Re: [RFC PATCH 1/3] ebpf: add next_skb_frag bpf helper for sk filter

On 06/08/2018 02:46 PM, Tushar Dave wrote:

On 06/08/2018 02:27 PM, Daniel Borkmann wrote:

quoted

On 06/08/2018 11:00 PM, Tushar Dave wrote:

quoted

Today socket filter only deals with linear skbs. This change allows
ebpf programs to look into non-linear skb e.g. skb frags. This will be
useful when users need to look into data which is not contained in the
linear part of skb.

Hmm, I don't think this statement is correct in its form here ... they
can handle non-linear skbs just fine.

Thanks Daniel for your reply.

quoted

Straight forward way is to use bpf_skb_load_bytes(). It's simple and uses
internally skb_header_pointer(), and that one of course walks everything
if it really has to via skb_copy_bits() (page frags _and_ frag list). And
if you need to look into mac/net headers that may otherwise not be 
accessible
anymore from socket layer, there's bpf_skb_load_bytes_relative() helper
which is effectively doing the negative offset trick from ld_abs/ind more
efficient for multi-byte loads.

I'm looking into bpf_skb_load_bytes and friends.

Daniel,

While I am trying to see if I can use exiting bpf_skb_load helpers, I am
wondering socket filter based ebpf program are allowed to change packet
data? In other words, can we use them to build firewall?

Thanks.

-Tushar

Thanks.
-Tushar

quoted

Thanks,
Daniel