From patchwork Tue Oct 19 14:46:46 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Mikityanskiy X-Patchwork-Id: 12570101 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6B7EC433EF for ; Tue, 19 Oct 2021 14:47:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A6E4A61038 for ; Tue, 19 Oct 2021 14:47:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231450AbhJSOty (ORCPT ); Tue, 19 Oct 2021 10:49:54 -0400 Received: from mail-dm6nam10on2078.outbound.protection.outlook.com ([40.107.93.78]:37089 "EHLO NAM10-DM6-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S231250AbhJSOtn (ORCPT ); Tue, 19 Oct 2021 10:49:43 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dwIhJaFPf25JklXDlUI1s/5M3JHN7laa0OOAH59d3sOd5wHF8GRuZAZjIla4iWw+Foj7xOJY7aYg5CZY1pytaNdvDYJnwc6NzLNZN6alX02DMNyOWB2tZdCRFNRyZjLsGfFsE5dclkNnBZyzDx+3IJTV6DgAevH6Z9kI0pbn4kYfMcURt9uLo2G5wQBH9+chqJWtvo5L6nQuRV/XS+roCoSojGRzwhM56LXwvcTm3ds6tTZfSwVnbc7QfOymoRJd+2Fx37VjSxMqk0+XqSOLdXblPqMtiUMkhWzDDgOgE3wtf5EwmZphoqVnNjXTmsnu/WPDaAhk/Y7UQyxV8/sIpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=r7DpgvEwdn7iizPr5bjsqGU1PVBCFESrVJBDSlHkEIc=; b=djPwJEdyy8zmsIl8qteJxnZtgumh9gF4nBhYMpq30P+R7rzABQipcuYzWI5WGH5XyrL8c3v2HSuTIKsgzLcT0H3RJ/MyaJWeTFsndX0ZYtKf0dZw/A+arzL7Mwy7B0j4xjWESX5FlYqvihpvEpWeJtwYm44Oi0O+SWbK6KdwkgP1Oe2u1OwaY6dOWimbGoI3cpQ4HptwxGhVEZbxhEIrp1gcu1s3dZRi1y2vLrc3S5oq5xbyifjlG0QbNRQH44h5V7jnl8OF8oQRXAAeVp7zoUMzpcuUoGeiG/02xUxjlv+b949Xz3deqv3BoqsaCHGQVgTYBSIwwXJK0yPtjp6zXw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.36) smtp.rcpttodomain=google.com smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=r7DpgvEwdn7iizPr5bjsqGU1PVBCFESrVJBDSlHkEIc=; b=Pg+4s8SMZ2MnFi4WxX+FASrRzA0eisDQeXFsEE1NkwefAL4EIkDI0SX7zEsISxGPHAhcWPAXpBqZEr51xwqu8HsfhzJcVsxv2lsnLggxuz2+OHQH2jol4jgeE6K4oYJEwjw014VisfAm8bmxR/fuGQLB4o4FGXV8gCk6UZUkG6nPd0QAx80GZ/NBw3AsQC54lZYkhmJW9Sdg2z5YG9sT1pchxl5JScs0YQqo2VMFAMV1x8ISEusX0WHtwQawK+e/BOyd1FZ2OfPY91lX3eTDKfWi8YEWqFdpGSBgEONh1UWqu4gj1S51R+XmdBbI7GWEvSKIkMLkqafYQqy7BC5Gxw== Received: from MWHPR03CA0013.namprd03.prod.outlook.com (2603:10b6:300:117::23) by CY4PR12MB1893.namprd12.prod.outlook.com (2603:10b6:903:127::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.18; Tue, 19 Oct 2021 14:47:29 +0000 Received: from CO1NAM11FT015.eop-nam11.prod.protection.outlook.com (2603:10b6:300:117:cafe::b4) by MWHPR03CA0013.outlook.office365.com (2603:10b6:300:117::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:47:29 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.36) smtp.mailfrom=nvidia.com; google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.36 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.36; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.36) by CO1NAM11FT015.mail.protection.outlook.com (10.13.175.130) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:47:28 +0000 Received: from HQMAIL107.nvidia.com (172.20.187.13) by HQMAIL101.nvidia.com (172.20.187.10) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 14:47:25 +0000 Received: from vdi.nvidia.com (172.20.187.6) by mail.nvidia.com (172.20.187.13) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Tue, 19 Oct 2021 14:47:14 +0000 From: Maxim Mikityanskiy To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh CC: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Hideaki YOSHIFUJI , David Ahern , "Jesper Dangaard Brouer" , Nathan Chancellor , "Nick Desaulniers" , Brendan Jackman , Florent Revest , Joe Stringer , "Lorenz Bauer" , Tariq Toukan , , , , Maxim Mikityanskiy Subject: [PATCH bpf-next 01/10] bpf: Use ipv6_only_sock in bpf_tcp_gen_syncookie Date: Tue, 19 Oct 2021 17:46:46 +0300 Message-ID: <20211019144655.3483197-2-maximmi@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211019144655.3483197-1-maximmi@nvidia.com> References: <20211019144655.3483197-1-maximmi@nvidia.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b0474ccf-f881-4441-2713-08d9930f5fbd X-MS-TrafficTypeDiagnostic: CY4PR12MB1893: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:1169; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: v4iJwkEB1OyZtb8PyVTAMSwGyfTWV0rKqSi5INKm4KpMQ0KIp7/P5jvquKlQjsfJpSuIxOBlq/QktDjxXtVUbsoLX1y46qpCe3oLd7cuyzgvf5SQMEJtruWWqA3XnnbVqitLgh1kNsEHY+LXVKw5duHN8mIWmMJinoGnLKbzbS78rlwQ9PyClXyQZnNfmfRemAuC8TPwIEiE5fn/hJOn+VBKYPMfdT4Wng/CJZP/VIs/RYzxMdfUpolfqND9heS+Iv5lTVgB1Yq9c9YG7Z+miRbfGcfdx7SvHXUPJ8RP3W/oLxtJhIImtWbo+k7b1vsubnHytFrxHh5LFm5QkiSfZR3FCmkkqQ+hKtDMHw+cCwVKQ/6vkU7z4syUxDdrHeEFNL4XcmfzrVPkdNWQY9fvLgqa+LMLhVNaPw68e56vE0BOeykYNXmYQSWQvaNGrB852suNhndb8pNceUqVosYN+xAvUfaGCkqiQhIkEdSpUB9gRXedWBpHxLfcteJCDvxSqTHrfFITQ67pWSsLNu4IoFNM/CjVUrlsY4mZF8N7nOXyWlBsEdPxf1UJxrjrFZGjUJiP0qYwv7qMwnf7/KSDWZjMNpOHRabFAbx+2Y+cIwXHTvp7fTk5wHksI9MI6aSt50B/mMjq0QFRrUffnkGTS9GDdMizFYGURuQskg790hcLa8ATElKQ1m6s2S3mB4CH5XxgVp8TwrrmowrxtJaZbw== X-Forefront-Antispam-Report: CIP:216.228.112.36;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:schybrid05.nvidia.com;CAT:NONE;SFS:(4636009)(36840700001)(46966006)(356005)(316002)(36860700001)(26005)(7636003)(7416002)(54906003)(186003)(5660300002)(2616005)(83380400001)(110136005)(2906002)(8676002)(86362001)(508600001)(336012)(7696005)(8936002)(426003)(47076005)(36756003)(4744005)(107886003)(4326008)(1076003)(70206006)(70586007)(82310400003)(6666004)(36906005);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 14:47:28.1115 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b0474ccf-f881-4441-2713-08d9930f5fbd X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.36];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT015.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR12MB1893 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net Instead of querying the sk_ipv6only field directly, use the dedicated ipv6_only_sock helper. Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan --- net/core/filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 4bace37a6a44..d830055d477c 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -6788,7 +6788,7 @@ BPF_CALL_5(bpf_tcp_gen_syncookie, struct sock *, sk, void *, iph, u32, iph_len, */ switch (((struct iphdr *)iph)->version) { case 4: - if (sk->sk_family == AF_INET6 && sk->sk_ipv6only) + if (sk->sk_family == AF_INET6 && ipv6_only_sock(sk)) return -EINVAL; mss = tcp_v4_get_syncookie(sk, iph, th, &cookie); From patchwork Tue Oct 19 14:46:47 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Mikityanskiy X-Patchwork-Id: 12570103 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B131C43219 for ; Tue, 19 Oct 2021 14:47:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 532526135F for ; Tue, 19 Oct 2021 14:47:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231741AbhJSOuA (ORCPT ); Tue, 19 Oct 2021 10:50:00 -0400 Received: from mail-dm3nam07on2054.outbound.protection.outlook.com ([40.107.95.54]:4832 "EHLO NAM02-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S232568AbhJSOt6 (ORCPT ); Tue, 19 Oct 2021 10:49:58 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TfWfD1o2Bp2QtmYhRrYEl+VJyq97RGb0bP4das5qSztfOCTF6CsgsSqH3PzckdEIGCND9hghzbJwO5HGJOicmaL43x7tjv0detKk1QcsMkrQKOOB8rt+ngmSBxkP7zj2xCOFH7MNUTc+KM6ISp4tZ9hz1bNMETCCXmkmo6XCrDO2HGtQncoePf+9CV3oW9KinFku2A9YWSnpA9zeh3zhueiDUqLjjGEB6dfel3vWm+Rmsxk2gjU5Zaejwuwjd3u2sPEGTDsQn6ydsTQr1NLovH3VLzfG/KMuJh8Wy61D7SVHwcr9NygXT0wHRwOX7qonal4R86XxfHOtueB+tiuxrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=QwTjwXxdG12o2mQxxRArAsWV4kp+J5whluLckcXufEY=; b=h9PEg0mZuKLHFP5VZs8PMyxlaDA5BbPsDwxZNPeg4UfUNf6/eyawky+leEGdFPlNFiJr2VzrfkzetSKaFBf5Kg/3a7PjsBPoIiUGsWVThR0XYNRSvTvYus0Onb987Eu5vf1mqVc0cziUhK9yDzkDdytiIt/a9nJqMkmbfMZ5klnOJVTFmY9whfRpmPhpoo3FA/Hq0WG39ZECC9mKvlPCAGSLo3nWWrSe3ZSksurmUr6T5FbSmg8VQ9ZMuv6zZnI41ULbFh2dvH3rONLtOXBBFJeBKPjdaDJ+d2POq7ZWLrGcHJA255KFrgMSXK8xPMOCKYds4bbt5mDWBPCSPkzRKA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.34) smtp.rcpttodomain=google.com smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QwTjwXxdG12o2mQxxRArAsWV4kp+J5whluLckcXufEY=; b=RFsH5apj1amfKxAdkvyeOrFZitWxuYukyq507eqjwHkbsJUwpsy441r4iSuUV010lEtoXvWDmbcNEKTfET5HE73OryCegNSHpSHClB5IbGRglZlvspUMXiTppQmyccngjCs+reT7PlpCvuIArrUurWHtBDzYsoOIHiVn7rCSFRXWjxFHFZzTAd9QtXxcsieztO/C0RwmLRhFPmKZLz0JT0veRt4WAJpLseKqw/LwHhTk9iAF5RX+BoMW2tmv4qeC5Gsd5QOTUYBOdjNIAPx8LU4gPqxRD09PbijJhuAMpbIbqErjh3dWX2RSWypIeY7UIVQb9JACvOTYh2/Nn8GWAA== Received: from DM6PR04CA0019.namprd04.prod.outlook.com (2603:10b6:5:334::24) by MWHPR12MB1613.namprd12.prod.outlook.com (2603:10b6:301:11::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.16; Tue, 19 Oct 2021 14:47:43 +0000 Received: from DM6NAM11FT031.eop-nam11.prod.protection.outlook.com (2603:10b6:5:334:cafe::a8) by DM6PR04CA0019.outlook.office365.com (2603:10b6:5:334::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.18 via Frontend Transport; Tue, 19 Oct 2021 14:47:43 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.34) smtp.mailfrom=nvidia.com; google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.34 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.34; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.34) by DM6NAM11FT031.mail.protection.outlook.com (10.13.172.203) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:47:42 +0000 Received: from HQMAIL107.nvidia.com (172.20.187.13) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 14:47:38 +0000 Received: from vdi.nvidia.com (172.20.187.6) by mail.nvidia.com (172.20.187.13) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Tue, 19 Oct 2021 14:47:26 +0000 From: Maxim Mikityanskiy To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh CC: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Hideaki YOSHIFUJI , David Ahern , "Jesper Dangaard Brouer" , Nathan Chancellor , "Nick Desaulniers" , Brendan Jackman , Florent Revest , Joe Stringer , Lorenz Bauer , Tariq Toukan , , , , Maxim Mikityanskiy Subject: [PATCH bpf-next 02/10] bpf: Support dual-stack sockets in bpf_tcp_check_syncookie Date: Tue, 19 Oct 2021 17:46:47 +0300 Message-ID: <20211019144655.3483197-3-maximmi@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211019144655.3483197-1-maximmi@nvidia.com> References: <20211019144655.3483197-1-maximmi@nvidia.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 7d9e9ae9-f70e-498f-a6d8-08d9930f6838 X-MS-TrafficTypeDiagnostic: MWHPR12MB1613: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: vRCszz2Ht3l9BG44B4UFz+Q1OMaS+0V1EIIMF6sJDnZk7YI+Nze4BGLGog2NvDuGLgdZY14m/AF6vocsyGpn9CbibM7EPKNAVCIPV/N7/qPZ56BHYCO2/IEUDAe8MgJle9Qt92rfz7Rh2ja2DLQLN63TIpAx4KSeM2lTjYqXc9K7NHCH/9eSBrrVclWI+VFU23Hbhxz7Zt1IWyqTqaXkeaOgMIgJDxuPP1gn20rqwYFJ82+YrKvsL+smT+D+CTHI4u6+GTPuIG7N0nWMs4Qj4HQu7/Wjv1R+OrdAH/c9JU0r64EWXgHGg015T3XqFNNLHy+WzaZ9wa6hacuY0QJmuM2x86vN3eHhbRYbwmBrMu25fbI9+0Fycuq1VP/Zxfju8WEaAk64J4mh4qWpLHYQkJZ1VXOKxwZuZ2G1vlqg09XSknn2qJ9xytd+RJKMnZ1CJzBSjbtRpgJBtxIsOTOQnXdVvzQsyC9fHBpa36vHGHclYGXkN+q+Z1e2qvZ1UVwr4hM/Bya9PT6/q/Qt5exYvAatioQnqhV7d7Sa5YkcLMPNgARLPQPmwmmnZqugnJS6efJB66AG7LvtL1zOpIYP39gbf/t8xbsS288+JsDvVIn7hkO7XwfBImb1wGkSeASWRbvToA8Tp8rLtja8U+mSJJtj3COpWF+MLMwUhyt/3RIjpIbIYyatE0vVrsvkWPEo2JCyTtvwjK5d8I6D4dulmQ== X-Forefront-Antispam-Report: CIP:216.228.112.34;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:schybrid03.nvidia.com;CAT:NONE;SFS:(4636009)(36840700001)(46966006)(7416002)(47076005)(36756003)(186003)(1076003)(86362001)(7636003)(356005)(70586007)(83380400001)(26005)(426003)(4326008)(2616005)(110136005)(107886003)(316002)(36860700001)(5660300002)(70206006)(336012)(54906003)(2906002)(82310400003)(508600001)(8936002)(7696005)(36906005)(6666004)(8676002);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 14:47:42.6304 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 7d9e9ae9-f70e-498f-a6d8-08d9930f6838 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.34];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT031.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR12MB1613 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net bpf_tcp_gen_syncookie looks at the IP version in the IP header and validates the address family of the socket. It supports IPv4 packets in AF_INET6 dual-stack sockets. On the other hand, bpf_tcp_check_syncookie looks only at the address family of the socket, ignoring the real IP version in headers, and validates only the packet size. This implementation has some drawbacks: 1. Packets are not validated properly, allowing a BPF program to trick bpf_tcp_check_syncookie into handling an IPv6 packet on an IPv4 socket. 2. Dual-stack sockets fail the checks on IPv4 packets. IPv4 clients end up receiving a SYNACK with the cookie, but the following ACK gets dropped. This patch fixes these issues by changing the checks in bpf_tcp_check_syncookie to match the ones in bpf_tcp_gen_syncookie. IP version from the header is taken into account, and it is validated properly with address family. Fixes: 399040847084 ("bpf: add helper to check for a valid SYN cookie") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan --- net/core/filter.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index d830055d477c..6cfb676e1adb 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -6714,24 +6714,33 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len if (!th->ack || th->rst || th->syn) return -ENOENT; + if (unlikely(iph_len < sizeof(struct iphdr))) + return -EINVAL; + if (tcp_synq_no_recent_overflow(sk)) return -ENOENT; cookie = ntohl(th->ack_seq) - 1; - switch (sk->sk_family) { - case AF_INET: - if (unlikely(iph_len < sizeof(struct iphdr))) + /* Both struct iphdr and struct ipv6hdr have the version field at the + * same offset so we can cast to the shorter header (struct iphdr). + */ + switch (((struct iphdr *)iph)->version) { + case 4: + if (sk->sk_family == AF_INET6 && ipv6_only_sock(sk)) return -EINVAL; ret = __cookie_v4_check((struct iphdr *)iph, th, cookie); break; #if IS_BUILTIN(CONFIG_IPV6) - case AF_INET6: + case 6: if (unlikely(iph_len < sizeof(struct ipv6hdr))) return -EINVAL; + if (sk->sk_family != AF_INET6) + return -EINVAL; + ret = __cookie_v6_check((struct ipv6hdr *)iph, th, cookie); break; #endif /* CONFIG_IPV6 */ From patchwork Tue Oct 19 14:46:48 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Mikityanskiy X-Patchwork-Id: 12570105 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F280C433FE for ; Tue, 19 Oct 2021 14:47:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 48B1F6113B for ; Tue, 19 Oct 2021 14:47:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232286AbhJSOuJ (ORCPT ); Tue, 19 Oct 2021 10:50:09 -0400 Received: from mail-bn8nam11on2084.outbound.protection.outlook.com ([40.107.236.84]:40160 "EHLO NAM11-BN8-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S229790AbhJSOuJ (ORCPT ); Tue, 19 Oct 2021 10:50:09 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Jwpc3cOGJQp6eFJp2nbzDBjJeSUDawedApdWjo/yj0wFEEY9n/1YtYDUtnfZnIPi5IwjG27DXzn0OLwACwOrHnHBWxmsq13ioaGQ2fSGz2DQjaS4FLxQmEx8Hj9q5GKNqJq5Uc9xB6YsT0g/1G01p0ol7H05igKySFSPTdvjfn1MOvAD7tojuGWDkiVgoMwnbO7t9C3sSG01SkKlNtJUx8e2PW5XD1TB1LL+DzYtvmwKE11ARlzG6E2WCGsPZKBoar9u+HZfiePyX15RdTk8kBndSOArvJ+MIElPrr62okS7XS0QoHxF8PDx65kSSskMxE8LWrTnXZT9Bh7uLqWhEA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=6iBQ0gwMkFusxTqbsXw5hdDyo8RoCQn5IqnfK77WvkY=; b=jUJMdkgLIFYByMkTimXqIfQIyVa+MDvR5/n0Snuahf9sS6FPVRCpi/NPgEIjEtpCwWYv6FKanJfXVA/+qGPdgQjFnl/OWX1tTBORFcbWK8oyr7lzZWk483PnmTkm8nDGn9nrzAoOZmPWy9Xr6vgHMM7KA0qkMAUUdlzYht66a5TzFoSVZOU+rOL51d6JwxPoPzmQZBEtC25hRQzOYF2CDnIwu0NxfPWly3RYmC+qEbRg7annn9sQ85StL8Enwgvvhx9hv8yge4O6PdMWbuQpEmIX1VlpDopM7HF+6zjRnnjVfMq87faGJgIn5bgUQY7BYZOvLokXB82rTSmd6l1z8g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.32) smtp.rcpttodomain=google.com smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6iBQ0gwMkFusxTqbsXw5hdDyo8RoCQn5IqnfK77WvkY=; b=FEFBeIrS85jLyOItDt3aMj2dhibqq6goADnZnWCFkgWtsvSFUvf/1DQUybYRVTFrYCgVqXDMF6hgoTZcN/whGa/MHfy1Kw16B3+0mgd1nqJwapq8vE8c8vC1ZHl9FQB4ie9Y/w628xz8DS+cO+EqdbFxF+nQVw9ILxxUHt/QAHy+KBVHQXqBAFl3g+07PmzRitWVhyBEW6R8eKAYyp8N9Rce+cqCKJxYkaah9ctycczlC+GkuaIZJIcPgcgiV4xZn/ug6SrBSWkOuW0PNdY2cdo0ZXB2pfDf6D9wf770UGYDy1xYaf8WMqTcu3HBrFlQVD/cAtm7SK8OS3z/XmNOLA== Received: from DM6PR06CA0023.namprd06.prod.outlook.com (2603:10b6:5:120::36) by BN6PR12MB1635.namprd12.prod.outlook.com (2603:10b6:405:3::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.16; Tue, 19 Oct 2021 14:47:52 +0000 Received: from DM6NAM11FT023.eop-nam11.prod.protection.outlook.com (2603:10b6:5:120:cafe::f7) by DM6PR06CA0023.outlook.office365.com (2603:10b6:5:120::36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:47:52 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.32) smtp.mailfrom=nvidia.com; google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.32 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.32; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.32) by DM6NAM11FT023.mail.protection.outlook.com (10.13.173.96) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:47:51 +0000 Received: from HQMAIL107.nvidia.com (172.20.187.13) by HQMAIL109.nvidia.com (172.20.187.15) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 07:47:50 -0700 Received: from vdi.nvidia.com (172.20.187.6) by mail.nvidia.com (172.20.187.13) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Tue, 19 Oct 2021 14:47:38 +0000 From: Maxim Mikityanskiy To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh CC: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Hideaki YOSHIFUJI , David Ahern , "Jesper Dangaard Brouer" , Nathan Chancellor , "Nick Desaulniers" , Brendan Jackman , Florent Revest , Joe Stringer , Lorenz Bauer , Tariq Toukan , , , , Maxim Mikityanskiy Subject: [PATCH bpf-next 03/10] bpf: Use EOPNOTSUPP in bpf_tcp_check_syncookie Date: Tue, 19 Oct 2021 17:46:48 +0300 Message-ID: <20211019144655.3483197-4-maximmi@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211019144655.3483197-1-maximmi@nvidia.com> References: <20211019144655.3483197-1-maximmi@nvidia.