| Message ID | 20200729003104.1280813-1-sdf@google.com |
|---|---|
| State | Accepted |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf-next,1/2] bpf: expose socket storage to BPF_PROG_TYPE_CGROUP_SOCK | expand |
On Tue, Jul 28, 2020 at 5:31 PM Stanislav Fomichev <sdf@google.com> wrote: > > This lets us use socket storage from the following hooks: > * BPF_CGROUP_INET_SOCK_CREATE > * BPF_CGROUP_INET_SOCK_RELEASE > * BPF_CGROUP_INET4_POST_BIND > * BPF_CGROUP_INET6_POST_BIND > > Using existing 'bpf_sk_storage_get_proto' doesn't work because > second argument is ARG_PTR_TO_SOCKET. Even though > BPF_PROG_TYPE_CGROUP_SOCK hooks operate on 'struct bpf_sock', > the verifier still considers it as a PTR_TO_CTX. > That's why I'm adding another 'bpf_sk_storage_get_cg_sock_proto' > definition strictly for BPF_PROG_TYPE_CGROUP_SOCK which accepts > ARG_PTR_TO_CTX which is really 'struct sock' for this program type. > > Cc: Martin KaFai Lau <kafai@fb.com> > Signed-off-by: Stanislav Fomichev <sdf@google.com> Acked-by: Song Liu <songliubraving@fb.com>
On 7/29/20 2:31 AM, Stanislav Fomichev wrote: > This lets us use socket storage from the following hooks: > * BPF_CGROUP_INET_SOCK_CREATE > * BPF_CGROUP_INET_SOCK_RELEASE > * BPF_CGROUP_INET4_POST_BIND > * BPF_CGROUP_INET6_POST_BIND > > Using existing 'bpf_sk_storage_get_proto' doesn't work because > second argument is ARG_PTR_TO_SOCKET. Even though > BPF_PROG_TYPE_CGROUP_SOCK hooks operate on 'struct bpf_sock', > the verifier still considers it as a PTR_TO_CTX. > That's why I'm adding another 'bpf_sk_storage_get_cg_sock_proto' > definition strictly for BPF_PROG_TYPE_CGROUP_SOCK which accepts > ARG_PTR_TO_CTX which is really 'struct sock' for this program type. > > Cc: Martin KaFai Lau <kafai@fb.com> > Signed-off-by: Stanislav Fomichev <sdf@google.com> Makes sense, both applied, thanks! [...] > diff --git a/net/core/filter.c b/net/core/filter.c > index 29e3455122f7..7124f0fe6974 100644 > --- a/net/core/filter.c > +++ b/net/core/filter.c > @@ -6187,6 +6187,7 @@ bool bpf_helper_changes_pkt_data(void *func) > } > > const struct bpf_func_proto bpf_event_output_data_proto __weak; > +const struct bpf_func_proto bpf_sk_storage_get_cg_sock_proto __weak; > > static const struct bpf_func_proto * > sock_filter_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) > @@ -6219,6 +6220,8 @@ sock_filter_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) > case BPF_FUNC_get_cgroup_classid: > return &bpf_get_cgroup_classid_curr_proto; > #endif > + case BPF_FUNC_sk_storage_get: > + return &bpf_sk_storage_get_cg_sock_proto; Been wondering whether we need these for connect/sendmsg/etc hooks that operate on sock_addr, but for those we have them already covered in sock_addr_func_proto() therefore all good. sock_addr_func_proto() also lists the BPF_FUNC_sk_storage_delete. Should we add that one as well for sock_filter_func_proto()? Presumably create/release doesn't make sense, but any use case for bind hook? > default: > return bpf_base_func_proto(func_id); > } >
On 07/30, Daniel Borkmann wrote: > On 7/29/20 2:31 AM, Stanislav Fomichev wrote: [..] > sock_addr_func_proto() also lists the BPF_FUNC_sk_storage_delete. Should > we add > that one as well for sock_filter_func_proto()? Presumably create/release > doesn't > make sense, but any use case for bind hook? Right, I didn't think delete makes sense for create/release, but maybe it does for post_bind :-/ Let me put it on my list, I'll follow up!
diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c index eafcd15e7dfd..d3377c90a291 100644 --- a/net/core/bpf_sk_storage.c +++ b/net/core/bpf_sk_storage.c @@ -944,6 +944,16 @@ const struct bpf_func_proto bpf_sk_storage_get_proto = { .arg4_type = ARG_ANYTHING, }; +const struct bpf_func_proto bpf_sk_storage_get_cg_sock_proto = { + .func = bpf_sk_storage_get, + .gpl_only = false, + .ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL, + .arg1_type = ARG_CONST_MAP_PTR, + .arg2_type = ARG_PTR_TO_CTX, /* context is 'struct sock' */ + .arg3_type = ARG_PTR_TO_MAP_VALUE_OR_NULL, + .arg4_type = ARG_ANYTHING, +}; + const struct bpf_func_proto bpf_sk_storage_delete_proto = { .func = bpf_sk_storage_delete, .gpl_only = false, diff --git a/net/core/filter.c b/net/core/filter.c index 29e3455122f7..7124f0fe6974 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -6187,6 +6187,7 @@ bool bpf_helper_changes_pkt_data(void *func) } const struct bpf_func_proto bpf_event_output_data_proto __weak; +const struct bpf_func_proto bpf_sk_storage_get_cg_sock_proto __weak; static const struct bpf_func_proto * sock_filter_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) @@ -6219,6 +6220,8 @@ sock_filter_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_FUNC_get_cgroup_classid: return &bpf_get_cgroup_classid_curr_proto; #endif + case BPF_FUNC_sk_storage_get: + return &bpf_sk_storage_get_cg_sock_proto; default: return bpf_base_func_proto(func_id); }
This lets us use socket storage from the following hooks: * BPF_CGROUP_INET_SOCK_CREATE * BPF_CGROUP_INET_SOCK_RELEASE * BPF_CGROUP_INET4_POST_BIND * BPF_CGROUP_INET6_POST_BIND Using existing 'bpf_sk_storage_get_proto' doesn't work because second argument is ARG_PTR_TO_SOCKET. Even though BPF_PROG_TYPE_CGROUP_SOCK hooks operate on 'struct bpf_sock', the verifier still considers it as a PTR_TO_CTX. That's why I'm adding another 'bpf_sk_storage_get_cg_sock_proto' definition strictly for BPF_PROG_TYPE_CGROUP_SOCK which accepts ARG_PTR_TO_CTX which is really 'struct sock' for this program type. Cc: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Stanislav Fomichev <sdf@google.com> --- net/core/bpf_sk_storage.c | 10 ++++++++++ net/core/filter.c | 3 +++ 2 files changed, 13 insertions(+)