[PATCH v3 bpf-next 1/3] bpf: Add get_netns_id helper function for sock_ops
From: Lingpeng Chen <hidden>
Date: 2020-02-20 07:11:43
Also in:
bpf
Subsystem:
bpf [general] (safe dynamic programs and tools), bpf [networking] (tcx & tc bpf, sock_addr), networking [general], the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a uniq connection because there may be multi net namespace. For example, there may be a chance that netns a and netns b all listen on 127.0.0.1:8080 and the client with same port 40782 connect to them. Without netns number, sock ops program can't distinguish them. Using bpf_get_netns_id helper to get current connection netns id to distinguish connections. Signed-off-by: Lingpeng Chen <redacted> --- include/uapi/linux/bpf.h | 9 ++++++++- net/core/filter.c | 20 ++++++++++++++++++++ 2 files changed, 28 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index f1d74a2bd234..e79082f78b74 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h@@ -2892,6 +2892,12 @@ union bpf_attr { * Obtain the 64bit jiffies * Return * The 64 bit jiffies + * + * u64 bpf_get_netns_id(struct bpf_sock_ops *bpf_socket) + * Description + * Obtain netns id of sock + * Return + * The current netns inum */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \
@@ -3012,7 +3018,8 @@ union bpf_attr { FN(probe_read_kernel_str), \ FN(tcp_send_ack), \ FN(send_signal_thread), \ - FN(jiffies64), + FN(jiffies64), \ + FN(get_netns_id), /* integer value in 'imm' field of BPF_CALL instruction selects which helper * function eBPF program intends to call
diff --git a/net/core/filter.c b/net/core/filter.c
index c180871e606d..5302ec9f7c0d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c@@ -4421,6 +4421,24 @@ static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = { .arg2_type = ARG_ANYTHING, }; +BPF_CALL_1(bpf_get_netns_id_sock_ops, struct bpf_sock_ops_kern *, bpf_sock) +{ +#ifdef CONFIG_NET_NS + struct sock *sk = bpf_sock->sk; + + return (u64)sk->sk_net.net->ns.inum; +#else + return 0; +#endif +} + +static const struct bpf_func_proto bpf_get_netns_id_sock_ops_proto = { + .func = bpf_get_netns_id_sock_ops, + .gpl_only = false, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_CTX, +}; + const struct ipv6_bpf_stub *ipv6_bpf_stub __read_mostly; EXPORT_SYMBOL_GPL(ipv6_bpf_stub);
@@ -6218,6 +6236,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_FUNC_tcp_sock: return &bpf_tcp_sock_proto; #endif /* CONFIG_INET */ + case BPF_FUNC_get_netns_id: + return &bpf_get_netns_id_sock_ops_proto; default: return bpf_base_func_proto(func_id); }
--
2.20.1