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: d2669bd0-f6bb-4ea1-68a5-08d9930f6d7c X-MS-TrafficTypeDiagnostic: BN6PR12MB1635: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:5236; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: cK/aQwOSJstpsONa+KlBS213rvP81Z4QY4aPZm/7sooTdzeenBYcngtCVKm5ayMIu3KIO+tg2qBNaURbAFkhHJw7d3GAeEMOpzklFbGdUDTGgZBX4KCCOQi9KVY+a3B4PDQUy380/JNiwagDfrcU5+JPGrKlDtHJyAipTtkPXE09IC9x045qNkbhAPXCuPvJS0T2Kf8JY1qNcNKHqWh5OD9Zxi/dkrXBXFBs4X+/zEOfVgXMCnfXdIWsTbLNwsoocYb6KZJR2tJwI2TZSD3qHmuhLHk5wl0Gs9iwAdctLUD+U9IjvS3pkMGfsZmhclPpT8KSAO2+fAQNpnxsOQ6wYo9ynMZd5O9DIIcUy2sAKCHu5qnsJE3sBlLVYYAuD/nG73qnGv1LInv5qB+D8jYdqG1L6zuhpI5ssRMKkwh73a0f155oLxRVPrx/Wj6QaFjpRXQiKFBPGipzAKrE1yUbaID0qu3sJMDm9nMcpTY+Q1efsjMuk1OM4ZucuRFmnwuc+WF0fRZrwmy+sC/h02X5dKEpvL5nu1ZZiEP++QqCK0U6pbh7VQq0gvQmaY3wUN3Hvlx7qqpoFZtso15B1tSuXE/wqgRhBFkpJnbR/FPSY/5pwnKkTCXOcZX50/QnyAbklh24azR3k+pf6rJqDzOqRASAEEIQmhH8P8lL5gLbHKhn2L20yCiK6NB6ijTHUOosyHDWRYdeqPijdRq9Jfpjsg== X-Forefront-Antispam-Report: CIP:216.228.112.32;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:schybrid01.nvidia.com;CAT:NONE;SFS:(4636009)(46966006)(36840700001)(36860700001)(36756003)(7636003)(8676002)(356005)(1076003)(83380400001)(70586007)(86362001)(47076005)(4744005)(4326008)(186003)(70206006)(82310400003)(2906002)(316002)(336012)(5660300002)(2616005)(508600001)(8936002)(110136005)(54906003)(107886003)(426003)(7416002)(6666004)(7696005)(26005);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 14:47:51.8798 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d2669bd0-f6bb-4ea1-68a5-08d9930f6d7c X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.32];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT023.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR12MB1635 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net When CONFIG_SYN_COOKIES is off, bpf_tcp_check_syncookie returns ENOTSUPP. It's a non-standard and deprecated code. The related function bpf_tcp_gen_syncookie and most of the other functions use EOPNOTSUPP if some feature is not available. This patch changes ENOTSUPP to EOPNOTSUPP in bpf_tcp_check_syncookie. Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan --- net/core/filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 6cfb676e1adb..2c5877b775d9 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -6754,7 +6754,7 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len return -ENOENT; #else - return -ENOTSUPP; + return -EOPNOTSUPP; #endif } From patchwork Tue Oct 19 14:46:49 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Mikityanskiy X-Patchwork-Id: 12570155 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 829E2C433FE for ; Tue, 19 Oct 2021 14:48:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 69B736128B for ; Tue, 19 Oct 2021 14:48:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231775AbhJSOuU (ORCPT ); Tue, 19 Oct 2021 10:50:20 -0400 Received: from mail-co1nam11on2040.outbound.protection.outlook.com ([40.107.220.40]:25664 "EHLO NAM11-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S229641AbhJSOuT (ORCPT ); Tue, 19 Oct 2021 10:50:19 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=X4N6/ndJtwnRABwvbQMO9vh66s8G5E95Nmg6eSFEAokrBIdAyW2QvzPLFVzvPTDHsdUpx79jgARyifP5ca8C9vPPUnNE6W0artPPrBJq3L5RZ/h6cb3AFAgqI2Yjr/Dr2xO1MD13bO7JOuaNRHHzwdiBjHaxIMfjfsXsqXqTyimKMczklB/Lg4eGicJNVWgkbMfosiCvDibnz1yoeZBdXjg1CyaClOhA80k+umZVAP9J5J5F68rGnYXlSNKjBj5YY/TErIP7wwGKLvPRbZ7iobgDNXohii+tOoG0WprR3txorwZkQ6M3DqqJqYFGS+/OXimoe+s/Dcr/FpoWtvfahA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=jXLQ7xAs8EOu6G2zUj4E0yFOji2FUos7HtcrIt0viUk=; b=fib6ncjq2r8saJChd3oebAZPjywo4FDxhK/eeUpQ2rz+kNUwRvG649xT0bWSQ9KrmhjRkWScRBD3SWdERjHXBEuiENL+0CnGkW8lsiCNakHCPmvZ0w9W0qfbaekc/Vfuqf8dT2HmDckUFPdJ5TAyVYQiSY3mNaH6pahyZnTZ2Y7MV9Np/2kp/h9O6YsUfjQwMgCXEtj6k4LKbMXoPQddKSi9dAwuyjQZY5mokNBNznntDBQb3KE2umjWJ3iADNR2XmoO9cEDHiDrZQzvSBTMzBJLlZ8L+nb1nMW+HLWHiofXLUnlPUT7FpSlwf6pp6NcHD5DplKC5YQcbZSA/k6nHg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.32) smtp.rcpttodomain=google.com smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jXLQ7xAs8EOu6G2zUj4E0yFOji2FUos7HtcrIt0viUk=; b=OmhToDrlEuDsBmTgWf6cn9jqKUN4NXM0LDTmuwoKN7ceZn+fnpS/X0IZu7eh54fWk5In8ef45+mUIPCBSjaF2YcsxlgjQRlzPs6leTdEmZDoZx5xIyL47u3SZlRE0D35k9LzcW9W7d0Vl8YV9pCHdyAFd/6PaSn+4EspeaTqyvA0/IIXdeo8q0K5A2/76PuG9Dt3WY/l+3o/zhCOkBtXh9lurvJDk52BvhDrWmRhH0THyGdqiL+cwAMqNhxD6tVH8eWy/mIsVf4VrWVR65BDG+VCaowILPHm8ZrEbmYF3YEJZjNpOoeYlzvTUkjFg+OkFdxioMS+A1DiS8Cpvp/Zgg== Received: from DM6PR03CA0013.namprd03.prod.outlook.com (2603:10b6:5:40::26) by CY4PR1201MB0199.namprd12.prod.outlook.com (2603:10b6:910:1c::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.18; Tue, 19 Oct 2021 14:48:03 +0000 Received: from DM6NAM11FT028.eop-nam11.prod.protection.outlook.com (2603:10b6:5:40:cafe::4) by DM6PR03CA0013.outlook.office365.com (2603:10b6:5:40::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.16 via Frontend Transport; Tue, 19 Oct 2021 14:48:03 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.32) smtp.mailfrom=nvidia.com; google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.32 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.32; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.32) by DM6NAM11FT028.mail.protection.outlook.com (10.13.173.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:48:03 +0000 Received: from HQMAIL107.nvidia.com (172.20.187.13) by HQMAIL109.nvidia.com (172.20.187.15) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 07:48:02 -0700 Received: from vdi.nvidia.com (172.20.187.6) by mail.nvidia.com (172.20.187.13) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Tue, 19 Oct 2021 14:47:51 +0000 From: Maxim Mikityanskiy To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh CC: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Hideaki YOSHIFUJI , David Ahern , "Jesper Dangaard Brouer" , Nathan Chancellor , "Nick Desaulniers" , Brendan Jackman , Florent Revest , Joe Stringer , "Lorenz Bauer" , Tariq Toukan , , , , Maxim Mikityanskiy Subject: [PATCH bpf-next 04/10] bpf: Make errors of bpf_tcp_check_syncookie distinguishable Date: Tue, 19 Oct 2021 17:46:49 +0300 Message-ID: <20211019144655.3483197-5-maximmi@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211019144655.3483197-1-maximmi@nvidia.com> References: <20211019144655.3483197-1-maximmi@nvidia.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: dbffa9f1-e9d6-4067-fb84-08d9930f7452 X-MS-TrafficTypeDiagnostic: CY4PR1201MB0199: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:2512; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: HUDYheS+pV6nwD7bM5lIZQ+sE+Qpea1QxXSfKXbFkeW+cZFjpaL5owE+buJzw64Ld+iws2ZcAsJi5KQSRvISs0xw78ls2G8ydv2X8vgkDOoCYQE6wXa602ucJPhAryAtA5LouAMI6kwYsEwnNumrbGVcVZ543G0R7ZLJ5YSeNEuiv24yVJgePzVMc7sqWFlC8OhndOHT4GI8jFP9NNZ3LTdpuugjgf91EIUY+eNIYmLS5QyonFih7w5bls/yxZVThIgt10wAU1ZTbKt+r4nTHaB6j5u16sNa1z6+P030FwE9EbbmmL9k9SNJcimSH0B3sfE5HfrjJFjNkD/MdK/dSU1b2Wl4M0OnXBw4iN+WV6oPuef3GJ0TXtDkxZz6h9sAAe9KHiJo5/KcXbAe8s4xil82FMz8sfguJad+y4P4gh2cYfrfAbxSgvYOgp14DrAhVOJ7te94fhwXYPvYWWLkX4xtm94BWxTmRxNPUHmFqCt+ugtDWQHws4iADUaQLeJFSj3/nOf3twT/n6Qdw0yRAxQekkDmQ186+JSLrk/XBoQ05IY5qOhboPXrEfqxlaerkCcU8mG9i/8pdBn09+J+TQQJ0ULUUDJpU2z8nynW5HzPaxQaBMr3YQkn6KeFXWi/jg2iu4m+UA40SIxufhapIl299m7K9h/XC+yD8W0qm5TyUm+4nYURA/vYaSAvdi2xhX0lCMeP4Cm5eV+hjs3E7Q== X-Forefront-Antispam-Report: CIP:216.228.112.32;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:schybrid01.nvidia.com;CAT:NONE;SFS:(4636009)(46966006)(36840700001)(110136005)(2616005)(54906003)(70586007)(107886003)(2906002)(8676002)(47076005)(1076003)(316002)(83380400001)(7696005)(5660300002)(70206006)(7416002)(36860700001)(82310400003)(426003)(26005)(36756003)(186003)(356005)(7636003)(336012)(508600001)(8936002)(86362001)(4326008);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 14:48:03.3404 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: dbffa9f1-e9d6-4067-fb84-08d9930f7452 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.32];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT028.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR1201MB0199 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net bpf_tcp_check_syncookie returns errors when SYN cookie generation is disabled (EINVAL) or when no cookies were recently generated (ENOENT). The same error codes are used for other kinds of errors: invalid parameters (EINVAL), invalid packet (EINVAL, ENOENT), bad cookie (ENOENT). Such an overlap makes it impossible for a BPF program to distinguish different cases that may require different handling. For a BPF program that accelerates generating and checking SYN cookies, typical logic looks like this (with current error codes annotated): 1. Drop invalid packets (EINVAL, ENOENT). 2. Drop packets with bad cookies (ENOENT). 3. Pass packets with good cookies (0). 4. Pass all packets when cookies are not in use (EINVAL, ENOENT). The last point also matches the behavior of cookie_v4_check and cookie_v6_check that skip all checks if cookie generation is disabled or no cookies were recently generated. Overlapping error codes, however, make it impossible to distinguish case 4 from cases 1 and 2. The original commit message of commit 399040847084 ("bpf: add helper to check for a valid SYN cookie") mentions another use case, though: traffic classification, where it's important to distinguish new connections from existing ones, and case 4 should be distinguishable from case 3. To match the requirements of both use cases, this patch reassigns error codes of bpf_tcp_check_syncookie and adds missing documentation: 1. EINVAL: Invalid packets. 2. EACCES: Packets with bad cookies. 3. 0: Packets with good cookies. 4. ENOENT: Cookies are not in use. This way all four cases are easily distinguishable. Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan --- include/uapi/linux/bpf.h | 18 ++++++++++++++++-- net/core/filter.c | 6 +++--- tools/include/uapi/linux/bpf.h | 18 ++++++++++++++++-- 3 files changed, 35 insertions(+), 7 deletions(-) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 6fc59d61937a..2f12b11f1259 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -3545,8 +3545,22 @@ union bpf_attr { * *th* points to the start of the TCP header, while *th_len* * contains **sizeof**\ (**struct tcphdr**). * Return - * 0 if *iph* and *th* are a valid SYN cookie ACK, or a negative - * error otherwise. + * 0 if *iph* and *th* are a valid SYN cookie ACK. + * + * On failure, the returned value is one of the following: + * + * **-EACCES** if the SYN cookie is not valid. + * + * **-EINVAL** if the packet or input arguments are invalid. + * + * **-ENOENT** if SYN cookies are not issued (no SYN flood, or SYN + * cookies are disabled in sysctl). + * + * **-EOPNOTSUPP** if the kernel configuration does not enable SYN + * cookies (CONFIG_SYN_COOKIES is off). + * + * **-EPROTONOSUPPORT** if the IP version is not 4 or 6 (or 6, but + * CONFIG_IPV6 is disabled). * * long bpf_sysctl_get_name(struct bpf_sysctl *ctx, char *buf, size_t buf_len, u64 flags) * Description diff --git a/net/core/filter.c b/net/core/filter.c index 2c5877b775d9..d04988e67640 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -6709,10 +6709,10 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len return -EINVAL; if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies) - return -EINVAL; + return -ENOENT; if (!th->ack || th->rst || th->syn) - return -ENOENT; + return -EINVAL; if (unlikely(iph_len < sizeof(struct iphdr))) return -EINVAL; @@ -6752,7 +6752,7 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len if (ret > 0) return 0; - return -ENOENT; + return -EACCES; #else return -EOPNOTSUPP; #endif diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 6fc59d61937a..2f12b11f1259 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -3545,8 +3545,22 @@ union bpf_attr { * *th* points to the start of the TCP header, while *th_len* * contains **sizeof**\ (**struct tcphdr**). * Return - * 0 if *iph* and *th* are a valid SYN cookie ACK, or a negative - * error otherwise. + * 0 if *iph* and *th* are a valid SYN cookie ACK. + * + * On failure, the returned value is one of the following: + * + * **-EACCES** if the SYN cookie is not valid. + * + * **-EINVAL** if the packet or input arguments are invalid. + * + * **-ENOENT** if SYN cookies are not issued (no SYN flood, or SYN + * cookies are disabled in sysctl). + * + * **-EOPNOTSUPP** if the kernel configuration does not enable SYN + * cookies (CONFIG_SYN_COOKIES is off). + * + * **-EPROTONOSUPPORT** if the IP version is not 4 or 6 (or 6, but + * CONFIG_IPV6 is disabled). * * long bpf_sysctl_get_name(struct bpf_sysctl *ctx, char *buf, size_t buf_len, u64 flags) * Description From patchwork Tue Oct 19 14:46:50 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Mikityanskiy X-Patchwork-Id: 12570157 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EA51C433F5 for ; Tue, 19 Oct 2021 14:48:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 28F146113B for ; Tue, 19 Oct 2021 14:48:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232290AbhJSOub (ORCPT ); Tue, 19 Oct 2021 10:50:31 -0400 Received: from mail-mw2nam12on2057.outbound.protection.outlook.com ([40.107.244.57]:53729 "EHLO NAM12-MW2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S229641AbhJSOub (ORCPT ); Tue, 19 Oct 2021 10:50:31 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=YuaITKXVjeV2xeMUkmILYlBI0mX+fNub31B9JBT3Ms5+x1lrgOkZxrCKyQSpuvO+Y7++DhBo3x8ByJDYEAyk1fqIWecUfIYUpQRQ9Vwe2xrrJwXDlDiMH6iRA47mVQNWWuH4bVTqYL1QxOm2l/mgbQv8c9CjKpeCxGRWjWPTm/P+PFsBF4TCW5zcLejr86BlLhsl9FA8nOwYBL+fJwfsMOlYkQEMw0VmtDA9DeYQkMdoNqrgt/vH0PTU5kM1IyRb8V/l6VYLlqbuP0Uk/gsYDdbgsRdUJ4uOLmU+XtKXjWDzdV2AmmgEepdYLGjbhvcVc73qF84hmxRMQQqp12SVeg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Jb1uETqWVAaoOM305t81Q0H2Deol3CCp7nQLsSHbUSs=; b=cUV0fWxbR1yJgKF7ATeDn3LWL70Yw1Kvlt75aXJj4Xg/NmfrgpYw5Vx5kj7h7TQxTCnvoKYlQHinMJtSph7wJ5i6HiEq33zotDHGQM/VEXNbnn5kobBV7raE6noLkiAlge+BvvB+nAH4D8J5HqjWOYJs39qxRsB0+D0FFFd0oaoA877P69doPwo2wDR3moL+i8ELAponwAihIcDOSx7RNBCBrBtvFDL0p0zbme2PGSS9mMhCBzjEdwIC2fY5svrXB3JyokgJ3vcJSF1ZcO2xMemPqDZT6RZ6lsbxW5FHhvFwvvbsNUD8dRomcNspaB6EDtl5XTe5xDUl9Fy3yti7XA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.34) smtp.rcpttodomain=google.com smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Jb1uETqWVAaoOM305t81Q0H2Deol3CCp7nQLsSHbUSs=; b=noWFWeo9pLoWmrfVQOwhYqjqqjBknTiqkbtOZQMqy8+JWpk7tTM+ySx+K0c7Hm2up8HNc/3XxZujMCjlm6aV19Idm2aY+4+cmxsTumhea6GSbkzTlgiwzxQDK+sibOJSzd52h1ITqEiWDgLcrkH6UqtOShhUbePiFsLNGkVPRM7FSTflhDkaGX/Bu+grKVw08wK9puWID/X9it6vNGygk2ifrYl2UntMbSPEiH/KiioB9sm3MkeN+1PKJUnXl36sEofdF0WXrDDeSfRQYUSNtWJD0rbxyWeksNlzyWTPp1bEXAXQNVcfDB2ij3FnWP08p32PdVLPSvWkVnkECUNBoQ== Received: from DM3PR08CA0021.namprd08.prod.outlook.com (2603:10b6:0:52::31) by BY5PR12MB3684.namprd12.prod.outlook.com (2603:10b6:a03:1a2::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.18; Tue, 19 Oct 2021 14:48:16 +0000 Received: from DM6NAM11FT067.eop-nam11.prod.protection.outlook.com (2603:10b6:0:52:cafe::fe) by DM3PR08CA0021.outlook.office365.com (2603:10b6:0:52::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4628.15 via Frontend Transport; Tue, 19 Oct 2021 14:48:16 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.34) smtp.mailfrom=nvidia.com; google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.34 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.34; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.34) by DM6NAM11FT067.mail.protection.outlook.com (10.13.172.76) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:48:15 +0000 Received: from HQMAIL107.nvidia.com (172.20.187.13) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 14:48:14 +0000 Received: from vdi.nvidia.com (172.20.187.6) by mail.nvidia.com (172.20.187.13) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Tue, 19 Oct 2021 14:48:03 +0000 From: Maxim Mikityanskiy To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh CC: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Hideaki YOSHIFUJI , David Ahern , "Jesper Dangaard Brouer" , Nathan Chancellor , "Nick Desaulniers" , Brendan Jackman , Florent Revest , Joe Stringer , Lorenz Bauer , Tariq Toukan , , , , Maxim Mikityanskiy Subject: [PATCH bpf-next 05/10] bpf: Fix documentation of th_len in bpf_tcp_{gen,check}_syncookie Date: Tue, 19 Oct 2021 17:46:50 +0300 Message-ID: <20211019144655.3483197-6-maximmi@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211019144655.3483197-1-maximmi@nvidia.com> References: <20211019144655.3483197-1-maximmi@nvidia.