORCPT ); Mon, 11 Feb 2019 23:40:03 -0500 Received: from mail-pl1-f194.google.com ([209.85.214.194]:43345 "EHLO mail-pl1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726864AbfBLEkD (ORCPT ); Mon, 11 Feb 2019 23:40:03 -0500 Received: by mail-pl1-f194.google.com with SMTP id f90so658722plb.10 for ; Mon, 11 Feb 2019 20:40:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=sVkUSzKS1IRQW7Zo4umTPaaQPpUrlc5JgOEwZn1/OQU=; b=vdTIRsAk9/GTpwqCvetnm97i4EsTz7RYlnzj3lWk9g1q2CpshYXx5rn5eUWb+rX6h0 TZc73z/BBC5tkmKAEmJKmxwpB3t3QiEmC1NwmWvE1kacKnacYkuHqCuiqCu6EPc8bVjZ BNuOziSNCiVDfFhEfdAIGe5HbfJwPoXzoZ4nvwrYJISVll6QPqb1fUu7tjSQGuVkCoYR V8HfZJuyMCN0L8X1RL5pJ1sbDDmDOPPQOJhH2gS87M9A1ssloqLJXhVmg9NgnxeP56QN P+NO6hYdF/VHQGzSqwIHE2zLpGvJN80xmm7ULeRmVHoEC//iUT1J+vqerck3v4V43Pco yvTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=sVkUSzKS1IRQW7Zo4umTPaaQPpUrlc5JgOEwZn1/OQU=; b=WTDqnGLHj3Ve4Ne7m+cdZ3hszac3m6Q5m1pAQZafE1S0dSBkz8l/gYvZ/ySFloBwiG z+8o5H+WqZsZEae3Q5Sm6TZKNHqtNrZXTJ21kJ2WcFtbx71zFw3L2nDc7LzzCYd+HuNG J8GxvKwKN8o2AEXkY843My0CfAJ58QOKYt+d8pKpE/t8OotHgaoO0f2QlJ8xIaW6vtma 9gJlt9lExnZEPPw2H9cdD61986Elr3HfOGAtuV0sGje+58odAo5682vuDV7i4TYjEI/c illoqYsM4uofB9szu4xYWCasrNh+YhKc6zSnBrcI1C7OAvubG7KyFhf1YoUX72/NmnfV V6tw== X-Gm-Message-State: AHQUAuYPp4w2sul/V0dm63qMX8dq2nBuw9v0H0MRvtgwZueS01dw16Nd iNzOPiZOA/K6vp3yS9vqC90= X-Google-Smtp-Source: AHgI3IYxXsEYYHn8XD2X6+NieY1TN8+7DemubZ4xvXjlytYnCyhyhf4YndicTv1UYv++cjmrtiJFKQ== X-Received: by 2002:a17:902:2867:: with SMTP id e94mr2072304plb.264.1549946402335; Mon, 11 Feb 2019 20:40:02 -0800 (PST) Received: from ?IPv6:2601:282:800:fd80:907e:9842:c8fc:a8a7? ([2601:282:800:fd80:907e:9842:c8fc:a8a7]) by smtp.googlemail.com with ESMTPSA id l5sm15492399pgl.51.2019.02.11.20.40.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 11 Feb 2019 20:40:01 -0800 (PST) Subject: Re: [PATCH bpf-next v9 5/7] bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c To: Peter Oskolkov , Alexei Starovoitov , Daniel Borkmann , netdev@vger.kernel.org Cc: Peter Oskolkov , Willem de Bruijn References: <20190212004249.219268-1-posk@google.com> <20190212004249.219268-6-posk@google.com> From: David Ahern Message-ID: <494f0c40-6423-9985-fe40-f493da2eec0b@gmail.com> Date: Mon, 11 Feb 2019 21:39:59 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <20190212004249.219268-6-posk@google.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 2/11/19 5:42 PM, Peter Oskolkov wrote: > @@ -88,6 +90,35 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt, > return ret; > } > > +static int bpf_lwt_input_reroute(struct sk_buff *skb) > +{ > + int err = -EINVAL; > + > + if (skb->protocol == htons(ETH_P_IP)) { > + struct iphdr *iph = ip_hdr(skb); > + > + err = ip_route_input_noref(skb, iph->daddr, iph->saddr, > + iph->tos, skb_dst(skb)->dev); > + } else if (skb->protocol == htons(ETH_P_IPV6)) { > +#if IS_ENABLED(CONFIG_IPV6) > + err = ipv6_stub->ipv6_route_input(skb); > +#else > + pr_warn_once("BPF_LWT_REROUTE