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ea5932fd-8d1c-4ff7-2166-08d9930f7bb1 X-MS-TrafficTypeDiagnostic: BY5PR12MB3684: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7219; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: C6RKjhAPiBOoyuhWSy0Kg2ciyNFQdhKI0nlgpZbbsRhdrz94GzU5SXt9UvyEStw/+eQYsI+znpIg3vjfuZCtKgIu9oeDh/aEUXo1KlHx9g1v2GpJcIfW1xfcM4inUsYOi546LPU3TuVybGZo4YQzt2mcfDy8M3/wZsgTykhjD2sBA11EhpO05oR/GTobdnecCEUCMtIhk0ITlsffjHkpPLZp/4JnRGq4nqP61HfewNCaRi7qzdOx04O2QmsTb5W+anW1zCcMYKCmUaJIaMetcQa2KkNBrz8D7YOmCjJyEn0cpK4whMR4kaOfjVve66S8uroXGdtU8owLIHKvOqAzuddAfZiyWlzt8re22OyTHliUelGlmQ/ug2ejSPUYrfSZpTKZGz6AhbGcAU+QKIvbp4DP04/z3lO/t/iWJh0XAknIpF7W2L+4XBoceN2QXifZrH8/VdPNLCDiUY7w531MmmaoaNlVnqF/eTiKsJflJ//idWMz0OHy+8UP0coM1UvlPuWQGknyK00awGzg/gfHD3p91BQipUeGLpZjbd5t0UQKfJXrXl08Fyfq9IZiwLLB8vM7wPM6CEFN4TREDM+y+h5fJE/e+fFM6PvQxSXrmcb9INHUvAw++yS297cvxswb2iZ10/NO9IyLYd0QDTEmqOKV3AtS2KEDVVDgxA2c7HyhvN7fyjag2ATfIrk7rWmbeKCFWxejAN6CoZvCyiD53Q== X-Forefront-Antispam-Report: CIP:216.228.112.34;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:schybrid03.nvidia.com;CAT:NONE;SFS:(4636009)(36840700001)(46966006)(8936002)(107886003)(36860700001)(316002)(6666004)(7636003)(356005)(7416002)(83380400001)(82310400003)(2906002)(336012)(47076005)(2616005)(86362001)(70206006)(70586007)(36756003)(7696005)(110136005)(54906003)(426003)(8676002)(5660300002)(508600001)(186003)(1076003)(4326008)(26005);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 14:48:15.7135 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ea5932fd-8d1c-4ff7-2166-08d9930f7bb1 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.34];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT067.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR12MB3684 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie expect the full length of the TCP header (with all extensions). Fix the documentation that says it should be sizeof(struct tcphdr). Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan --- include/uapi/linux/bpf.h | 6 ++++-- tools/include/uapi/linux/bpf.h | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 2f12b11f1259..efb2750f39c6 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -3543,7 +3543,8 @@ union bpf_attr { * **sizeof**\ (**struct ip6hdr**). * * *th* points to the start of the TCP header, while *th_len* - * contains **sizeof**\ (**struct tcphdr**). + * contains the length of the TCP header (at least + * **sizeof**\ (**struct tcphdr**)). * Return * 0 if *iph* and *th* are a valid SYN cookie ACK. * @@ -3743,7 +3744,8 @@ union bpf_attr { * **sizeof**\ (**struct ip6hdr**). * * *th* points to the start of the TCP header, while *th_len* - * contains the length of the TCP header. + * contains the length of the TCP header (at least + * **sizeof**\ (**struct tcphdr**)). * Return * On success, lower 32 bits hold the generated SYN cookie in * followed by 16 bits which hold the MSS value for that cookie, diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 2f12b11f1259..efb2750f39c6 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -3543,7 +3543,8 @@ union bpf_attr { * **sizeof**\ (**struct ip6hdr**). * * *th* points to the start of the TCP header, while *th_len* - * contains **sizeof**\ (**struct tcphdr**). + * contains the length of the TCP header (at least + * **sizeof**\ (**struct tcphdr**)). * Return * 0 if *iph* and *th* are a valid SYN cookie ACK. * @@ -3743,7 +3744,8 @@ union bpf_attr { * **sizeof**\ (**struct ip6hdr**). * * *th* points to the start of the TCP header, while *th_len* - * contains the length of the TCP header. + * contains the length of the TCP header (at least + * **sizeof**\ (**struct tcphdr**)). * Return * On success, lower 32 bits hold the generated SYN cookie in * followed by 16 bits which hold the MSS value for that cookie, From patchwork Tue Oct 19 14:46:51 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Mikityanskiy X-Patchwork-Id: 12570159 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51B8AC433F5 for ; Tue, 19 Oct 2021 14:48:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2AF0F6113B for ; Tue, 19 Oct 2021 14:48:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229764AbhJSOup (ORCPT ); Tue, 19 Oct 2021 10:50:45 -0400 Received: from mail-dm6nam12on2044.outbound.protection.outlook.com ([40.107.243.44]:50945 "EHLO NAM12-DM6-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S229641AbhJSOun (ORCPT ); Tue, 19 Oct 2021 10:50:43 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cnr9RZR4kJhuJoN6t651URio3R+eKVQYPVesBDhJb7IHzGen/Wxw7J9HtqHfNgUCDCMuPlXo6hyd/rIns3OpQRa6+HJTDAilZonWC2+dyBMXGEva9jnuz7rI6yn7Go7RzoHcf9nQJvONVfSRzztFSUer/9Pw4ZiUlq/L3mKE39TAkAVyyWW0a2eP3yOORjup0DtJonq8ePfH0whq7QdEPPevXbv+nb+C1adTHw3HkK70zsDOroRQWosv97DkDL3HYYdQUfevvzyHvFnE3gqSwrAFxRx3iI929a0IsoOD+jqBtlAezcGEvHLf0C+83C8KznCc8EKCNo5wGkAAXpfDOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=/Q7C3HQJGZiVgoIHw6X7iM/39ZDT/tFo1L7k2OMaNa0=; b=Jo4C1QKJXe3brPvJtWEqE35ImGdBSqyLAQQr3Dn+A0XaA6sS+4LKX0OUg48PfON5IlC7M7Z6iUA0CIq8ztCuXgDH8NnE6R1ZNpfjn2El9girMSuV0TRVL+3Guf2udPWGSqqClC54Uy9b7JN93kmArHrpZTSQZPNmz1tIY+9ivZKkBhTNwgjQPSgGF+r+uqjtiDqN7GZtUTjpWEDHSv9SRogeuT1RpgilRS1e0acf0DV6cbvD6TETsycWbEHggCygxQFe3Gq/qKASnK1dfC2zlTmuKTcIkmtMJnjrgjSLhxDv9vqIaktAAk16q52hJ6kzNu6BPaNSD32pNypOwgZK3Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.34) smtp.rcpttodomain=iogearbox.net smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/Q7C3HQJGZiVgoIHw6X7iM/39ZDT/tFo1L7k2OMaNa0=; b=tmE5bN3tCJAlnmlSUKXo3SfGNQnWhJNVddoRmLrvgLMJEy1GqkN7s2MVnJyvunasvYPxlo/0TRpBM4IuUCRuac7VWZdS+HrAw+IZxS3A2mA+O7OHB5tU23WWzzEIH9x0ee5GeYUaE5O1XsqpGMuMvxXUmrZvZzyuAMqVtbGBBOvOUG4z5Cn5QrqN70STlIcd0c6TGyfRKh+3Mb67LxFWoDQXDAeHmA39btP6v4grVwI7WGaFfn4JISk1cWVDxS1ZJQqkk3jF1h4vIDftrcbAFImiEJ1DecX9HuziNAarOuOgU6Xp1KFmAO5GA8X/2FqdA8zqdZiQOs8A7UP/IxRdtQ== Received: from DM6PR12CA0010.namprd12.prod.outlook.com (2603:10b6:5:1c0::23) by BYAPR12MB3144.namprd12.prod.outlook.com (2603:10b6:a03:d6::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.18; Tue, 19 Oct 2021 14:48:28 +0000 Received: from DM6NAM11FT052.eop-nam11.prod.protection.outlook.com (2603:10b6:5:1c0:cafe::7a) by DM6PR12CA0010.outlook.office365.com (2603:10b6:5:1c0::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:48:28 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.34) smtp.mailfrom=nvidia.com; iogearbox.net; dkim=none (message not signed) header.d=none;iogearbox.net; dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.34 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.34; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.34) by DM6NAM11FT052.mail.protection.outlook.com (10.13.172.111) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:48:28 +0000 Received: from HQMAIL105.nvidia.com (172.20.187.12) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 14:48:27 +0000 Received: from HQMAIL107.nvidia.com (172.20.187.13) by HQMAIL105.nvidia.com (172.20.187.12) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 14:48:27 +0000 Received: from vdi.nvidia.com (172.20.187.6) by mail.nvidia.com (172.20.187.13) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Tue, 19 Oct 2021 14:48:15 +0000 From: Maxim Mikityanskiy To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh CC: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Hideaki YOSHIFUJI , David Ahern , "Jesper Dangaard Brouer" , Nathan Chancellor , "Nick Desaulniers" , Brendan Jackman , Florent Revest , Joe Stringer , Lorenz Bauer , Tariq Toukan , , , , Maxim Mikityanskiy Subject: [PATCH bpf-next 06/10] bpf: Expose struct nf_conn to BPF Date: Tue, 19 Oct 2021 17:46:51 +0300 Message-ID: <20211019144655.3483197-7-maximmi@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211019144655.3483197-1-maximmi@nvidia.com> References: <20211019144655.3483197-1-maximmi@nvidia.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: e02ee8ae-e9b9-45b4-12b7-08d9930f832c X-MS-TrafficTypeDiagnostic: BYAPR12MB3144: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:480; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: l39e7abl2KTVCFZjlVuzq972ZihpuaZHAQYT4bZ9qNpbcrSysJE9G/A9+DZk0bi8LVkKjPPCB2IbZvSHsRXlN4yfd08HnRu70b7ZiC7b55vGfaJoKp87G9PuHEUgX22xj7w/zKLtN//tOY3kwUajxKb+1lzlKptkVmcmLvQoEiU0U+kgIwPq0KcyAyZjLyjX7dXCLcQ8jzmVowUvmNoFppe9LnYt8lqASgPF3AY/KTAV63w0i/J3EoA12EikB0y4QZPim72LE2eaxbLmCbBEYSu/zeo2bObMK9zebOuyGhqE3Ds7eXLyBLTrmVhMrR8eRCTkNs+HbemrCO38IBI3vI0rSbuDLJmKNN0YNNRZ2ym4Q8PoS8NiyDuWiQUnRRtJY0ZdyipC2/bIA6VRP7zTNHXrB5eBM7EhQ1G5osppodcGMVVh/8P2EX2EpSdg8mdbUCTZ4Q1s+J3y7ZjK/JMY9GijgMxMMR8PpvUKiXNB9FmBYuyz2QkDZ/DZdJowvJ0sGT0RO+3TVzherNnLsCWCJOLhxpJIf39Gj66Kvian76DEYEIOjKxGx+VWNizL1tQ7JW51NVftnaFCcH8Iff4W4qZSEH4YcFI5QqdXFrIHwmkGcqvldG7Ysd3TlWV+CCJeNkLYpnlHVU9q3PWreTPMXDG2291z0pHF04gTMYn1EVJIxIVkM/NlpSmZP3z2Xx99xzF/ZhuYHBreZ8EQj8Be0g== X-Forefront-Antispam-Report: CIP:216.228.112.34;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:schybrid03.nvidia.com;CAT:NONE;SFS:(4636009)(46966006)(36840700001)(2616005)(2906002)(336012)(426003)(86362001)(36756003)(107886003)(356005)(7636003)(7696005)(70206006)(70586007)(6666004)(7416002)(8676002)(8936002)(186003)(508600001)(36906005)(4326008)(316002)(36860700001)(54906003)(110136005)(5660300002)(30864003)(83380400001)(47076005)(1076003)(82310400003)(26005);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 14:48:28.3004 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e02ee8ae-e9b9-45b4-12b7-08d9930f832c X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.34];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT052.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR12MB3144 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net This commit adds struct nf_conn as a new type to BPF. For now, only the status field is mapped. It will allow to add helpers that will expose conntrack information to BPF programs. Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan --- include/linux/bpf.h | 46 ++++++++++++++++ include/uapi/linux/bpf.h | 4 ++ kernel/bpf/verifier.c | 95 ++++++++++++++++++++++++++++++++-- net/core/filter.c | 41 +++++++++++++++ scripts/bpf_doc.py | 1 + tools/include/uapi/linux/bpf.h | 4 ++ 6 files changed, 186 insertions(+), 5 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index d604c8251d88..21ca6e1f0f7a 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -341,6 +341,7 @@ enum bpf_arg_type { ARG_PTR_TO_STACK_OR_NULL, /* pointer to stack or NULL */ ARG_PTR_TO_CONST_STR, /* pointer to a null terminated read-only string */ ARG_PTR_TO_TIMER, /* pointer to bpf_timer */ + ARG_PTR_TO_NF_CONN, /* pointer to nf_conn */ __BPF_ARG_TYPE_MAX, }; @@ -358,6 +359,7 @@ enum bpf_return_type { RET_PTR_TO_MEM_OR_BTF_ID_OR_NULL, /* returns a pointer to a valid memory or a btf_id or NULL */ RET_PTR_TO_MEM_OR_BTF_ID, /* returns a pointer to a valid memory or a btf_id */ RET_PTR_TO_BTF_ID, /* returns a pointer to a btf_id */ + RET_PTR_TO_NF_CONN_OR_NULL, /* returns a pointer to a nf_conn or NULL */ }; /* eBPF function prototype used by verifier to allow BPF_CALLs from eBPF programs @@ -459,6 +461,8 @@ enum bpf_reg_type { PTR_TO_PERCPU_BTF_ID, /* reg points to a percpu kernel variable */ PTR_TO_FUNC, /* reg points to a bpf program function */ PTR_TO_MAP_KEY, /* reg points to a map element key */ + PTR_TO_NF_CONN, /* reg points to struct nf_conn */ + PTR_TO_NF_CONN_OR_NULL, /* reg points to struct nf_conn or NULL */ __BPF_REG_TYPE_MAX, }; @@ -2127,6 +2131,32 @@ u32 bpf_sock_convert_ctx_access(enum bpf_access_type type, struct bpf_insn *insn_buf, struct bpf_prog *prog, u32 *target_size); + +#if IS_BUILTIN(CONFIG_NF_CONNTRACK) +bool bpf_ct_is_valid_access(int off, int size, enum bpf_access_type type, + struct bpf_insn_access_aux *info); +u32 bpf_ct_convert_ctx_access(enum bpf_access_type type, + const struct bpf_insn *si, + struct bpf_insn *insn_buf, + struct bpf_prog *prog, u32 *target_size); +#else +static inline bool bpf_ct_is_valid_access(int off, int size, + enum bpf_access_type type, + struct bpf_insn_access_aux *info) +{ + return false; +} + +static inline u32 bpf_ct_convert_ctx_access(enum bpf_access_type type, + const struct bpf_insn *si, + struct bpf_insn *insn_buf, + struct bpf_prog *prog, + u32 *target_size) +{ + return 0; +} +#endif + #else static inline bool bpf_sock_common_is_valid_access(int off, int size, enum bpf_access_type type, @@ -2148,6 +2178,22 @@ static inline u32 bpf_sock_convert_ctx_access(enum bpf_access_type type, { return 0; } + +static inline bool bpf_ct_is_valid_access(int off, int size, + enum bpf_access_type type, + struct bpf_insn_access_aux *info) +{ + return false; +} + +static inline u32 bpf_ct_convert_ctx_access(enum bpf_access_type type, + const struct bpf_insn *si, + struct bpf_insn *insn_buf, + struct bpf_prog *prog, + u32 *target_size) +{ + return 0; +} #endif #ifdef CONFIG_INET diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index efb2750f39c6..a10a44c4f79b 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -5472,6 +5472,10 @@ struct bpf_xdp_sock { __u32 queue_id; }; +struct bpf_nf_conn { + __u64 status; +}; + #define XDP_PACKET_HEADROOM 256 /* User return codes for XDP prog type. diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 20900a1bac12..6eafef35e247 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -436,13 +436,19 @@ static bool type_is_sk_pointer(enum bpf_reg_type type) type == PTR_TO_XDP_SOCK; } +static bool type_is_ct_pointer(enum bpf_reg_type type) +{ + return type == PTR_TO_NF_CONN; +} + static bool reg_type_not_null(enum bpf_reg_type type) { return type == PTR_TO_SOCKET || type == PTR_TO_TCP_SOCK || type == PTR_TO_MAP_VALUE || type == PTR_TO_MAP_KEY || - type == PTR_TO_SOCK_COMMON; + type == PTR_TO_SOCK_COMMON || + type == PTR_TO_NF_CONN; } static bool reg_type_may_be_null(enum bpf_reg_type type) @@ -454,7 +460,8 @@ static bool reg_type_may_be_null(enum bpf_reg_type type) type == PTR_TO_BTF_ID_OR_NULL || type == PTR_TO_MEM_OR_NULL || type == PTR_TO_RDONLY_BUF_OR_NULL || - type == PTR_TO_RDWR_BUF_OR_NULL; + type == PTR_TO_RDWR_BUF_OR_NULL || + type == PTR_TO_NF_CONN_OR_NULL; } static bool reg_may_point_to_spin_lock(const struct bpf_reg_state *reg) @@ -470,12 +477,15 @@ static bool reg_type_may_be_refcounted_or_null(enum bpf_reg_type type) type == PTR_TO_TCP_SOCK || type == PTR_TO_TCP_SOCK_OR_NULL || type == PTR_TO_MEM || - type == PTR_TO_MEM_OR_NULL; + type == PTR_TO_MEM_OR_NULL || + type == PTR_TO_NF_CONN || + type == PTR_TO_NF_CONN_OR_NULL; } static bool arg_type_may_be_refcounted(enum bpf_arg_type type) { - return type == ARG_PTR_TO_SOCK_COMMON; + return type == ARG_PTR_TO_SOCK_COMMON || + type == ARG_PTR_TO_NF_CONN; } static bool arg_type_may_be_null(enum bpf_arg_type type) @@ -577,6 +587,8 @@ static const char * const reg_type_str[] = { [PTR_TO_RDWR_BUF_OR_NULL] = "rdwr_buf_or_null", [PTR_TO_FUNC] = "func", [PTR_TO_MAP_KEY] = "map_key", + [PTR_TO_NF_CONN] = "nf_conn", + [PTR_TO_NF_CONN_OR_NULL] = "nf_conn_or_null", }; static char slot_type_char[] = { @@ -1189,6 +1201,9 @@ static void mark_ptr_not_null_reg(struct bpf_reg_state *reg) case PTR_TO_RDWR_BUF_OR_NULL: reg->type = PTR_TO_RDWR_BUF; break; + case PTR_TO_NF_CONN_OR_NULL: + reg->type = PTR_TO_NF_CONN; + break; default: WARN_ONCE(1, "unknown nullable register type"); } @@ -2748,6 +2763,8 @@ static bool is_spillable_regtype(enum bpf_reg_type type) case PTR_TO_MEM_OR_NULL: case PTR_TO_FUNC: case PTR_TO_MAP_KEY: + case PTR_TO_NF_CONN: + case PTR_TO_NF_CONN_OR_NULL: return true; default: return false; @@ -3665,6 +3682,40 @@ static int check_sock_access(struct bpf_verifier_env *env, int insn_idx, return -EACCES; } +static int check_ct_access(struct bpf_verifier_env *env, int insn_idx, + u32 regno, int off, int size, enum bpf_access_type t) +{ + struct bpf_reg_state *regs = cur_regs(env); + struct bpf_reg_state *reg = ®s[regno]; + struct bpf_insn_access_aux info = {}; + bool valid; + + if (reg->smin_value < 0) { + verbose(env, "R%d min value is negative, either use unsigned index or do a if (index >=0) check.