input: IPV6 not available\n"); > +#endif The stub defines ipv6_route_input when IPv6 is not enabled. addrconf_core.o is compiled in if NET is enabled irregardless of CONFIG_IPV6. ie., you don't need the IS_ENABLED check here. If a bpf program pushes a v6 header the stub returns -EAFNOSUPPORT based on patch 4. > + } else { > + pr_warn_once("BPF_LWT_REROUTE input: unsupported proto %d\n", > + skb->protocol); You don't need a warn on here; just return -EAFNOSUPPORT. > + } > + > + if (err) > + goto err; > + return dst_input(skb); > + > +err: > + kfree_skb(skb); > + return err; > +} > + > static int bpf_input(struct sk_buff *skb) > { > struct dst_entry *dst = skb_dst(skb); > @@ -99,6 +130,8 @@ static int bpf_input(struct sk_buff *skb) > ret = run_lwt_bpf(skb, &bpf->in, dst, NO_REDIRECT); > if (ret < 0) > return ret; > + if (ret == BPF_LWT_REROUTE) > + return bpf_lwt_input_reroute(skb); > } > > if (unlikely(!dst->lwtstate->orig_input)) { > @@ -148,6 +181,95 @@ static int xmit_check_hhlen(struct sk_buff *skb) > return 0; > } > > +static int bpf_lwt_xmit_reroute(struct sk_buff *skb) > +{ > + struct net_device *l3mdev = l3mdev_master_dev_rcu(skb_dst(skb)->dev); > + int oif = l3mdev ? l3mdev->ifindex : 0; > + struct dst_entry *dst = NULL; > + struct sock *sk; > + struct net *net; > + bool ipv4; > + int err; > + > + if (skb->protocol == htons(ETH_P_IP)) { > + ipv4 = true; > + } else if (skb->protocol == htons(ETH_P_IPV6)) { > + ipv4 = false; > + } else { > + pr_warn_once("BPF_LWT_REROUTE xmit: unsupported proto %d\n", > + skb->protocol); same here - no warn on. > + return -EINVAL; > + } > + > + sk = sk_to_full_sk(skb->sk); > + if (sk) { > + if (sk->sk_bound_dev_if) > + oif = sk->sk_bound_dev_if; > + net = sock_net(sk); > + } else { > + net = dev_net(skb_dst(skb)->dev); > + } > + > + if (ipv4) { > + struct iphdr *iph = ip_hdr(skb); > + struct flowi4 fl4 = {}; > + struct rtable *rt; > + > + fl4.flowi4_oif = oif; > + fl4.flowi4_mark = skb->mark; > + fl4.flowi4_uid = sock_net_uid(net, sk); > + fl4.flowi4_tos = RT_TOS(iph->tos); > + fl4.flowi4_flags = FLOWI_FLAG_ANYSRC; > + fl4.flowi4_proto = iph->protocol; > + fl4.daddr = iph->daddr; > + fl4.saddr = iph->saddr; > + > + rt = ip_route_output_key(net, &fl4); > + if (IS_ERR(rt) || rt->dst.error) > + return -EINVAL; > + dst = &rt->dst; > + } else { > +#if IS_ENABLED(CONFIG_IPV6) > + struct ipv6hdr *iph6 = ipv6_hdr(skb); > + struct flowi6 fl6 = {}; > + > + fl6.flowi6_oif = oif; > + fl6.flowi6_mark = skb->mark; > + fl6.flowi6_uid = sock_net_uid(net, sk); > + fl6.flowlabel = ip6_flowinfo(iph6); > + fl6.flowi6_proto = iph6->nexthdr; > + fl6.daddr = iph6->daddr; > + fl6.saddr = iph6->saddr; > + > + err = ipv6_stub->ipv6_dst_lookup(net, skb->sk, &dst, &fl6); > + if (err || IS_ERR(dst) || dst->error) > + return -EINVAL; > +#else > + pr_warn_once("BPF_LWT_REROUTE xmit: IPV6 not available\n"); > + return -EINVAL; > +#endif No #if .. #endif needed. The stub handles it.