\n", + regno); + return -EACCES; + } + + switch (reg->type) { + case PTR_TO_NF_CONN: + valid = bpf_ct_is_valid_access(off, size, t, &info); + break; + default: + valid = false; + } + + if (valid) { + env->insn_aux_data[insn_idx].ctx_field_size = + info.ctx_field_size; + return 0; + } + + verbose(env, "R%d invalid %s access off=%d size=%d\n", + regno, reg_type_str[reg->type], off, size); + + return -EACCES; +} + static bool is_pointer_value(struct bpf_verifier_env *env, int regno) { return __is_pointer_value(env->allow_ptr_leaks, reg_state(env, regno)); @@ -3684,6 +3735,13 @@ static bool is_sk_reg(struct bpf_verifier_env *env, int regno) return type_is_sk_pointer(reg->type); } +static bool is_ct_reg(struct bpf_verifier_env *env, int regno) +{ + const struct bpf_reg_state *reg = reg_state(env, regno); + + return type_is_ct_pointer(reg->type); +} + static bool is_pkt_reg(struct bpf_verifier_env *env, int regno) { const struct bpf_reg_state *reg = reg_state(env, regno); @@ -3804,6 +3862,9 @@ static int check_ptr_alignment(struct bpf_verifier_env *env, case PTR_TO_XDP_SOCK: pointer_desc = "xdp_sock "; break; + case PTR_TO_NF_CONN: + pointer_desc = "nf_conn "; + break; default: break; } @@ -4478,6 +4539,15 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn err = check_sock_access(env, insn_idx, regno, off, size, t); if (!err && value_regno >= 0) mark_reg_unknown(env, regs, value_regno); + } else if (type_is_ct_pointer(reg->type)) { + if (t == BPF_WRITE) { + verbose(env, "R%d cannot write into %s\n", + regno, reg_type_str[reg->type]); + return -EACCES; + } + err = check_ct_access(env, insn_idx, regno, off, size, t); + if (!err && value_regno >= 0) + mark_reg_unknown(env, regs, value_regno); } else if (reg->type == PTR_TO_TP_BUFFER) { err = check_tp_buffer_access(env, reg, regno, off, size); if (!err && t == BPF_READ && value_regno >= 0) @@ -4571,7 +4641,8 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i if (is_ctx_reg(env, insn->dst_reg) || is_pkt_reg(env, insn->dst_reg) || is_flow_key_reg(env, insn->dst_reg) || - is_sk_reg(env, insn->dst_reg)) { + is_sk_reg(env, insn->dst_reg) || + is_ct_reg(env, insn->dst_reg)) { verbose(env, "BPF_ATOMIC stores into R%d %s is not allowed\n", insn->dst_reg, reg_type_str[reg_state(env, insn->dst_reg)->type]); @@ -5086,6 +5157,7 @@ static const struct bpf_reg_types func_ptr_types = { .types = { PTR_TO_FUNC } }; static const struct bpf_reg_types stack_ptr_types = { .types = { PTR_TO_STACK } }; static const struct bpf_reg_types const_str_ptr_types = { .types = { PTR_TO_MAP_VALUE } }; static const struct bpf_reg_types timer_types = { .types = { PTR_TO_MAP_VALUE } }; +static const struct bpf_reg_types nf_conn_types = { .types = { PTR_TO_NF_CONN } }; static const struct bpf_reg_types *compatible_reg_types[__BPF_ARG_TYPE_MAX] = { [ARG_PTR_TO_MAP_KEY] = &map_key_value_types, @@ -5118,6 +5190,7 @@ static const struct bpf_reg_types *compatible_reg_types[__BPF_ARG_TYPE_MAX] = { [ARG_PTR_TO_STACK_OR_NULL] = &stack_ptr_types, [ARG_PTR_TO_CONST_STR] = &const_str_ptr_types, [ARG_PTR_TO_TIMER] = &timer_types, + [ARG_PTR_TO_NF_CONN] = &nf_conn_types, }; static int check_reg_type(struct bpf_verifier_env *env, u32 regno, @@ -6586,6 +6659,9 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn */ regs[BPF_REG_0].btf = btf_vmlinux; regs[BPF_REG_0].btf_id = ret_btf_id; + } else if (fn->ret_type == RET_PTR_TO_NF_CONN_OR_NULL) { + mark_reg_known_zero(env, regs, BPF_REG_0); + regs[BPF_REG_0].type = PTR_TO_NF_CONN_OR_NULL; } else { verbose(env, "unknown return type %d of func %s#%d\n", fn->ret_type, func_id_name(func_id), func_id); @@ -7214,6 +7290,8 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, case PTR_TO_TCP_SOCK: case PTR_TO_TCP_SOCK_OR_NULL: case PTR_TO_XDP_SOCK: + case PTR_TO_NF_CONN: + case PTR_TO_NF_CONN_OR_NULL: verbose(env, "R%d pointer arithmetic on %s prohibited\n", dst, reg_type_str[ptr_reg->type]); return -EACCES; @@ -10505,6 +10583,8 @@ static bool regsafe(struct bpf_verifier_env *env, struct bpf_reg_state *rold, case PTR_TO_TCP_SOCK: case PTR_TO_TCP_SOCK_OR_NULL: case PTR_TO_XDP_SOCK: + case PTR_TO_NF_CONN: + case PTR_TO_NF_CONN_OR_NULL: /* Only valid matches are exact, which memcmp() above * would have accepted */ @@ -11040,6 +11120,8 @@ static bool reg_type_mismatch_ok(enum bpf_reg_type type) case PTR_TO_XDP_SOCK: case PTR_TO_BTF_ID: case PTR_TO_BTF_ID_OR_NULL: + case PTR_TO_NF_CONN: + case PTR_TO_NF_CONN_OR_NULL: return false; default: return true; @@ -12462,6 +12544,9 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env) return -EINVAL; } continue; + case PTR_TO_NF_CONN: + convert_ctx_access = bpf_ct_convert_ctx_access; + break; default: continue; } diff --git a/net/core/filter.c b/net/core/filter.c index d04988e67640..d2d07ccae599 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -78,6 +78,7 @@ #include #include #include +#include static const struct bpf_func_proto * bpf_sk_base_func_proto(enum bpf_func_id func_id); @@ -8002,6 +8003,24 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, return size == size_default; } +#if IS_BUILTIN(CONFIG_NF_CONNTRACK) +bool bpf_ct_is_valid_access(int off, int size, enum bpf_access_type type, + struct bpf_insn_access_aux *info) +{ + if (off < 0 || off > sizeof(struct bpf_nf_conn)) + return false; + if (off % size != 0) + return false; + + switch (off) { + case offsetof(struct bpf_nf_conn, status): + return size == sizeof_field(struct bpf_nf_conn, status); + } + + return false; +} +#endif + static bool sock_filter_is_valid_access(int off, int size, enum bpf_access_type type, const struct bpf_prog *prog, @@ -9094,6 +9113,28 @@ u32 bpf_sock_convert_ctx_access(enum bpf_access_type type, return insn - insn_buf; } +#if IS_BUILTIN(CONFIG_NF_CONNTRACK) +u32 bpf_ct_convert_ctx_access(enum bpf_access_type type, + const struct bpf_insn *si, + struct bpf_insn *insn_buf, + struct bpf_prog *prog, u32 *target_size) +{ + struct bpf_insn *insn = insn_buf; + + switch (si->off) { + case offsetof(struct bpf_nf_conn, status): + BUILD_BUG_ON(sizeof_field(struct nf_conn, status) > + sizeof_field(struct bpf_nf_conn, status)); + *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(struct nf_conn, status), + si->dst_reg, si->src_reg, + offsetof(struct nf_conn, status)); + break; + } + + return insn - insn_buf; +} +#endif + static u32 tc_cls_act_convert_ctx_access(enum bpf_access_type type, const struct bpf_insn *si, struct bpf_insn *insn_buf, diff --git a/scripts/bpf_doc.py b/scripts/bpf_doc.py index 00ac7b79cddb..0c2cd955f5e0 100755 --- a/scripts/bpf_doc.py +++ b/scripts/bpf_doc.py @@ -596,6 +596,7 @@ class PrinterHelpers(Printer): 'struct socket', 'struct file', 'struct bpf_timer', + 'struct bpf_nf_conn', } mapped_types = { 'u8': '__u8', diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index efb2750f39c6..a10a44c4f79b 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -5472,6 +5472,10 @@ struct bpf_xdp_sock { __u32 queue_id; }; +struct bpf_nf_conn { + __u64 status; +}; + #define XDP_PACKET_HEADROOM 256 /* User return codes for XDP prog type. From patchwork Tue Oct 19 14:46:52 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Mikityanskiy X-Patchwork-Id: 12570161 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BFECC433FE for ; Tue, 19 Oct 2021 14:48:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7EB356113B for ; Tue, 19 Oct 2021 14:48:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232109AbhJSOu5 (ORCPT ); Tue, 19 Oct 2021 10:50:57 -0400 Received: from mail-dm6nam10on2067.outbound.protection.outlook.com ([40.107.93.67]:8544 "EHLO NAM10-DM6-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S231888AbhJSOu4 (ORCPT ); Tue, 19 Oct 2021 10:50:56 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Q35UOqMQMr6wdSec49kS/UcHTKZHWLZ8FZf/Cg/iZj0HCV1uLAkZuei3iD2kPyq0hAFly1oKha7UsQs+J//nZ/yqGD7mIX8riz0v4eMei7sjtAW+qQ5u+XlAn7j7DzPgBpK2HJ99HI+nr/wAQGJXZuTBQFFbdO8x8pNhRT86e4L88Qtd/A3KCsIuUpmkIoPuE0FW6LcAmxv7mTZCCDPJ2mNV28vRGSwOpRj5z9LEt3Ge0R4UWBEduewMwTiCw0IqUmVgNxrcOZRxFyYS5cyjtdCZ592DQzzEFVH6Oos1oEXsTeupgZzqUos4jQFRFEDV8AlB05Krx+YdpTBFdU6hBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=vU+B4qRP7qY0JT/OpCk4ACyeJG2Bkd0l++xjZupBqa0=; b=ZFUrQYUvioB8Ps1XBy/9KWM/SU3fqSv3cjajeQHc3KZ/jQDlTrfLyGuvckIcp2vyH6UpLI5wkFkxdhDnsKCrYR103PS4dPypL/pU6ivcIHar/uc/8jrH0CHgE+mX017g1uzKeY59m/x9PKicnui2xG4WvedjxlbdayVO4AXsjBeWf7ExTOrdDRwmJkV8ovRTOcn47KpXvT570BHikBWzAbF6D9mTvRm0nVIiOxfK5fiRKvn4CkOniPaK5VUi4RPQ4e7xZahWnbdrFMZJbyD4i40cI15EeZQZbjx4l617w613y1F+FHovYTxFkUu/gxXskzh5rf262IlaVG/WO2PmFQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.34) smtp.rcpttodomain=iogearbox.net smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vU+B4qRP7qY0JT/OpCk4ACyeJG2Bkd0l++xjZupBqa0=; b=ZSfImuaj18GGGdwoJ6o5Fasq1qfYQRghfUps8C+Pa/Zbr3+wZt+A2ZrySiHd4wMipy5gfyRXlaRSE/Rc4c1ZTjpGekCRo6ueizh0uCZka8UqMAzG4ZKS8tY1BeKOdLdwrUdcevoHI2taZEm03/3O7KBQQmByM1fzGyw0qCva5M+oL+r1LMKUCOOyp8mH1UxpNb4UNxzzcuo2Jd1KmujwH/WP41KvG5F+5zshGJWD8J3SMSFAvyLXptIHz0rWODAg8NjapA5+dSkON9adhIDBrw01HBFgE9YhoXkK5mUO2w3OttosuAgY0Y9pfDd3TLUKGm7AIaUvk1ekBGAWj//Qtg== Received: from DM6PR02CA0099.namprd02.prod.outlook.com (2603:10b6:5:1f4::40) by BYAPR12MB3061.namprd12.prod.outlook.com (2603:10b6:a03:a8::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4628.15; Tue, 19 Oct 2021 14:48:41 +0000 Received: from DM6NAM11FT029.eop-nam11.prod.protection.outlook.com (2603:10b6:5:1f4:cafe::e2) by DM6PR02CA0099.outlook.office365.com (2603:10b6:5:1f4::40) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.16 via Frontend Transport; Tue, 19 Oct 2021 14:48:41 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.34) smtp.mailfrom=nvidia.com; iogearbox.net; dkim=none (message not signed) header.d=none;iogearbox.net; dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.34 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.34; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.34) by DM6NAM11FT029.mail.protection.outlook.com (10.13.173.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:48:40 +0000 Received: from HQMAIL105.nvidia.com (172.20.187.12) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 14:48:40 +0000 Received: from HQMAIL107.nvidia.com (172.20.187.13) by HQMAIL105.nvidia.com (172.20.187.12) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 14:48:39 +0000 Received: from vdi.nvidia.com (172.20.187.6) by mail.nvidia.com (172.20.187.13) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Tue, 19 Oct 2021 14:48:27 +0000 From: Maxim Mikityanskiy To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh CC: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Hideaki YOSHIFUJI , David Ahern , "Jesper Dangaard Brouer" , Nathan Chancellor , "Nick Desaulniers" , Brendan Jackman , Florent Revest , Joe Stringer , "Lorenz Bauer" , Tariq Toukan , , , , Maxim Mikityanskiy Subject: [PATCH bpf-next 07/10] bpf: Add helpers to query conntrack info Date: Tue, 19 Oct 2021 17:46:52 +0300 Message-ID: <20211019144655.3483197-8-maximmi@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211019144655.3483197-1-maximmi@nvidia.com> References: <20211019144655.3483197-1-maximmi@nvidia.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 4406f076-1202-4140-97e8-08d9930f8abc X-MS-TrafficTypeDiagnostic: BYAPR12MB3061: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 1wnmgW7GjCppMQripW/AeD5gYncjCEOodmMH4sOMJ8p98grUWkFkKNBdtaKGno46T+WcjfOP9E1v+yhxxPOvNsc6FLqF58/Bn/jwNscdWCPcX63JnN46cP177ht6W64ohFu/mq/xe6hHGpgAWR/RlSuWIL4Fj8FLVs7rpV0jxbXyk3KpDBx596Hd9q7y/Y95JRVLvdACJszNUULXsk0M0B8p9mbaEksJ6aEcOrRA04/fiAO1eWfIruwgAj/KuWhi15OU6mNyY4AiIZm1jyX4PsNXJtYjmHx1ZSYCW7g2mlVh3oVFCg6J9B0k2y9RoJTORD9TQTLCn01bKPFH9pcO03fufkRNmslKBVfTMyfxcjMxf9sZ26q1H17GxOw1wSHcvJT8CeQluy9e9q7Xbepo79HqVBpZdfejC0Pj8j3Na+SPzmVv4n/WjBwshP+ScLOhpycL7TxwstHp3qWy2WyMswbZatquLjyYHJvDJs+1oJ8cbxiEqjwBITDt6U5ZvbOQhC435RRPhwwFCEHF3G+Jdvjh4ZTCuqLe9yygOu8KYnBhRdna90T9AK59plkKaP/VLgFYBm60CQVZLEY1U9f5v0pFpkSFeJOA2gxhEBS4dlgOuepxbTlpk9SDdcUA86u3n4WX21yJX6ElzCur8/9SJNZamC8mr1N0VcxTC5vF4GWOx2fsoqVNyVkJXfP0vJC5BaL2LTu1aOZF/0Zz8WQ0xQx5hOtn3J+EY2FsbsAKMd8= X-Forefront-Antispam-Report: CIP:216.228.112.34;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:schybrid03.nvidia.com;CAT:NONE;SFS:(4636009)(46966006)(36840700001)(36756003)(110136005)(82310400003)(36906005)(86362001)(8936002)(5660300002)(54906003)(336012)(8676002)(2616005)(1076003)(426003)(26005)(107886003)(6666004)(30864003)(47076005)(186003)(508600001)(4326008)(36860700001)(7696005)(2906002)(70586007)(70206006)(316002)(7636003)(356005)(7416002)(83380400001)(21314003);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 14:48:40.9564 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 4406f076-1202-4140-97e8-08d9930f8abc X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.34];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT029.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR12MB3061 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net The new helpers (bpf_ct_lookup_tcp and bpf_ct_lookup_udp) allow to query connection tracking information of TCP and UDP connections based on source and destination IP address and port. The helper returns a pointer to struct nf_conn (if the conntrack entry was found), which needs to be released with bpf_ct_release. Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan --- include/uapi/linux/bpf.h | 81 +++++++++++++ kernel/bpf/verifier.c | 9 +- net/core/filter.c | 205 +++++++++++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 81 +++++++++++++ 4 files changed, 373 insertions(+), 3 deletions(-) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index a10a44c4f79b..883de3f1bb8b 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -4925,6 +4925,79 @@ union bpf_attr { * Return * The number of bytes written to the buffer, or a negative error * in case of failure. + * + * struct bpf_nf_conn *bpf_ct_lookup_tcp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u64 netns, u64 *flags_err) + * Description + * Look for conntrack info for a TCP connection matching *tuple*, + * optionally in a child network namespace *netns*. + * + * The *flags_err* argument is used as an input parameter for flags + * and output parameter for the error code. The flags can be a + * combination of one or more of the following values: + * + * **BPF_F_CT_DIR_REPLY** + * When set, the conntrack direction is IP_CT_DIR_REPLY, + * otherwise IP_CT_DIR_ORIGINAL. + * + * If the function returns **NULL**, *flags_err* will indicate the + * error code: + * + * **EAFNOSUPPORT** + * *tuple_size* doesn't match supported address families + * (AF_INET; AF_INET6 when CONFIG_IPV6 is enabled). + * + * **EINVAL** + * Input arguments are not valid. + * + * **ENOENT** + * Connection tracking entry for *tuple* wasn't found. + * + * This helper is available only if the kernel was compiled with + * **CONFIG_NF_CONNTRACK** configuration option as built-in. + * Return + * Connection tracking status (see **enum ip_conntrack_status**), + * or **NULL** in case of failure or if there is no conntrack entry + * for this tuple. + * + * struct bpf_nf_conn *bpf_ct_lookup_udp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u64 netns, u64 *flags_err) + * Description + * Look for conntrack info for a UDP connection matching *tuple*, + * optionally in a child network namespace *netns*. + * + * The *flags_err* argument is used as an input parameter for flags + * and output parameter for the error code. The flags can be a + * combination of one or more of the following values: + * + * **BPF_F_CT_DIR_REPLY** + * When set, the conntrack direction is IP_CT_DIR_REPLY, + * otherwise IP_CT_DIR_ORIGINAL. + * + * If the function returns **NULL**, *flags_err* will indicate the + * error code: + * + * **EAFNOSUPPORT** + * *tuple_size* doesn't match supported address families + * (AF_INET; AF_INET6 when CONFIG_IPV6 is enabled). + * + * **EINVAL** + * Input arguments are not valid. + * + * **ENOENT** + * Connection tracking entry for *tuple* wasn't found. + * + * This helper is available only if the kernel was compiled with + * **CONFIG_NF_CONNTRACK** configuration option as built-in. + * Return + * Connection tracking status (see **enum ip_conntrack_status**), + * or **NULL** in case of failure or if there is no conntrack entry + * for this tuple. + * + * long bpf_ct_release(void *ct) + * Description + * Release the reference held by *ct*. *ct* must be a non-**NULL** + * pointer that was returned from **bpf_ct_lookup_xxx**\ (). + * Return + * 0 on success, or a negative error in case of failure. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -5105,6 +5178,9 @@ union bpf_attr { FN(task_pt_regs), \ FN(get_branch_snapshot), \ FN(trace_vprintk), \ + FN(ct_lookup_tcp), \ + FN(ct_lookup_udp), \ + FN(ct_release), \ /* */ /* integer value in 'imm' field of BPF_CALL instruction selects which helper @@ -5288,6 +5364,11 @@ enum { BPF_F_EXCLUDE_INGRESS = (1ULL << 4), }; +/* Flags for bpf_ct_lookup_{tcp,udp} helpers. */ +enum { + BPF_F_CT_DIR_REPLY = (1ULL << 0), +}; + #define __bpf_md_ptr(type, name) \ union { \ type name; \ diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6eafef35e247..23e2a23ca9c4 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -506,7 +506,8 @@ static bool is_release_function(enum bpf_func_id func_id) { return func_id == BPF_FUNC_sk_release || func_id == BPF_FUNC_ringbuf_submit || - func_id == BPF_FUNC_ringbuf_discard; + func_id == BPF_FUNC_ringbuf_discard || + func_id == BPF_FUNC_ct_release; } static bool may_be_acquire_function(enum bpf_func_id func_id) @@ -515,7 +516,8 @@ static bool may_be_acquire_function(enum bpf_func_id func_id) func_id == BPF_FUNC_sk_lookup_udp || func_id == BPF_FUNC_skc_lookup_tcp || func_id == BPF_FUNC_map_lookup_elem || - func_id == BPF_FUNC_ringbuf_reserve; + func_id == BPF_FUNC_ringbuf_reserve || + func_id == BPF_FUNC_ct_lookup_tcp; } static bool is_acquire_function(enum bpf_func_id func_id, @@ -526,7 +528,8 @@ static bool is_acquire_function(enum bpf_func_id func_id, if (func_id == BPF_FUNC_sk_lookup_tcp || func_id == BPF_FUNC_sk_lookup_udp || func_id == BPF_FUNC_skc_lookup_tcp || - func_id == BPF_FUNC_ringbuf_reserve) + func_id == BPF_FUNC_ringbuf_reserve || + func_id == BPF_FUNC_ct_lookup_tcp) return true; if (func_id == BPF_FUNC_map_lookup_elem && diff --git a/net/core/filter.c b/net/core/filter.c index d2d07ccae599..f913851c97f7 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -79,6 +79,7 @@ #include #include #include +#include static const struct bpf_func_proto * bpf_sk_base_func_proto(enum bpf_func_id func_id); @@ -7096,6 +7097,194 @@ static const struct bpf_func_proto bpf_sock_ops_reserve_hdr_opt_proto = { .arg3_type = ARG_ANYTHING, }; +#if IS_BUILTIN(CONFIG_NF_CONNTRACK) +static struct nf_conn *bpf_ct_lookup(struct net *caller_net, + struct bpf_sock_tuple *tuple, + u32 tuple_len, + u8 protonum, + u64 netns_id, + u64 flags) +{ + struct nf_conntrack_tuple ct_tuple = {}; + struct nf_conntrack_tuple_hash *found; + struct net *net; + u8 direction; + + direction = flags & BPF_F_CT_DIR_REPLY ? IP_CT_DIR_REPLY : + IP_CT_DIR_ORIGINAL; + + if (flags & ~BPF_F_CT_DIR_REPLY) + return ERR_PTR(-EINVAL); + + if (tuple_len == sizeof(tuple->ipv4)) { + ct_tuple.src.l3num = AF_INET; + ct_tuple.src.u3.ip = tuple->ipv4.saddr; + ct_tuple.src.u.tcp.port = tuple->ipv4.sport; + ct_tuple.dst.u3.ip = tuple->ipv4.daddr; + ct_tuple.dst.u.tcp.port = tuple->ipv4.dport; +#if IS_ENABLED(CONFIG_IPV6) + } else if (tuple_len == sizeof(tuple->ipv6)) { + ct_tuple.src.l3num = AF_INET6; + memcpy(ct_tuple.src.u3.ip6, tuple->ipv6.saddr, + sizeof(tuple->ipv6.saddr)); + ct_tuple.src.u.tcp.port = tuple->ipv6.sport; + memcpy(ct_tuple.dst.u3.ip6, tuple->ipv6.daddr, + sizeof(tuple->ipv6.daddr)); + ct_tuple.dst.u.tcp.port = tuple->ipv6.dport; +#endif + } else { + return ERR_PTR(-EAFNOSUPPORT); + } + + ct_tuple.dst.protonum = protonum; + ct_tuple.dst.dir = direction; + + net = caller_net; + if ((s32)netns_id >= 0) { + if (unlikely(netns_id > S32_MAX)) + return ERR_PTR(-EINVAL); + net = get_net_ns_by_id(net, netns_id); + if (!net) + return ERR_PTR(-EINVAL); + } + + found = nf_conntrack_find_get(net, &nf_ct_zone_dflt, &ct_tuple); + + if ((s32)netns_id >= 0) + put_net(net); + + if (!found) + return ERR_PTR(-ENOENT); + return nf_ct_tuplehash_to_ctrack(found); +} + +BPF_CALL_5(bpf_xdp_ct_lookup_tcp, struct xdp_buff *, ctx, + struct bpf_sock_tuple *, tuple, u32, tuple_len, + u64, netns_id, u64 *, flags_err) +{ + struct nf_conn *ct; + + ct = bpf_ct_lookup(dev_net(ctx->rxq->dev), tuple, tuple_len, + IPPROTO_TCP, netns_id, *flags_err); + if (IS_ERR(ct)) { + *flags_err = PTR_ERR(ct); + return (unsigned long)NULL; + } + return (unsigned long)ct; +} + +static const struct bpf_func_proto bpf_xdp_ct_lookup_tcp_proto = { + .func = bpf_xdp_ct_lookup_tcp, + .gpl_only = true, /* nf_conntrack_find_get is GPL */ + .pkt_access = true, + .ret_type = RET_PTR_TO_NF_CONN_OR_NULL, + .arg1_type = ARG_PTR_TO_CTX, + .arg2_type = ARG_PTR_TO_MEM, + .arg3_type = ARG_CONST_SIZE, + .arg4_type = ARG_ANYTHING, + .arg5_type = ARG_PTR_TO_LONG, +}; + +BPF_CALL_5(bpf_xdp_ct_lookup_udp, struct xdp_buff *, ctx, + struct bpf_sock_tuple *, tuple, u32, tuple_len, + u64, netns_id, u64 *, flags_err) +{ + struct nf_conn *ct; + + ct = bpf_ct_lookup(dev_net(ctx->rxq->dev), tuple, tuple_len, + IPPROTO_UDP, netns_id, *flags_err); + if (IS_ERR(ct)) { + *flags_err = PTR_ERR(ct); + return (unsigned long)NULL; + } + return (unsigned long)ct; +} + +static const struct bpf_func_proto bpf_xdp_ct_lookup_udp_proto = { + .func = bpf_xdp_ct_lookup_udp, + .gpl_only = true, /* nf_conntrack_find_get is GPL */ + .pkt_access = true, + .ret_type = RET_PTR_TO_NF_CONN_OR_NULL, + .arg1_type = ARG_PTR_TO_CTX, + .arg2_type = ARG_PTR_TO_MEM, + .arg3_type = ARG_CONST_SIZE, + .arg4_type = ARG_ANYTHING, + .arg5_type = ARG_PTR_TO_LONG, +}; + +BPF_CALL_5(bpf_skb_ct_lookup_tcp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, tuple_len, + u64, netns_id, u64 *, flags_err) +{ + struct net *caller_net; + struct nf_conn *ct; + + caller_net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk); + ct = bpf_ct_lookup(caller_net, tuple, tuple_len, IPPROTO_TCP, + netns_id, *flags_err); + if (IS_ERR(ct)) { + *flags_err = PTR_ERR(ct); + return (unsigned long)NULL; + } + return (unsigned long)ct; +} + +static const struct bpf_func_proto bpf_skb_ct_lookup_tcp_proto = { + .func = bpf_skb_ct_lookup_tcp, + .gpl_only = true, /* nf_conntrack_find_get is GPL */ + .pkt_access = true, + .ret_type = RET_PTR_TO_NF_CONN_OR_NULL, + .arg1_type = ARG_PTR_TO_CTX, + .arg2_type = ARG_PTR_TO_MEM, + .arg3_type = ARG_CONST_SIZE, + .arg4_type = ARG_ANYTHING, + .arg5_type = ARG_PTR_TO_LONG, +}; + +BPF_CALL_5(bpf_skb_ct_lookup_udp, struct sk_buff *, skb, + struct bpf_sock_tuple *, tuple, u32, tuple_len, + u64, netns_id, u64 *, flags_err) +{ + struct net *caller_net; + struct nf_conn *ct; + + caller_net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk); + ct = bpf_ct_lookup(caller_net, tuple, tuple_len, IPPROTO_UDP, + netns_id, *flags_err); + if (IS_ERR(ct)) { + *flags_err = PTR_ERR(ct); + return (unsigned long)NULL; + } + return (unsigned long)ct; +} + +static const struct bpf_func_proto bpf_skb_ct_lookup_udp_proto = { + .func = bpf_skb_ct_lookup_udp, + .gpl_only = true, /* nf_conntrack_find_get is GPL */ + .pkt_access = true, + .ret_type = RET_PTR_TO_NF_CONN_OR_NULL, + .arg1_type = ARG_PTR_TO_CTX, + .arg2_type = ARG_PTR_TO_MEM, + .arg3_type = ARG_CONST_SIZE, + .arg4_type = ARG_ANYTHING, + .arg5_type = ARG_PTR_TO_LONG, +}; + +BPF_CALL_1(bpf_ct_release, struct nf_conn *, ct) +{ + nf_ct_put(ct); + return 0; +} + +static const struct bpf_func_proto bpf_ct_release_proto = { + .func = bpf_ct_release, + .gpl_only = false, + .pkt_access = false, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_NF_CONN, +}; +#endif + #endif /* CONFIG_INET */ bool bpf_helper_changes_pkt_data(void *func) @@ -7455,6 +7644,14 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) return &bpf_tcp_gen_syncookie_proto; case BPF_FUNC_sk_assign: return &bpf_sk_assign_proto; +#if IS_BUILTIN(CONFIG_NF_CONNTRACK) + case BPF_FUNC_ct_lookup_tcp: + return &bpf_skb_ct_lookup_tcp_proto; + case BPF_FUNC_ct_lookup_udp: + return &bpf_skb_ct_lookup_udp_proto; + case BPF_FUNC_ct_release: + return &bpf_ct_release_proto; +#endif #endif default: return bpf_sk_base_func_proto(func_id); @@ -7498,6 +7695,14 @@ xdp_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) return &bpf_tcp_check_syncookie_proto; case BPF_FUNC_tcp_gen_syncookie: return &bpf_tcp_gen_syncookie_proto; +#if IS_BUILTIN(CONFIG_NF_CONNTRACK) + case BPF_FUNC_ct_lookup_tcp: + return &bpf_xdp_ct_lookup_tcp_proto; + case BPF_FUNC_ct_lookup_udp: + return &bpf_xdp_ct_lookup_udp_proto; + case BPF_FUNC_ct_release: + return &bpf_ct_release_proto; +#endif #endif default: return bpf_sk_base_func_proto(func_id); diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index a10a44c4f79b..883de3f1bb8b 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -4925,6 +4925,79 @@ union bpf_attr { * Return * The number of bytes written to the buffer, or a negative error * in case of failure. + * + * struct bpf_nf_conn *bpf_ct_lookup_tcp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u64 netns, u64 *flags_err) + * Description + * Look for conntrack info for a TCP connection matching *tuple*, + * optionally in a child network namespace *netns*. + * + * The *flags_err* argument is used as an input parameter for flags + * and output parameter for the error code. The flags can be a + * combination of one or more of the following values: + * + * **BPF_F_CT_DIR_REPLY** + * When set, the conntrack direction is IP_CT_DIR_REPLY, + * otherwise IP_CT_DIR_ORIGINAL. + * + * If the function returns **NULL**, *flags_err* will indicate the + * error code: + * + * **EAFNOSUPPORT** + * *tuple_size* doesn't match supported address families + * (AF_INET; AF_INET6 when CONFIG_IPV6 is enabled). + * + * **EINVAL** + * Input arguments are not valid. + * + * **ENOENT** + * Connection tracking entry for *tuple* wasn't found. + * + * This helper is available only if the kernel was compiled with + * **CONFIG_NF_CONNTRACK** configuration option as built-in. + * Return + * Connection tracking status (see **enum ip_conntrack_status**), + * or **NULL** in case of failure or if there is no conntrack entry + * for this tuple. + * + * struct bpf_nf_conn *bpf_ct_lookup_udp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u64 netns, u64 *flags_err) + * Description + * Look for conntrack info for a UDP connection matching *tuple*, + * optionally in a child network namespace *netns*. + * + * The *flags_err* argument is used as an input parameter for flags + * and output parameter for the error code. The flags can be a + * combination of one or more of the following values: + * + * **BPF_F_CT_DIR_REPLY** + * When set, the conntrack direction is IP_CT_DIR_REPLY, + * otherwise IP_CT_DIR_ORIGINAL. + * + * If the function returns **NULL**, *flags_err* will indicate the + * error code: + * + * **EAFNOSUPPORT** + * *tuple_size* doesn't match supported address families + * (AF_INET; AF_INET6 when CONFIG_IPV6 is enabled). + * + * **EINVAL** + * Input arguments are not valid. + * + * **ENOENT** + * Connection tracking entry for *tuple* wasn't found. + * + * This helper is available only if the kernel was compiled with + * **CONFIG_NF_CONNTRACK** configuration option as built-in. + * Return + * Connection tracking status (see **enum ip_conntrack_status**), + * or **NULL** in case of failure or if there is no conntrack entry + * for this tuple. + * + * long bpf_ct_release(void *ct) + * Description + * Release the reference held by *ct*. *ct* must be a non-**NULL** + * pointer that was returned from **bpf_ct_lookup_xxx**\ (). + * Return + * 0 on success, or a negative error in case of failure. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -5105,6 +5178,9 @@ union bpf_attr { FN(task_pt_regs), \ FN(get_branch_snapshot), \ FN(trace_vprintk), \ + FN(ct_lookup_tcp), \ + FN(ct_lookup_udp), \ + FN(ct_release), \ /* */ /* integer value in 'imm' field of BPF_CALL instruction selects which helper @@ -5288,6 +5364,11 @@ enum { BPF_F_EXCLUDE_INGRESS = (1ULL << 4), }; +/* Flags for bpf_ct_lookup_{tcp,udp} helpers. */ +enum { + BPF_F_CT_DIR_REPLY = (1ULL << 0), +}; + #define __bpf_md_ptr(type, name) \ union { \ type name; \ From patchwork Tue Oct 19 14:46:53 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Mikityanskiy X-Patchwork-Id: 12570163 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 000EDC433FE for ; Tue, 19 Oct 2021 14:49:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D23646113B for ; Tue, 19 Oct 2021 14:49:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232425AbhJSOvV (ORCPT ); Tue, 19 Oct 2021 10:51:21 -0400 Received: from mail-bn8nam12on2040.outbound.protection.outlook.com ([40.107.237.40]:13664 "EHLO NAM12-BN8-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S232363AbhJSOvJ (ORCPT ); Tue, 19 Oct 2021 10:51:09 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=QR0Jp33Kd7nK6ZQ16Fmaje31Zu+bnWsw4phT9T+LeLi8EUvzPuBKQuwMRPu0jb0hY/lNmN8GeAfh9jsrl/ZhmBctWozyunV4VesAWBxFjMvWF0gqCR7wEMCChoVDWnDHE+MLkYMYDAPrkwVJU56THDtVN++xxN326oXFs4DPYVTlbJX4KUa2wkJ0uEFPf6PdDRtcZCXngqPec0jlh5vuP0vhPIkrEDxPjuv+p0pig8RfkbaAwekdzzgISnyssL1YzMiTTAbqc/XgYQZwNUnT8VFtpyhxZi7Az9OPF5LwVmLeEXtU9RxUfBx4Ju4KEjUi/RAPoE+R+mgQjKF3lCJQ0w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=izyikvGZoGtoyPRFWarjhXP/b/YofPb6QbY7D3U8IAM=; b=AXTQrIOlYASKDJCMhgspcb05G78EWfaFyLxdXU3jA2kpgGvrG1l5dZRrl4eZeTpHPFgSpPR+NDbaP7Q3SxGvOo04ETRfRZBEQ7DReE5zZWhxqoL8McsiNyVtMkT7WOM53ZuY3obAGuPvruhyesvGYytwdHlJKeLiLWSmUWhCtspz3v0fX4ceHo3FTU++X9xEumW9Z1g/H/X43+apxV0Y0fNISLfz2dVi5LujSsR0X/ZDJgOTp4Rgow4Nmel4AyAXWoDkf6JawN1jDjsCBYvFmE4NjJDkEyLb5malm4p5/BTFsnV3rVj1PyY7G8wAXbErPcZRkY5wLBzGxvEGRV7ZJQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.34) smtp.rcpttodomain=google.com smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=izyikvGZoGtoyPRFWarjhXP/b/YofPb6QbY7D3U8IAM=; b=FJHAr3YViJW0ra9LaorkE0uY5JmgqOS7/Nm+nOPC6adbhwjH3Q8+LQ8LrzIOYjsrMBJgmQTw3QDEtZChUp0Msr6UYL3DCLI685sJGFAnNMYgr3n8Z/m3oyomOT2Vk8mZKDt+B5TZX1YNGLRWmtJhuVAVU24wWn3g5O6aWGGyofJ0Vc1yKm8L99jAY00AsXGY7lsL/gjWp/HLmPIlMsh0hGwoJuAhJ91nx4BXDt2rJbldPKDPOQ0NoI6hV3/x55xHH/yu1lErxHSh6mhU9NLDORI6f28avvgj5NHYy8O2a4nAPKRWtJgZEyFAcnFwk8V7jdQ1yzYNOoCWpUy7NJpV/A== Received: from DM5PR07CA0096.namprd07.prod.outlook.com (2603:10b6:4:ae::25) by SN6PR12MB2637.namprd12.prod.outlook.com (2603:10b6:805:6b::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.16; Tue, 19 Oct 2021 14:48:54 +0000 Received: from DM6NAM11FT008.eop-nam11.prod.protection.outlook.com (2603:10b6:4:ae:cafe::8) by DM5PR07CA0096.outlook.office365.com (2603:10b6:4:ae::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:48:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.34) smtp.mailfrom=nvidia.com; google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.34 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.34; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.34) by DM6NAM11FT008.mail.protection.outlook.com (10.13.172.85) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:48:53 +0000 Received: from HQMAIL107.nvidia.com (172.20.187.13) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 14:48:51 +0000 Received: from vdi.nvidia.com (172.20.187.6) by mail.nvidia.com (172.20.187.13) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Tue, 19 Oct 2021 14:48:40 +0000 From: Maxim Mikityanskiy To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh CC: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Hideaki YOSHIFUJI , David Ahern , "Jesper Dangaard Brouer" , Nathan Chancellor , "Nick Desaulniers" , Brendan Jackman , Florent Revest , Joe Stringer , "Lorenz Bauer" , Tariq Toukan , , , , Maxim Mikityanskiy Subject: [PATCH bpf-next 08/10] bpf: Add helpers to issue and check SYN cookies in XDP Date: Tue, 19 Oct 2021 17:46:53 +0300 Message-ID: <20211019144655.3483197-9-maximmi@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211019144655.3483197-1-maximmi@nvidia.com> References: <20211019144655.3483197-1-maximmi@nvidia.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: de6d4987-4805-4e21-0fc4-08d9930f9221 X-MS-TrafficTypeDiagnostic: SN6PR12MB2637: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Yb5UrXtby0H1LScP0WRGdkfZIEMUhxUkjWu0eDn8ulmQVsAlfnyyPMhD5yvTK69SqZ9Zjv8fGhMBhllbRgUwe88iZuPmY2ihJ08Eohgq4uMRVO+WFG+0gZ3f09+Hab07b8d9F8GfQMpzaFxLN3dtMFODiQpHhdZR29YZSfpAsWwVfd6nNSzwM56McIIhOqHkdxXHTnGyDOzQntGyi3BtuslAkf6dECcrpIPuC0rgGMP1If6dPRTIG2cSAVTS+jJwXQGFqzo0HgkLxbjkAHMuHlc107itsd4aAgVfnSd1Z0LQR0enQisqggiHtV6dCboTK7muflOzrSfyl/+QMiocQ8pZfeh8O+Rxy/SXRAwA8NiZAS/GaWQy5MdlRrqmvJS0mJ27h5pAylReotdpWU6QChlmjdD0y4HXQ4DY4m/Sg0EIGZt7x/htkwZfK1LpawchcWL/RyaFL9QtscLaIJbwkS19sz8F/p6/Z8lC7aoBgs7fcKPSZNFeMsdOBQnIZbFs6TBvJdl8ghF+IMM02Lx93B9zbBtTBECn1MAqAcNvxsxpIo71eGi56mzy89o1vVTlOumfpbgk/IedI6TnT18R9S9PY2xLUlmgHaEJ055mEy+9/R+r0U2HInl4BQ7Be3C/lyWQ9F4xWAoQNwZg5r7bBqKq2+ZpIB/72xwObuwXd1BmMiForkpPUnltkCrtHAatbwtDTV7mKQG0z3+J4wcZFSPPZ0eXXXHOH0+7dYcBHs4= X-Forefront-Antispam-Report: CIP:216.228.112.34;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:schybrid03.nvidia.com;CAT:NONE;SFS:(4636009)(46966006)(36840700001)(70586007)(7636003)(36860700001)(4326008)(8676002)(82310400003)(2906002)(107886003)(54906003)(426003)(110136005)(70206006)(508600001)(47076005)(7416002)(5660300002)(83380400001)(2616005)(30864003)(6666004)(336012)(36756003)(7696005)(1076003)(26005)(8936002)(316002)(86362001)(356005)(186003)(21314003);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 14:48:53.3189 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: de6d4987-4805-4e21-0fc4-08d9930f9221 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.34];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT008.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR12MB2637 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net The new helpers bpf_tcp_raw_{gen,check}_syncookie allow an XDP program to generate SYN cookies in response to TCP SYN packets and to check those cookies upon receiving the first ACK packet (the final packet of the TCP handshake). Unlike bpf_tcp_{gen,check}_syncookie these new helpers don't need a listening socket on the local machine, which allows to use them together with synproxy to accelerate SYN cookie generation. Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan --- include/net/tcp.h | 1 + include/uapi/linux/bpf.h | 57 +++++++++++++++ net/core/filter.c | 122 +++++++++++++++++++++++++++++++++ net/ipv4/tcp_input.c | 3 +- tools/include/uapi/linux/bpf.h | 57 +++++++++++++++ 5 files changed, 239 insertions(+), 1 deletion(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index 4c2898ac6569..1cc96a225848 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -431,6 +431,7 @@ u16 tcp_v4_get_syncookie(struct sock *sk, struct iphdr *iph, struct tcphdr *th, u32 *cookie); u16 tcp_v6_get_syncookie(struct sock *sk, struct ipv6hdr *iph, struct tcphdr *th, u32 *cookie); +u16 tcp_parse_mss_option(const struct tcphdr *th, u16 user_mss); u16 tcp_get_syncookie_mss(struct request_sock_ops *rsk_ops, const struct tcp_request_sock_ops *af_ops, struct sock *sk, struct tcphdr *th); diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 883de3f1bb8b..e32f72077250 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -4998,6 +4998,61 @@ union bpf_attr { * pointer that was returned from **bpf_ct_lookup_xxx**\ (). * Return * 0 on success, or a negative error in case of failure. + * + * s64 bpf_tcp_raw_gen_syncookie(void *iph, u32 iph_len, struct tcphdr *th, u32 th_len) + * Description + * Try to issue a SYN cookie for the packet with corresponding + * IP/TCP headers, *iph* and *th*, without depending on a listening + * socket. + * + * *iph* points to the start of the IPv4 or IPv6 header, while + * *iph_len* contains **sizeof**\ (**struct iphdr**) or + * **sizeof**\ (**struct ip6hdr**). + * + * *th* points to the start of the TCP header, while *th_len* + * contains the length of the TCP header (at least + * **sizeof**\ (**struct tcphdr**)). + * Return + * On success, lower 32 bits hold the generated SYN cookie in + * followed by 16 bits which hold the MSS value for that cookie, + * and the top 16 bits are unused. + * + * On failure, the returned value is one of the following: + * + * **-EINVAL** if the packet or input arguments are invalid. + * + * **-EOPNOTSUPP** if the kernel configuration does not enable SYN + * cookies (CONFIG_SYN_COOKIES is off). + * + * **-EPROTONOSUPPORT** if the IP version is not 4 or 6 (or 6, but + * CONFIG_IPV6 is disabled). + * + * int bpf_tcp_raw_check_syncookie(void *iph, u32 iph_len, struct tcphdr *th, u32 th_len) + * Description + * Check whether *iph* and *th* contain a valid SYN cookie ACK + * without depending on a listening socket. + * + * *iph* points to the start of the IPv4 or IPv6 header, while + * *iph_len* contains **sizeof**\ (**struct iphdr**) or + * **sizeof**\ (**struct ip6hdr**). + * + * *th* points to the start of the TCP header, while *th_len* + * contains the length of the TCP header (at least + * **sizeof**\ (**struct tcphdr**)). + * Return + * 0 if *iph* and *th* are a valid SYN cookie ACK. + * + * On failure, the returned value is one of the following: + * + * **-EACCES** if the SYN cookie is not valid. + * + * **-EINVAL** if the packet or input arguments are invalid. + * + * **-EOPNOTSUPP** if the kernel configuration does not enable SYN + * cookies (CONFIG_SYN_COOKIES is off). + * + * **-EPROTONOSUPPORT** if the IP version is not 4 or 6 (or 6, but + * CONFIG_IPV6 is disabled). */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -5181,6 +5236,8 @@ union bpf_attr { FN(ct_lookup_tcp), \ FN(ct_lookup_udp), \ FN(ct_release), \ + FN(tcp_raw_gen_syncookie), \ + FN(tcp_raw_check_syncookie), \ /* */ /* integer value in 'imm' field of BPF_CALL instruction selects which helper diff --git a/net/core/filter.c b/net/core/filter.c index f913851c97f7..5f03d4a282a0 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7285,6 +7285,124 @@ static const struct bpf_func_proto bpf_ct_release_proto = { }; #endif +BPF_CALL_4(bpf_tcp_raw_gen_syncookie, void *, iph, u32, iph_len, + struct tcphdr *, th, u32, th_len) +{ +#ifdef CONFIG_SYN_COOKIES + u32 cookie; + u16 mss; + + if (unlikely(th_len < sizeof(*th) || th_len != th->doff * 4)) + return -EINVAL; + + if (!th->syn || th->ack || th->fin || th->rst) + return -EINVAL; + + if (unlikely(iph_len < sizeof(struct iphdr))) + return -EINVAL; + + /* Both struct iphdr and struct ipv6hdr have the version field at the + * same offset so we can cast to the shorter header (struct iphdr). + */ + switch (((struct iphdr *)iph)->version) { + case 4: + mss = tcp_parse_mss_option(th, 0) ?: TCP_MSS_DEFAULT; + cookie = __cookie_v4_init_sequence(iph, th, &mss); + break; + +#if IS_BUILTIN(CONFIG_IPV6) + case 6: { + const u16 mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr); + + if (unlikely(iph_len < sizeof(struct ipv6hdr))) + return -EINVAL; + + mss = tcp_parse_mss_option(th, 0) ?: mss_clamp; + cookie = __cookie_v6_init_sequence(iph, th, &mss); + break; + } +#endif /* CONFIG_IPV6 */ + + default: + return -EPROTONOSUPPORT; + } + + return cookie | ((u64)mss << 32); +#else + return -EOPNOTSUPP; +#endif /* CONFIG_SYN_COOKIES */ +} + +static const struct bpf_func_proto bpf_tcp_raw_gen_syncookie_proto = { + .func = bpf_tcp_raw_gen_syncookie, + .gpl_only = true, /* __cookie_v*_init_sequence() is GPL */ + .pkt_access = true, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_MEM, + .arg2_type = ARG_CONST_SIZE, + .arg3_type = ARG_PTR_TO_MEM, + .arg4_type = ARG_CONST_SIZE, +}; + +BPF_CALL_4(bpf_tcp_raw_check_syncookie, void *, iph, u32, iph_len, + struct tcphdr *, th, u32, th_len) +{ +#ifdef CONFIG_SYN_COOKIES + u32 cookie; + int ret; + + if (unlikely(th_len < sizeof(*th))) + return -EINVAL; + + if (!th->ack || th->rst || th->syn) + return -EINVAL; + + if (unlikely(iph_len < sizeof(struct iphdr))) + return -EINVAL; + + cookie = ntohl(th->ack_seq) - 1; + + /* Both struct iphdr and struct ipv6hdr have the version field at the + * same offset so we can cast to the shorter header (struct iphdr). + */ + switch (((struct iphdr *)iph)->version) { + case 4: + ret = __cookie_v4_check((struct iphdr *)iph, th, cookie); + break; + +#if IS_BUILTIN(CONFIG_IPV6) + case 6: + if (unlikely(iph_len < sizeof(struct ipv6hdr))) + return -EINVAL; + + ret = __cookie_v6_check((struct ipv6hdr *)iph, th, cookie); + break; +#endif /* CONFIG_IPV6 */ + + default: + return -EPROTONOSUPPORT; + } + + if (ret > 0) + return 0; + + return -EACCES; +#else + return -EOPNOTSUPP; +#endif +} + +static const struct bpf_func_proto bpf_tcp_raw_check_syncookie_proto = { + .func = bpf_tcp_raw_check_syncookie, + .gpl_only = true, /* __cookie_v*_check is GPL */ + .pkt_access = true, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_MEM, + .arg2_type = ARG_CONST_SIZE, + .arg3_type = ARG_PTR_TO_MEM, + .arg4_type = ARG_CONST_SIZE, +}; + #endif /* CONFIG_INET */ bool bpf_helper_changes_pkt_data(void *func) @@ -7703,6 +7821,10 @@ xdp_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_FUNC_ct_release: return &bpf_ct_release_proto; #endif + case BPF_FUNC_tcp_raw_gen_syncookie: + return &bpf_tcp_raw_gen_syncookie_proto; + case BPF_FUNC_tcp_raw_check_syncookie: + return &bpf_tcp_raw_check_syncookie_proto; #endif default: return bpf_sk_base_func_proto(func_id); diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 246ab7b5e857..659af6cc7d8c 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3961,7 +3961,7 @@ static bool smc_parse_options(const struct tcphdr *th, /* Try to parse the MSS option from the TCP header. Return 0 on failure, clamped * value on success. */ -static u16 tcp_parse_mss_option(const struct tcphdr *th, u16 user_mss) +u16 tcp_parse_mss_option(const struct tcphdr *th, u16 user_mss) { const unsigned char *ptr = (const unsigned char *)(th + 1); int length = (th->doff * 4) - sizeof(struct tcphdr); @@ -4000,6 +4000,7 @@ static u16 tcp_parse_mss_option(const struct tcphdr *th, u16 user_mss) } return mss; } +EXPORT_SYMBOL_GPL(tcp_parse_mss_option); /* Look for tcp options. Normally only called on SYN and SYNACK packets. * But, this can also be called on packets in the established flow when diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 883de3f1bb8b..e32f72077250 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -4998,6 +4998,61 @@ union bpf_attr { * pointer that was returned from **bpf_ct_lookup_xxx**\ (). * Return * 0 on success, or a negative error in case of failure. + * + * s64 bpf_tcp_raw_gen_syncookie(void *iph, u32 iph_len, struct tcphdr *th, u32 th_len) + * Description + * Try to issue a SYN cookie for the packet with corresponding + * IP/TCP headers, *iph* and *th*, without depending on a listening + * socket. + * + * *iph* points to the start of the IPv4 or IPv6 header, while + * *iph_len* contains **sizeof**\ (**struct iphdr**) or + * **sizeof**\ (**struct ip6hdr**). + * + * *th* points to the start of the TCP header, while *th_len* + * contains the length of the TCP header (at least + * **sizeof**\ (**struct tcphdr**)). + * Return + * On success, lower 32 bits hold the generated SYN cookie in + * followed by 16 bits which hold the MSS value for that cookie, + * and the top 16 bits are unused. + * + * On failure, the returned value is one of the following: + * + * **-EINVAL** if the packet or input arguments are invalid. + * + * **-EOPNOTSUPP** if the kernel configuration does not enable SYN + * cookies (CONFIG_SYN_COOKIES is off). + * + * **-EPROTONOSUPPORT** if the IP version is not 4 or 6 (or 6, but + * CONFIG_IPV6 is disabled). + * + * int bpf_tcp_raw_check_syncookie(void *iph, u32 iph_len, struct tcphdr *th, u32 th_len) + * Description + * Check whether *iph* and *th* contain a valid SYN cookie ACK + * without depending on a listening socket. + * + * *iph* points to the start of the IPv4 or IPv6 header, while + * *iph_len* contains **sizeof**\ (**struct iphdr**) or + * **sizeof**\ (**struct ip6hdr**). + * + * *th* points to the start of the TCP header, while *th_len* + * contains the length of the TCP header (at least + * **sizeof**\ (**struct tcphdr**)). + * Return + * 0 if *iph* and *th* are a valid SYN cookie ACK. + * + * On failure, the returned value is one of the following: + * + * **-EACCES** if the SYN cookie is not valid. + * + * **-EINVAL** if the packet or input arguments are invalid. + * + * **-EOPNOTSUPP** if the kernel configuration does not enable SYN + * cookies (CONFIG_SYN_COOKIES is off). + * + * **-EPROTONOSUPPORT** if the IP version is not 4 or 6 (or 6, but + * CONFIG_IPV6 is disabled). */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -5181,6 +5236,8 @@ union bpf_attr { FN(ct_lookup_tcp), \ FN(ct_lookup_udp), \ FN(ct_release), \ + FN(tcp_raw_gen_syncookie), \ + FN(tcp_raw_check_syncookie), \ /* */ /* integer value in 'imm' field of BPF_CALL instruction selects which helper From patchwork Tue Oct 19 14:46:54 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Mikityanskiy X-Patchwork-Id: 12570165 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1D1B5C4332F for ; Tue, 19 Oct 2021 14:49:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 024676113B for ; Tue, 19 Oct 2021 14:49:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231921AbhJSOvZ (ORCPT ); Tue, 19 Oct 2021 10:51:25 -0400 Received: from mail-dm6nam08on2071.outbound.protection.outlook.com ([40.107.102.71]:12642 "EHLO NAM04-DM6-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S232116AbhJSOvX (ORCPT ); Tue, 19 Oct 2021 10:51:23 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=LXtTxP1on4jWtDaLl01gttX1LSGswhzZgf9pqnYj61Rec3BYOd6Pq0FDqeC0m5jCPhIpxytzf6v3yv/2oSQYQbykyri0YripxwQlPH2EwCJOl4rTbdCXHi8mGSJzbISuyJ6ldrsghLJJPtJ7tTylKXd8OR1ptJwQ+vsKUwfB2dY/sfIiiDBXxChJM8PBXRmJvYGr9+BXZrGDuwHNG3mC/mw12kTJVagwdH2G18WdHaa+JuDk85ZUSgUmKd6itM3UzGkuH2G0LjDVIHz/Z8To+yRiUuWr3r5FjiFtwhjq6VURHYGi6QpkkEYbegUGy1xWq8dy1xpBxDu0Xd6t5N+ZsA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=nnYsQpFbbU9w72FPBcPIOhXIc+/fmO4PsWHDublhcrQ=; b=X2km8BSqekc6WgS+ahOXKg+NQQrk69fNBz7xMgAFckogSlrB9ccQE382Fpjm15570rN4IHVVMZSnqR/zpcrVSIuK5SHNirzF6hba/1UuzkrFbR7/Mf89wHo0QbmNeQCZ2TaOlISc2zkIkN8VLqqwBQl083RpiQoTdIVhsT0bZRShWiJ7/sEdJM1v85FB38bJF9HW68TEeAlSJLqrA7kNnDohUtwLP3js4552x5elZKiCZepNnJ6rxVkmoogXnN4ted+VNKAQswe1p4EJPOeE1MTzXpUftBDHFareu+QtI1e0VxeBPQC12vPLkjEkyTM+IkiWOyAOU4vzWLNVTjV/2Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.36) smtp.rcpttodomain=google.com smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=nnYsQpFbbU9w72FPBcPIOhXIc+/fmO4PsWHDublhcrQ=; b=AWGL2rsxXyxdgvgjIAJXvbIBn6Mz4JBANN9gMr84HBjlzoJ1iGaFzVESgJdnZV+bGBrkGuUrh1fU+VxxMIKTxCbqUJ5LpwCSpp3XpnHdrgRtUEgvrX2/sil2OJhGCVblsDEiYynn5HfsDhWHsor2L7sgI22Vr0RjKpVKCQNkUQQ3vFasmUCX7e0iOO5a3+0H5X89U7C9z73M9/NzZNoyC+gBM+A48f9RMD9P0KGZxWs2u27Z4dxx7ghrBfxIfCbJngmTElnhCtSW25AuysstTK8TMrq6tWAQjPG0KSGyOaw3ccBEi+ibYZLZ3uza32b8rQX9OtM9y361g+SR1be45g== Received: from MWHPR20CA0037.namprd20.prod.outlook.com (2603:10b6:300:ed::23) by DM6PR12MB3449.namprd12.prod.outlook.com (2603:10b6:5:3b::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.18; Tue, 19 Oct 2021 14:49:09 +0000 Received: from CO1NAM11FT019.eop-nam11.prod.protection.outlook.com (2603:10b6:300:ed:cafe::2e) by MWHPR20CA0037.outlook.office365.com (2603:10b6:300:ed::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:49:08 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.36) smtp.mailfrom=nvidia.com; google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.36 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.36; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.36) by CO1NAM11FT019.mail.protection.outlook.com (10.13.175.57) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:49:08 +0000 Received: from HQMAIL107.nvidia.com (172.20.187.13) by HQMAIL101.nvidia.com (172.20.187.10) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 14:49:03 +0000 Received: from vdi.nvidia.com (172.20.187.6) by mail.nvidia.com (172.20.187.13) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Tue, 19 Oct 2021 14:48:52 +0000 From: Maxim Mikityanskiy To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh CC: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Hideaki YOSHIFUJI , David Ahern , "Jesper Dangaard Brouer" , Nathan Chancellor , "Nick Desaulniers" , Brendan Jackman , Florent Revest , Joe Stringer , "Lorenz Bauer" , Tariq Toukan , , , , Maxim Mikityanskiy Subject: [PATCH bpf-next 09/10] bpf: Add a helper to issue timestamp cookies in XDP Date: Tue, 19 Oct 2021 17:46:54 +0300 Message-ID: <20211019144655.3483197-10-maximmi@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211019144655.3483197-1-maximmi@nvidia.com> References: <20211019144655.3483197-1-maximmi@nvidia.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ab28417b-d125-472e-eb62-08d9930f9b1e X-MS-TrafficTypeDiagnostic: DM6PR12MB3449: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: his0TTJTrh2Hvzr8+YQCtjPYLkTAwuM/MNmgUYXivdiNlyl24n9NQ8nrqiD3aWAl5pEj1tKSjVpALqZtQ9BjU2Vr1LCutoi65VWlyVSDSbVGlscKWqoA04PrCqjUaVU9bBUkHfY4mhVOSpoeGF0vWIxfZ49ie1/DDJkVa3mJRTVDOaviMaJb/aAKOmjaHaAq2zi1kPrPieKVAvq6GNzespZnaKCe/HCqU6nmf/cD3dLvsTOoQCY57Qs8CEZwb5AXsz881UCt0RXI3pr+yd/61EIUqYh2hN5/sfa5RHkDTQlVdDfBlJgyKmlQHzyg7azBcNC9VEBZS2StSYoaJDSF0nmMz32AfjeJ0YwN1dQoXs9WvueYtf2RrpZ9PweNDSzczQn/kVvej7iz7Q7G4QZvECV6VQ7fZbJjNGSJjr2MVSeghE54U2/tXlVP6oHOJNUUFtOUIubh6o+6pg2N2C2nsbEG0qsQWsTDIuOC7JrIDPnn+06D86247Sw7J9B3gR5/cpySgUl2p2RrPDpwPwvUiV4TLfPzWCEgRykqGwe7e9fv9zBWGFR8kC5jfGqtzflylDrVkq5z+y24J/Bmop5TrwCEpjJODbM54F1xlrAlFFM3A5kIqmFS0qKkEtreb9wZlZAUA09CR7sDSdTdnQ1ZUlrMyzzzpXONBAzic7cQNgaOO++TQqi0WlrKpen8Nf6T0ozcWBTX/f0v3CkdhPpv4A== X-Forefront-Antispam-Report: CIP:216.228.112.36;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:schybrid05.nvidia.com;CAT:NONE;SFS:(4636009)(36840700001)(46966006)(7636003)(356005)(7416002)(36756003)(7696005)(54906003)(82310400003)(5660300002)(4326008)(186003)(36906005)(107886003)(110136005)(36860700001)(70206006)(70586007)(336012)(8936002)(426003)(2906002)(83380400001)(508600001)(86362001)(1076003)(2616005)(8676002)(316002)(26005)(47076005);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 14:49:08.0616 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ab28417b-d125-472e-eb62-08d9930f9b1e X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.36];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT019.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB3449 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net The new helper bpf_tcp_raw_gen_tscookie allows an XDP program to generate timestamp cookies (to be used together with SYN cookies) which encode different options set by the client in the SYN packet: SACK support, ECN support, window scale. These options are encoded in lower bits of the timestamp, which will be returned by the client in a subsequent ACK packet. The format is the same used by synproxy. Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan --- include/net/tcp.h | 1 + include/uapi/linux/bpf.h | 27 +++++++++++++++ net/core/filter.c | 38 +++++++++++++++++++++ net/ipv4/syncookies.c | 60 ++++++++++++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 27 +++++++++++++++ 5 files changed, 153 insertions(+) diff --git a/include/net/tcp.h b/include/net/tcp.h index 1cc96a225848..651820bef6a2 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -564,6 +564,7 @@ u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th, u16 *mssp); __u32 cookie_v4_init_sequence(const struct sk_buff *skb, __u16 *mss); u64 cookie_init_timestamp(struct request_sock *req, u64 now); +bool cookie_init_timestamp_raw(struct tcphdr *th, __be32 *tsval, __be32 *tsecr); bool cookie_timestamp_decode(const struct net *net, struct tcp_options_received *opt); bool cookie_ecn_ok(const struct tcp_options_received *opt, diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index e32f72077250..791790b41874 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -5053,6 +5053,32 @@ union bpf_attr { * * **-EPROTONOSUPPORT** if the IP version is not 4 or 6 (or 6, but * CONFIG_IPV6 is disabled). + * + * int bpf_tcp_raw_gen_tscookie(struct tcphdr *th, u32 th_len, __be32 *tsopt, u32 tsopt_len) + * Description + * Try to generate a timestamp cookie which encodes some of the + * flags sent by the client in the SYN packet: SACK support, ECN + * support, window scale. To be used with SYN cookies. + * + * *th* points to the start of the TCP header of the client's SYN + * packet, while *th_len* contains the length of the TCP header (at + * least **sizeof**\ (**struct tcphdr**)). + * + * *tsopt* points to the output location where to put the resulting + * timestamp values: tsval and tsecr, in the format of the TCP + * timestamp option. + * + * Return + * On success, 0. + * + * On failure, the returned value is one of the following: + * + * **-EINVAL** if the input arguments are invalid. + * + * **-ENOENT** if the TCP header doesn't have the timestamp option. + * + * **-EOPNOTSUPP** if the kernel configuration does not enable SYN + * cookies (CONFIG_SYN_COOKIES is off). */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -5238,6 +5264,7 @@ union bpf_attr { FN(ct_release), \ FN(tcp_raw_gen_syncookie), \ FN(tcp_raw_check_syncookie), \ + FN(tcp_raw_gen_tscookie), \ /* */ /* integer value in 'imm' field of BPF_CALL instruction selects which helper diff --git a/net/core/filter.c b/net/core/filter.c index 5f03d4a282a0..73fe20ef7442 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7403,6 +7403,42 @@ static const struct bpf_func_proto bpf_tcp_raw_check_syncookie_proto = { .arg4_type = ARG_CONST_SIZE, }; +BPF_CALL_4(bpf_tcp_raw_gen_tscookie, struct tcphdr *, th, u32, th_len, + __be32 *, tsopt, u32, tsopt_len) +{ + int err; + +#ifdef CONFIG_SYN_COOKIES + if (tsopt_len != sizeof(u64)) { + err = -EINVAL; + goto err_out; + } + + if (!cookie_init_timestamp_raw(th, &tsopt[0], &tsopt[1])) { + err = -ENOENT; + goto err_out; + } + + return 0; +err_out: +#else + err = -EOPNOTSUPP; +#endif + memset(tsopt, 0, tsopt_len); + return err; +} + +static const struct bpf_func_proto bpf_tcp_raw_gen_tscookie_proto = { + .func = bpf_tcp_raw_gen_tscookie, + .gpl_only = false, + .pkt_access = true, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_MEM, + .arg2_type = ARG_CONST_SIZE, + .arg3_type = ARG_PTR_TO_UNINIT_MEM, + .arg4_type = ARG_CONST_SIZE, +}; + #endif /* CONFIG_INET */ bool bpf_helper_changes_pkt_data(void *func) @@ -7825,6 +7861,8 @@ xdp_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) return &bpf_tcp_raw_gen_syncookie_proto; case BPF_FUNC_tcp_raw_check_syncookie: return &bpf_tcp_raw_check_syncookie_proto; + case BPF_FUNC_tcp_raw_gen_tscookie: + return &bpf_tcp_raw_gen_tscookie_proto; #endif default: return bpf_sk_base_func_proto(func_id); diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c index 8696dc343ad2..4dd2c7a096eb 100644 --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c @@ -85,6 +85,66 @@ u64 cookie_init_timestamp(struct request_sock *req, u64 now) return (u64)ts * (NSEC_PER_SEC / TCP_TS_HZ); } +bool cookie_init_timestamp_raw(struct tcphdr *th, __be32 *tsval, __be32 *tsecr) +{ + int length = (th->doff * 4) - sizeof(*th); + u8 wscale = TS_OPT_WSCALE_MASK; + bool option_timestamp = false; + bool option_sack = false; + u32 cookie; + u8 *ptr; + + ptr = (u8 *)(th + 1); + + while (length > 0) { + u8 opcode = *ptr++; + u8 opsize; + + if (opcode == TCPOPT_EOL) + break; + if (opcode == TCPOPT_NOP) { + length--; + continue; + } + + if (length < 2) + break; + opsize = *ptr++; + if (opsize < 2) + break; + if (opsize > length) + break; + + switch (opcode) { + case TCPOPT_WINDOW: + wscale = min_t(u8, *ptr, TCP_MAX_WSCALE); + break; + case TCPOPT_TIMESTAMP: + option_timestamp = true; + /* Client's tsval becomes our tsecr. */ + *tsecr = cpu_to_be32(get_unaligned_be32(ptr)); + break; + case TCPOPT_SACK_PERM: + option_sack = true; + break; + } + + ptr += opsize - 2; + length -= opsize; + } + + if (!option_timestamp) + return false; + + cookie = tcp_time_stamp_raw() & ~TSMASK; + cookie |= wscale & TS_OPT_WSCALE_MASK; + if (option_sack) + cookie |= TS_OPT_SACK; + if (th->ece && th->cwr) + cookie |= TS_OPT_ECN; + *tsval = cpu_to_be32(cookie); + return true; +} static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport, __u32 sseq, __u32 data) diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index e32f72077250..791790b41874 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -5053,6 +5053,32 @@ union bpf_attr { * * **-EPROTONOSUPPORT** if the IP version is not 4 or 6 (or 6, but * CONFIG_IPV6 is disabled). + * + * int bpf_tcp_raw_gen_tscookie(struct tcphdr *th, u32 th_len, __be32 *tsopt, u32 tsopt_len) + * Description + * Try to generate a timestamp cookie which encodes some of the + * flags sent by the client in the SYN packet: SACK support, ECN + * support, window scale. To be used with SYN cookies. + * + * *th* points to the start of the TCP header of the client's SYN + * packet, while *th_len* contains the length of the TCP header (at + * least **sizeof**\ (**struct tcphdr**)). + * + * *tsopt* points to the output location where to put the resulting + * timestamp values: tsval and tsecr, in the format of the TCP + * timestamp option. + * + * Return + * On success, 0. + * + * On failure, the returned value is one of the following: + * + * **-EINVAL** if the input arguments are invalid. + * + * **-ENOENT** if the TCP header doesn't have the timestamp option. + * + * **-EOPNOTSUPP** if the kernel configuration does not enable SYN + * cookies (CONFIG_SYN_COOKIES is off). */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -5238,6 +5264,7 @@ union bpf_attr { FN(ct_release), \ FN(tcp_raw_gen_syncookie), \ FN(tcp_raw_check_syncookie), \ + FN(tcp_raw_gen_tscookie), \ /* */ /* integer value in 'imm' field of BPF_CALL instruction selects which helper From patchwork Tue Oct 19 14:46:55 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Mikityanskiy X-Patchwork-Id: 12570167 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7672DC433F5 for ; Tue, 19 Oct 2021 14:49:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5D9BC6128B for ; Tue, 19 Oct 2021 14:49:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232910AbhJSOvh (ORCPT ); Tue, 19 Oct 2021 10:51:37 -0400 Received: from mail-dm3nam07on2058.outbound.protection.outlook.com ([40.107.95.58]:41185 "EHLO NAM02-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S232083AbhJSOve (ORCPT ); Tue, 19 Oct 2021 10:51:34 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cH+Wy6KilA17Q48TJxJ9jnqf2nezTEledmQXQDr8MvTtsbed95MIP70MdRw0sXQGYDPTrpkNEhW+/+Db4Lr4NrU33a1VeOLeMQaIJSQOOQN07z3F9QjijJhLeIBJCyLXAbPRM5ZVaorSRMUQoaqEsjhd0M58v7wUw3czambVn1Ir609eJQaGuX+vXjh+7plSl0VKiqPQLxxlupt9wuCIHRcb61MA9gnCUse0JfH4UnSBU8KUO3xh6TQOjN9x7xl4S9fomPgPBaYEIFb3BuSU6uJBBKDJv2dzES4PB2gTSR0Q8bv6YUNE15rRFDOisBAhEMUyS0oXB+FGf96FZ/zleQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=uo2MfpkL9FH9uFS+cZvNfuJQN29/AiFpT59htLADEnI=; b=j5lhgl/wD5BWaqoO/3gR7XW67K6RnSjsIElpWvPPCxRsvVLAYVHXQsM5YZoahQOEmSewj6uT60S5Ig0PY+wS2cVbFEqSeuNU/RpWxdNT++VzV4laSo0RLP7YmQRP6iQYLNB11uSqdUH3Onuq0UtCSu0DfCId5+/3TpiyeKm2I6Rct5SFw2WMKTVszs/XO5hpC2IXVfOwqVN4KQeujad7VL11ziFCpUN8kZkl33Lw76CUfH32308sSBX1UdKH5FZzdsZkgUwlX2BJwqWm6Nmvs3pPBNuon4MhI3G4eBQZ1kJ1AEvBVlctZcg3dnwCaVOv4YBRKmI17R7EDjOGo6BCCg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.36) smtp.rcpttodomain=google.com smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uo2MfpkL9FH9uFS+cZvNfuJQN29/AiFpT59htLADEnI=; b=Bkzx7y6ISteSQ6L6GgGXi/6uW4O15yi53gJtG+TRlOh0Sg8Mf9sR/Wm9GlyeYhJxLjiER8DLdtm3lEixKgAzhVZWQw9NJD3QtHfcHGuDmK6YazmbKkNfb8h0tsy5855b3NuayAfrYgPsb/MYUarkWWtzaP8naz9sP3CNVp4BAzMGocRZzNCVhHZnsuwfk6Zy1b749Iy2dP0Sw4NLcMUjYJ0YSYkQs60Sbf73SGw3ZDzJf0gQfg7Mdn/IAPr9Qi7r985OwYuAO/ATj4gfumxArbuSCrx5kRx9uKuUCpEEcM5f/N9lh3godslLhmUdXXr6SEYo9gzmiS9cWyE9hY3L5A== Received: from CO2PR05CA0100.namprd05.prod.outlook.com (2603:10b6:104:1::26) by CY4PR12MB1671.namprd12.prod.outlook.com (2603:10b6:910:c::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4608.17; Tue, 19 Oct 2021 14:49:19 +0000 Received: from CO1NAM11FT050.eop-nam11.prod.protection.outlook.com (2603:10b6:104:1:cafe::f4) by CO2PR05CA0100.outlook.office365.com (2603:10b6:104:1::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4628.8 via Frontend Transport; Tue, 19 Oct 2021 14:49:18 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.36) smtp.mailfrom=nvidia.com; google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.36 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.36; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.36) by CO1NAM11FT050.mail.protection.outlook.com (10.13.174.79) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4608.15 via Frontend Transport; Tue, 19 Oct 2021 14:49:18 +0000 Received: from HQMAIL107.nvidia.com (172.20.187.13) by HQMAIL101.nvidia.com (172.20.187.10) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Tue, 19 Oct 2021 14:49:17 +0000 Received: from vdi.nvidia.com (172.20.187.6) by mail.nvidia.com (172.20.187.13) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Tue, 19 Oct 2021 14:49:05 +0000 From: Maxim Mikityanskiy To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh CC: Eric Dumazet , "David S. Miller" , Jakub Kicinski , Hideaki YOSHIFUJI , David Ahern , "Jesper Dangaard Brouer" , Nathan Chancellor , "Nick Desaulniers" , Brendan Jackman , Florent Revest , Joe Stringer , "Lorenz Bauer" , Tariq Toukan , , , , Maxim Mikityanskiy Subject: [PATCH bpf-next 10/10] bpf: Add sample for raw syncookie helpers Date: Tue, 19 Oct 2021 17:46:55 +0300 Message-ID: <20211019144655.3483197-11-maximmi@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211019144655.3483197-1-maximmi@nvidia.com> References: <20211019144655.3483197-1-maximmi@nvidia.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 084375a6-913c-4fe2-d922-08d9930fa142 X-MS-TrafficTypeDiagnostic: CY4PR12MB1671: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:127; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: sRUvwRbcRXlQ7dqU0aYZicaOatu1sOXDrvD5qCdBzbWyFtZ/QmtM5wA08X7KhbIprJNnnbz/52Q+mspS061H1MJvOdmKe/+ES3g+8slkvWZajfPT+Lg9neaFQaQ8HmqpAir5v4cRM83gs/zXCU5ee77N6infsTcxbzfl6M4NMI7oVRRHSHPEZvAPBmqAyQvSYlhmc56+MTMtO/xhdVDsmrwPhP7g0Wmxxr+Ny8j+OEfY1LXM0V4oxRQ/3VTf6rPUEEpXhLBAkI6zJYcEoB4BZ9bNmur4Z4+SRFs17/SH6VJPXL2EHCBXut3/o4XK4gZAMwE5FtXJpr6lIIP9gsPeoA7m0R04nYtA6yw9XQ8j8Ls1kOu6EzX+953hJTlUUQT2r2761Cczp2QaZnl7o4bLKLP8WlmWgVhJrvpZ2pKwwd/6SqNM1imkCtnxs0J7oAtD0sXzrB01+TNMtonVtJ6NTAnHIWk6+WVvjwmMrRT0VCH4/zx3HgKTloai+JhsSTiKtHm3dxvtdosu9C+UqD3YjE3YTfV5Wd3GU8aqDfgw78+rP9yP+EyFvhdNCK7JERtTQrV08ub5yfs7+gOzgcdPZSqBkVRXpNzGovo7Lt2GxVTYzmrZvhxrRI5g5XWPw8GWo8XdxRAayLI62x43P/9/7FjZaby3qLUYDdQV6v+hB39A6ArO/9FBPEzu8in9ACG33fQI/Ntw81XnDdoFw02XV0ciunMTsEXSnqI2JRczVrn5lC9pi32BbGuhSWycSK5R7JYnfou877KcfopGhN+PKR7cR3H79JpVT6Jbtnt1aNBaXXbsLC7sg2pllMGPrHna X-Forefront-Antispam-Report: CIP:216.228.112.36;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:schybrid05.nvidia.com;CAT:NONE;SFS:(6019001)(4636009)(46966006)(36840700001)(26005)(7696005)(356005)(82310400003)(107886003)(30864003)(83380400001)(70586007)(1076003)(186003)(70206006)(2616005)(36756003)(7416002)(86362001)(6666004)(4326008)(47076005)(508600001)(316002)(36906005)(8676002)(110136005)(54906003)(7636003)(2906002)(36860700001)(336012)(426003)(5660300002)(8936002)(21314003);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 14:49:18.7601 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 084375a6-913c-4fe2-d922-08d9930fa142 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.36];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT050.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR12MB1671 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net This commit adds a sample for the new BPF helpers: bpf_ct_lookup_tcp, bpf_tcp_raw_gen_syncookie and bpf_tcp_raw_check_syncookie. samples/bpf/syncookie_kern.c is a BPF program that generates SYN cookies on allowed TCP ports and sends SYNACKs to clients, accelerating synproxy iptables module. samples/bpf/syncookie_user.c is a userspace control application that allows to configure the following options in runtime: list of allowed ports, MSS, window scale, TTL. samples/bpf/syncookie_test.sh is a script that demonstrates the setup of synproxy with XDP acceleration. Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan --- samples/bpf/.gitignore | 1 + samples/bpf/Makefile | 3 + samples/bpf/syncookie_kern.c | 591 ++++++++++++++++++++++++++++++++++ samples/bpf/syncookie_test.sh | 55 ++++ samples/bpf/syncookie_user.c | 388 ++++++++++++++++++++++ 5 files changed, 1038 insertions(+) create mode 100644 samples/bpf/syncookie_kern.c create mode 100755 samples/bpf/syncookie_test.sh create mode 100644 samples/bpf/syncookie_user.c diff --git a/samples/bpf/.gitignore b/samples/bpf/.gitignore index 0e7bfdbff80a..6b74e835d323 100644 --- a/samples/bpf/.gitignore +++ b/samples/bpf/.gitignore @@ -61,3 +61,4 @@ iperf.* /vmlinux.h /bpftool/ /libbpf/ +syncookie diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile index 4c5ad15f8d28..59d90c76bfea 100644 --- a/samples/bpf/Makefile +++ b/samples/bpf/Makefile @@ -53,6 +53,7 @@ tprogs-y += task_fd_query tprogs-y += xdp_sample_pkts tprogs-y += ibumad tprogs-y += hbm +tprogs-y += syncookie tprogs-y += xdp_redirect_cpu tprogs-y += xdp_redirect_map_multi @@ -118,6 +119,7 @@ task_fd_query-objs := task_fd_query_user.o $(TRACE_HELPERS) xdp_sample_pkts-objs := xdp_sample_pkts_user.o ibumad-objs := ibumad_user.o hbm-objs := hbm.o $(CGROUP_HELPERS) +syncookie-objs := syncookie_user.o xdp_redirect_map_multi-objs := xdp_redirect_map_multi_user.o $(XDP_SAMPLE) xdp_redirect_cpu-objs := xdp_redirect_cpu_user.o $(XDP_SAMPLE) @@ -181,6 +183,7 @@ always-y += ibumad_kern.o always-y += hbm_out_kern.o always-y += hbm_edt_kern.o always-y += xdpsock_kern.o +always-y += syncookie_kern.o ifeq ($(ARCH), arm) # Strip all except -D__LINUX_ARM_ARCH__ option needed to handle linux diff --git a/samples/bpf/syncookie_kern.c b/samples/bpf/syncookie_kern.c new file mode 100644 index 000000000000..b581ae30b650 --- /dev/null +++ b/samples/bpf/syncookie_kern.c @@ -0,0 +1,591 @@ +// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB +/* Copyright (c) 2021, NVIDIA CORPORATION & AFFILIATES. All rights reserved. */ + +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include + +#define DEFAULT_MSS4 1460 +#define DEFAULT_MSS6 1440 +#define DEFAULT_WSCALE 7 +#define DEFAULT_TTL 64 +#define MAX_ALLOWED_PORTS 8 + +struct bpf_map_def SEC("maps") values = { + .type = BPF_MAP_TYPE_ARRAY, + .key_size = sizeof(__u32), + .value_size = sizeof(__u64), + .max_entries = 2, +}; + +struct bpf_map_def SEC("maps") allowed_ports = { + .type = BPF_MAP_TYPE_ARRAY, + .key_size = sizeof(__u32), + .value_size = sizeof(__u16), + .max_entries = MAX_ALLOWED_PORTS, +}; + +#define IP_DF 0x4000 +#define IP_MF 0x2000 +#define IP_OFFSET 0x1fff + +#define NEXTHDR_TCP 6 + +#define TCPOPT_NOP 1 +#define TCPOPT_EOL 0 +#define TCPOPT_MSS 2 +#define TCPOPT_WINDOW 3 +#define TCPOPT_SACK_PERM 4 +#define TCPOPT_TIMESTAMP 8 + +#define TCPOLEN_MSS 4 +#define TCPOLEN_WINDOW 3 +#define TCPOLEN_SACK_PERM 2 +#define TCPOLEN_TIMESTAMP 10 + +#define IPV4_MAXLEN 60 +#define TCP_MAXLEN 60 + +static __always_inline void swap_eth_addr(__u8 *a, __u8 *b) +{ + __u8 tmp[ETH_ALEN]; + + __builtin_memcpy(tmp, a, ETH_ALEN); + __builtin_memcpy(a, b, ETH_ALEN); + __builtin_memcpy(b, tmp, ETH_ALEN); +} + +static __always_inline __u16 csum_fold(__u32 csum) +{ + csum = (csum & 0xffff) + (csum >> 16); + csum = (csum & 0xffff) + (csum >> 16); + return (__u16)~csum; +} + +static __always_inline __u16 csum_tcpudp_magic(__be32 saddr, __be32 daddr, + __u32 len, __u8 proto, + __u32 csum) +{ + __u64 s = csum; + + s += (__u32)saddr; + s += (__u32)daddr; +#if defined(__BIG_ENDIAN__) + s += proto + len; +#elif defined(__LITTLE_ENDIAN__) + s += (proto + len) << 8; +#else +#error Unknown endian +#endif + s = (s & 0xffffffff) + (s >> 32); + s = (s & 0xffffffff) + (s >> 32); + + return csum_fold((__u32)s); +} + +static __always_inline __u16 csum_ipv6_magic(const struct in6_addr *saddr, + const struct in6_addr *daddr, + __u32 len, __u8 proto, __u32 csum) +{ + __u64 sum = csum; + int i; + +#pragma unroll + for (i = 0; i < 4; i++) + sum += (__u32)saddr->s6_addr32[i]; + +#pragma unroll + for (i = 0; i < 4; i++) + sum += (__u32)daddr->s6_addr32[i]; + + // Don't combine additions to avoid 32-bit overflow. + sum += bpf_htonl(len); + sum += bpf_htonl(proto); + + sum = (sum & 0xffffffff) + (sum >> 32); + sum = (sum & 0xffffffff) + (sum >> 32); + + return csum_fold((__u32)sum); +} + +static __always_inline void values_get_tcpipopts(__u16 *mss, __u8 *wscale, + __u8 *ttl, bool ipv6) +{ + __u32 key = 0; + __u64 *value; + + value = bpf_map_lookup_elem(&values, &key); + if (value && *value != 0) { + if (ipv6) + *mss = (*value >> 32) & 0xffff; + else + *mss = *value & 0xffff; + *wscale = (*value >> 16) & 0xf; + *ttl = (*value >> 24) & 0xff; + return; + } + + *mss = ipv6 ? DEFAULT_MSS6 : DEFAULT_MSS4; + *wscale = DEFAULT_WSCALE; + *ttl = DEFAULT_TTL; +} + +static __always_inline void values_inc_synacks(void) +{ + __u32 key = 1; + __u32 *value; + + value = bpf_map_lookup_elem(&values, &key); + if (value) + __sync_fetch_and_add(value, 1); +} + +static __always_inline bool check_port_allowed(__u16 port) +{ + __u32 i; + + for (i = 0; i < MAX_ALLOWED_PORTS; i++) { + __u32 key = i; + __u16 *value; + + value = bpf_map_lookup_elem(&allowed_ports, &key); + + if (!value) + break; + // 0 is a terminator value. Check it first to avoid matching on + // a forbidden port == 0 and returning true. + if (*value == 0) + break; + + if (*value == port) + return true; + } + + return false; +} + +struct header_pointers { + struct ethhdr *eth; + struct iphdr *ipv4; + struct ipv6hdr *ipv6; + struct tcphdr *tcp; + __u16 tcp_len; +}; + +static __always_inline int tcp_dissect(void *data, void *data_end, + struct header_pointers *hdr) +{ + hdr->eth = data; + if (hdr->eth + 1 > data_end) + return XDP_DROP; + + switch (bpf_ntohs(hdr->eth->h_proto)) { + case ETH_P_IP: + hdr->ipv6 = NULL; + + hdr->ipv4 = (void *)hdr->eth + sizeof(*hdr->eth); + if (hdr->ipv4 + 1 > data_end) + return XDP_DROP; + if (hdr->ipv4->ihl * 4 < sizeof(*hdr->ipv4)) + return XDP_DROP; + if (hdr->ipv4->version != 4) + return XDP_DROP; + + if (hdr->ipv4->protocol != IPPROTO_TCP) + return XDP_PASS; + + hdr->tcp = (void *)hdr->ipv4 + hdr->ipv4->ihl * 4; + break; + case ETH_P_IPV6: + hdr->ipv4 = NULL; + + hdr->ipv6 = (void *)hdr->eth + sizeof(*hdr->eth); + if (hdr->ipv6 + 1 > data_end) + return XDP_DROP; + if (hdr->ipv6->version != 6) + return XDP_DROP; + + // XXX: Extension headers are not supported and could circumvent + // XDP SYN flood protection. + if (hdr->ipv6->nexthdr != NEXTHDR_TCP) + return XDP_PASS; + + hdr->tcp = (void *)hdr->ipv6 + sizeof(*hdr->ipv6); + break; + default: + // XXX: VLANs will circumvent XDP SYN flood protection. + return XDP_PASS; + } + + if (hdr->tcp + 1 > data_end) + return XDP_DROP; + hdr->tcp_len = hdr->tcp->doff * 4; + if (hdr->tcp_len < sizeof(*hdr->tcp)) + return XDP_DROP; + + return XDP_TX; +} + +static __always_inline __u8 tcp_mkoptions(__be32 *buf, __be32 *tsopt, __u16 mss, + __u8 wscale) +{ + __be32 *start = buf; + + *buf++ = bpf_htonl((TCPOPT_MSS << 24) | (TCPOLEN_MSS << 16) | mss); + + if (!tsopt) + return buf - start; + + if (tsopt[0] & bpf_htonl(1 << 4)) + *buf++ = bpf_htonl((TCPOPT_SACK_PERM << 24) | + (TCPOLEN_SACK_PERM << 16) | + (TCPOPT_TIMESTAMP << 8) | + TCPOLEN_TIMESTAMP); + else + *buf++ = bpf_htonl((TCPOPT_NOP << 24) | + (TCPOPT_NOP << 16) | + (TCPOPT_TIMESTAMP << 8) | + TCPOLEN_TIMESTAMP); + *buf++ = tsopt[0]; + *buf++ = tsopt[1]; + + if ((tsopt[0] & bpf_htonl(0xf)) != bpf_htonl(0xf)) + *buf++ = bpf_htonl((TCPOPT_NOP << 24) | + (TCPOPT_WINDOW << 16) | + (TCPOLEN_WINDOW << 8) | + wscale); + + return buf - start; +} + +static __always_inline void tcp_gen_synack(struct tcphdr *tcp_header, + __u32 cookie, __be32 *tsopt, + __u16 mss, __u8 wscale) +{ + void *tcp_options; + + tcp_flag_word(tcp_header) = TCP_FLAG_SYN | TCP_FLAG_ACK; + if (tsopt && (tsopt[0] & bpf_htonl(1 << 5))) + tcp_flag_word(tcp_header) |= TCP_FLAG_ECE; + tcp_header->doff = 5; // doff is part of tcp_flag_word. + swap(tcp_header->source, tcp_header->dest); + tcp_header->ack_seq = bpf_htonl(bpf_ntohl(tcp_header->seq) + 1); + tcp_header->seq = bpf_htonl(cookie); + tcp_header->window = 0; + tcp_header->urg_ptr = 0; + tcp_header->check = 0; // Rely on hardware checksum offload. + + tcp_options = (void *)(tcp_header + 1); + tcp_header->doff += tcp_mkoptions(tcp_options, tsopt, mss, wscale); +} + +static __always_inline void tcpv4_gen_synack(struct header_pointers *hdr, + __u32 cookie, __be32 *tsopt) +{ + __u8 wscale; + __u16 mss; + __u8 ttl; + + values_get_tcpipopts(&mss, &wscale, &ttl, false); + + swap_eth_addr(hdr->eth->h_source, hdr->eth->h_dest); + + swap(hdr->ipv4->saddr, hdr->ipv4->daddr); + hdr->ipv4->check = 0; // Rely on hardware checksum offload. + hdr->ipv4->tos = 0; + hdr->ipv4->id = 0; + hdr->ipv4->ttl = ttl; + + tcp_gen_synack(hdr->tcp, cookie, tsopt, mss, wscale); + + hdr->tcp_len = hdr->tcp->doff * 4; + hdr->ipv4->tot_len = bpf_htons(sizeof(*hdr->ipv4) + hdr->tcp_len); +} + +static __always_inline void tcpv6_gen_synack(struct header_pointers *hdr, + __u32 cookie, __be32 *tsopt) +{ + __u8 wscale; + __u16 mss; + __u8 ttl; + + values_get_tcpipopts(&mss, &wscale, &ttl, true); + + swap_eth_addr(hdr->eth->h_source, hdr->eth->h_dest); + + swap(hdr->ipv6->saddr, hdr->ipv6->daddr); + *(__be32 *)hdr->ipv6 = bpf_htonl(0x60000000); + hdr->ipv6->hop_limit = ttl; + + tcp_gen_synack(hdr->tcp, cookie, tsopt, mss, wscale); + + hdr->tcp_len = hdr->tcp->doff * 4; + hdr->ipv6->payload_len = bpf_htons(hdr->tcp_len); +} + +static __always_inline int syncookie_handle_syn(struct header_pointers *hdr, + struct xdp_md *ctx, + void *data, void *data_end) +{ + __u32 old_pkt_size, new_pkt_size; + // Unlike clang 10, clang 11 and 12 generate code that doesn't pass the + // BPF verifier if tsopt is not volatile. Volatile forces it to store + // the pointer value and use it directly, otherwise tcp_mkoptions is + // (mis)compiled like this: + // if (!tsopt) + // return buf - start; + // reg = stored_return_value_of_bpf_tcp_raw_gen_tscookie; + // if (reg == 0) + // tsopt = tsopt_buf; + // else + // tsopt = NULL; + // ... + // *buf++ = tsopt[1]; + // It creates a dead branch where tsopt is assigned NULL, but the + // verifier can't prove it's dead and blocks the program. + __be32 * volatile tsopt = NULL; + __be32 tsopt_buf[2]; + void *ip_header; + __u16 ip_len; + __u32 cookie; + __s64 value; + + if (hdr->ipv4) { + // Check the IPv4 and TCP checksums before creating a SYNACK. + value = bpf_csum_diff(0, 0, (void *)hdr->ipv4, hdr->ipv4->ihl * 4, 0); + if (value < 0) + return XDP_ABORTED; + if (csum_fold(value) != 0) + return XDP_DROP; // Bad IPv4 checksum. + + value = bpf_csum_diff(0, 0, (void *)hdr->tcp, hdr->tcp_len, 0); + if (value < 0) + return XDP_ABORTED; + if (csum_tcpudp_magic(hdr->ipv4->saddr, hdr->ipv4->daddr, + hdr->tcp_len, IPPROTO_TCP, value) != 0) + return XDP_DROP; // Bad TCP checksum. + + ip_header = hdr->ipv4; + ip_len = sizeof(*hdr->ipv4); + } else if (hdr->ipv6) { + // Check the TCP checksum before creating a SYNACK. + value = bpf_csum_diff(0, 0, (void *)hdr->tcp, hdr->tcp_len, 0); + if (value < 0) + return XDP_ABORTED; + if (csum_ipv6_magic(&hdr->ipv6->saddr, &hdr->ipv6->daddr, + hdr->tcp_len, IPPROTO_TCP, value) != 0) + return XDP_DROP; // Bad TCP checksum. + + ip_header = hdr->ipv6; + ip_len = sizeof(*hdr->ipv6); + } else { + return XDP_ABORTED; + } + + // Issue SYN cookies on allowed ports, drop SYN packets on + // blocked ports. + if (!check_port_allowed(bpf_ntohs(hdr->tcp->dest))) + return XDP_DROP; + + value = bpf_tcp_raw_gen_syncookie(ip_header, ip_len, + (void *)hdr->tcp, hdr->tcp_len); + if (value < 0) + return XDP_ABORTED; + cookie = (__u32)value; + + if (bpf_tcp_raw_gen_tscookie((void *)hdr->tcp, hdr->tcp_len, + tsopt_buf, sizeof(tsopt_buf)) == 0) + tsopt = tsopt_buf; + + // Check that there is enough space for a SYNACK. It also covers + // the check that the destination of the __builtin_memmove below + // doesn't overflow. + if (data + sizeof(*hdr->eth) + ip_len + TCP_MAXLEN > data_end) + return XDP_ABORTED; + + if (hdr->ipv4) { + if (hdr->ipv4->ihl * 4 > sizeof(*hdr->ipv4)) { + struct tcphdr *new_tcp_header; + + new_tcp_header = data + sizeof(*hdr->eth) + sizeof(*hdr->ipv4); + __builtin_memmove(new_tcp_header, hdr->tcp, sizeof(*hdr->tcp)); + hdr->tcp = new_tcp_header; + + hdr->ipv4->ihl = sizeof(*hdr->ipv4) / 4; + } + + tcpv4_gen_synack(hdr, cookie, tsopt); + } else if (hdr->ipv6) { + tcpv6_gen_synack(hdr, cookie, tsopt); + } else { + return XDP_ABORTED; + } + + // Recalculate checksums. + hdr->tcp->check = 0; + value = bpf_csum_diff(0, 0, (void *)hdr->tcp, hdr->tcp_len, 0); + if (value < 0) + return XDP_ABORTED; + if (hdr->ipv4) { + hdr->tcp->check = csum_tcpudp_magic(hdr->ipv4->saddr, + hdr->ipv4->daddr, + hdr->tcp_len, + IPPROTO_TCP, + value); + + hdr->ipv4->check = 0; + value = bpf_csum_diff(0, 0, (void *)hdr->ipv4, sizeof(*hdr->ipv4), 0); + if (value < 0) + return XDP_ABORTED; + hdr->ipv4->check = csum_fold(value); + } else if (hdr->ipv6) { + hdr->tcp->check = csum_ipv6_magic(&hdr->ipv6->saddr, + &hdr->ipv6->daddr, + hdr->tcp_len, + IPPROTO_TCP, + value); + } else { + return XDP_ABORTED; + } + + // Set the new packet size. + old_pkt_size = data_end - data; + new_pkt_size = sizeof(*hdr->eth) + ip_len + hdr->tcp->doff * 4; + if (bpf_xdp_adjust_tail(ctx, new_pkt_size - old_pkt_size)) + return XDP_ABORTED; + + values_inc_synacks(); + + return XDP_TX; +} + +static __always_inline int syncookie_handle_ack(struct header_pointers *hdr) +{ + int err; + + if (hdr->ipv4) + err = bpf_tcp_raw_check_syncookie(hdr->ipv4, sizeof(*hdr->ipv4), + (void *)hdr->tcp, hdr->tcp_len); + else if (hdr->ipv6) + err = bpf_tcp_raw_check_syncookie(hdr->ipv6, sizeof(*hdr->ipv6), + (void *)hdr->tcp, hdr->tcp_len); + else + return XDP_ABORTED; + if (err) + return XDP_DROP; + + return XDP_PASS; +} + +SEC("xdp/syncookie") +int syncookie_xdp(struct xdp_md *ctx) +{ + void *data_end = (void *)(long)ctx->data_end; + void *data = (void *)(long)ctx->data; + struct header_pointers hdr; + struct bpf_sock_tuple tup; + struct bpf_nf_conn *ct; + __u32 tup_size; + __s64 value; + int ret; + + ret = tcp_dissect(data, data_end, &hdr); + if (ret != XDP_TX) + return ret; + + if (hdr.ipv4) { + // TCP doesn't normally use fragments, and XDP can't reassemble them. + if ((hdr.ipv4->frag_off & bpf_htons(IP_DF | IP_MF | IP_OFFSET)) != bpf_htons(IP_DF)) + return XDP_DROP; + + tup.ipv4.saddr = hdr.ipv4->saddr; + tup.ipv4.daddr = hdr.ipv4->daddr; + tup.ipv4.sport = hdr.tcp->source; + tup.ipv4.dport = hdr.tcp->dest; + tup_size = sizeof(tup.ipv4); + } else if (hdr.ipv6) { + __builtin_memcpy(tup.ipv6.saddr, &hdr.ipv6->saddr, sizeof(tup.ipv6.saddr)); + __builtin_memcpy(tup.ipv6.daddr, &hdr.ipv6->daddr, sizeof(tup.ipv6.daddr)); + tup.ipv6.sport = hdr.tcp->source; + tup.ipv6.dport = hdr.tcp->dest; + tup_size = sizeof(tup.ipv6); + } else { + // The verifier can't track that either ipv4 or ipv6 is not NULL. + return XDP_ABORTED; + } + + value = 0; // Flags. + ct = bpf_ct_lookup_tcp(ctx, &tup, tup_size, BPF_F_CURRENT_NETNS, &value); + if (ct) { + unsigned long status = ct->status; + + bpf_ct_release(ct); + if (status & IPS_CONFIRMED_BIT) + return XDP_PASS; + } else if (value != -ENOENT) { + return XDP_ABORTED; + } + + // value == -ENOENT || !(status & IPS_CONFIRMED_BIT) + + if ((hdr.tcp->syn ^ hdr.tcp->ack) != 1) + return XDP_DROP; + + // Grow the TCP header to TCP_MAXLEN to be able to pass any hdr.tcp_len + // to bpf_tcp_raw_gen_syncookie and pass the verifier. + if (bpf_xdp_adjust_tail(ctx, TCP_MAXLEN - hdr.tcp_len)) + return XDP_ABORTED; + + data_end = (void *)(long)ctx->data_end; + data = (void *)(long)ctx->data; + + if (hdr.ipv4) { + hdr.eth = data; + hdr.ipv4 = (void *)hdr.eth + sizeof(*hdr.eth); + // IPV4_MAXLEN is needed when calculating checksum. + // At least sizeof(struct iphdr) is needed here to access ihl. + if ((void *)hdr.ipv4 + IPV4_MAXLEN > data_end) + return XDP_ABORTED; + hdr.tcp = (void *)hdr.ipv4 + hdr.ipv4->ihl * 4; + } else if (hdr.ipv6) { + hdr.eth = data; + hdr.ipv6 = (void *)hdr.eth + sizeof(*hdr.eth); + hdr.tcp = (void *)hdr.ipv6 + sizeof(*hdr.ipv6); + } else { + return XDP_ABORTED; + } + + if ((void *)hdr.tcp + TCP_MAXLEN > data_end) + return XDP_ABORTED; + + // We run out of registers, tcp_len gets spilled to the stack, and the + // verifier forgets its min and max values checked above in tcp_dissect. + hdr.tcp_len = hdr.tcp->doff * 4; + if (hdr.tcp_len < sizeof(*hdr.tcp)) + return XDP_ABORTED; + + return hdr.tcp->syn ? syncookie_handle_syn(&hdr, ctx, data, data_end) : + syncookie_handle_ack(&hdr); +} + +SEC("xdp/dummy") +int dummy_xdp(struct xdp_md *ctx) +{ + // veth requires XDP programs to be set on both sides. + return XDP_PASS; +} + +char _license[] SEC("license") = "GPL"; diff --git a/samples/bpf/syncookie_test.sh b/samples/bpf/syncookie_test.sh new file mode 100755 index 000000000000..923f94a7d6f6 --- /dev/null +++ b/samples/bpf/syncookie_test.sh @@ -0,0 +1,55 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB +# Copyright (c) 2021, NVIDIA CORPORATION & AFFILIATES. All rights reserved. + +set -e + +PORT=8080 + +DIR="$(dirname "$0")" +SERVER_PID= +MONITOR_PID= + +cleanup() { + set +e + [ -n "$SERVER_PID" ] && kill "$SERVER_PID" + [ -n "$MONITOR_PID" ] && kill "$MONITOR_PID" + ip link del tmp0 + ip netns del synproxy +} + +trap cleanup EXIT + +ip netns add synproxy +ip netns exec synproxy ip link set lo up +ip link add tmp0 type veth peer name tmp1 +sleep 1 # Wait, otherwise the IP address is not applied to tmp0. +ip link set tmp1 netns synproxy +ip link set tmp0 up +ip addr replace 198.18.0.1/24 dev tmp0 +ip netns exec synproxy ip link set tmp1 up +ip netns exec synproxy ip addr replace 198.18.0.2/24 dev tmp1 +ip netns exec synproxy sysctl -w net.ipv4.tcp_syncookies=2 +ip netns exec synproxy sysctl -w net.ipv4.tcp_timestamps=1 +ip netns exec synproxy sysctl -w net.netfilter.nf_conntrack_tcp_loose=0 +ip netns exec synproxy iptables -t raw -I PREROUTING \ + -i tmp1 -p tcp -m tcp --syn --dport "$PORT" -j CT --notrack +ip netns exec synproxy iptables -t filter -A INPUT \ + -i tmp1 -p tcp -m tcp --dport "$PORT" -m state --state INVALID,UNTRACKED \ + -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 +ip netns exec synproxy iptables -t filter -A INPUT \ + -i tmp1 -m state --state INVALID -j DROP +# When checksum offload is enabled, the XDP program sees wrong checksums and +# drops packets. +ethtool -K tmp0 tx off +# Workaround required for veth. +ip link set tmp0 xdp object "$DIR/syncookie_kern.o" section xdp/dummy +ip netns exec synproxy "$DIR/syncookie" --iface tmp1 --ports "$PORT" \ + --mss4 1460 --mss6 1440 --wscale 7 --ttl 64 & +MONITOR_PID="$!" +ip netns exec synproxy python3 -m http.server "$PORT" & +SERVER_PID="$!" +echo "Waiting a few seconds for the server to start..." +sleep 5 +wget 'http://198.18.0.2:8080/' -O /dev/null -o /dev/null +sleep 1 # Wait for stats to appear. diff --git a/samples/bpf/syncookie_user.c b/samples/bpf/syncookie_user.c new file mode 100644 index 000000000000..dcb074405691 --- /dev/null +++ b/samples/bpf/syncookie_user.c @@ -0,0 +1,388 @@ +// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB +/* Copyright (c) 2021, NVIDIA CORPORATION & AFFILIATES. All rights reserved. */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static unsigned int ifindex; +static __u32 attached_prog_id; + +static void noreturn cleanup(int sig) +{ + DECLARE_LIBBPF_OPTS(bpf_xdp_set_link_opts, opts); + int prog_fd; + int err; + + if (attached_prog_id == 0) + exit(0); + + prog_fd = bpf_prog_get_fd_by_id(attached_prog_id); + if (prog_fd < 0) { + fprintf(stderr, "Error: bpf_prog_get_fd_by_id: %s\n", strerror(-prog_fd)); + err = bpf_set_link_xdp_fd(ifindex, -1, 0); + if (err < 0) { + fprintf(stderr, "Error: bpf_set_link_xdp_fd: %s\n", strerror(-err)); + fprintf(stderr, "Failed to detach XDP program\n"); + exit(1); + } + } else { + opts.old_fd = prog_fd; + err = bpf_set_link_xdp_fd_opts(ifindex, -1, XDP_FLAGS_REPLACE, &opts); + close(prog_fd); + if (err < 0) { + fprintf(stderr, "Error: bpf_set_link_xdp_fd_opts: %s\n", strerror(-err)); + // Not an error if already replaced by someone else. + if (err != -EEXIST) { + fprintf(stderr, "Failed to detach XDP program\n"); + exit(1); + } + } + } + exit(0); +} + +static noreturn void usage(const char *progname) +{ + fprintf(stderr, "Usage: %s [--iface |--prog ] [--mss4 --mss6 --wscale --ttl ] [--ports ,,...]\n", + progname); + exit(1); +} + +static unsigned long parse_arg_ul(const char *progname, const char *arg, unsigned long limit) +{ + unsigned long res; + char *endptr; + + errno = 0; + res = strtoul(arg, &endptr, 10); + if (errno != 0 || *endptr != '\0' || arg[0] == '\0' || res > limit) + usage(progname); + + return res; +} + +static void parse_options(int argc, char *argv[], unsigned int *ifindex, __u32 *prog_id, + __u64 *tcpipopts, char **ports) +{ + static struct option long_options[] = { + { "help", no_argument, NULL, 'h' }, + { "iface", required_argument, NULL, 'i' }, + { "prog", required_argument, NULL, 'x' }, + { "mss4", required_argument, NULL, 4 }, + { "mss6", required_argument, NULL, 6 }, + { "wscale", required_argument, NULL, 'w' }, + { "ttl", required_argument, NULL, 't' }, + { "ports", required_argument, NULL, 'p' }, + { NULL, 0, NULL, 0 }, + }; + unsigned long mss4, mss6, wscale, ttl; + unsigned int tcpipopts_mask = 0; + + if (argc < 2) + usage(argv[0]); + + *ifindex = 0; + *prog_id = 0; + *tcpipopts = 0; + *ports = 0; + + while (true) { + int opt; + + opt = getopt_long(argc, argv, "", long_options, NULL); + if (opt == -1) + break; + + switch (opt) { + case 'h': + usage(argv[0]); + break; + case 'i': + *ifindex = if_nametoindex(optarg); + if (*ifindex == 0) + usage(argv[0]); + break; + case 'x': + *prog_id = parse_arg_ul(argv[0], optarg, UINT32_MAX); + if (*prog_id == 0) + usage(argv[0]); + break; + case 4: + mss4 = parse_arg_ul(argv[0], optarg, UINT16_MAX); + tcpipopts_mask |= 1 << 0; + break; + case 6: + mss6 = parse_arg_ul(argv[0], optarg, UINT16_MAX); + tcpipopts_mask |= 1 << 1; + break; + case 'w': + wscale = parse_arg_ul(argv[0], optarg, 14); + tcpipopts_mask |= 1 << 2; + break; + case 't': + ttl = parse_arg_ul(argv[0], optarg, UINT8_MAX); + tcpipopts_mask |= 1 << 3; + break; + case 'p': + *ports = optarg; + break; + default: + usage(argv[0]); + } + } + if (optind < argc) + usage(argv[0]); + + if (tcpipopts_mask == 0xf) { + if (mss4 == 0 || mss6 == 0 || wscale == 0 || ttl == 0) + usage(argv[0]); + *tcpipopts = (mss6 << 32) | (ttl << 24) | (wscale << 16) | mss4; + } else if (tcpipopts_mask != 0) { + usage(argv[0]); + } + + if (*ifindex != 0 && *prog_id != 0) + usage(argv[0]); + if (*ifindex == 0 && *prog_id == 0) + usage(argv[0]); +} + +static int syncookie_attach(const char *argv0, unsigned int ifindex) +{ + struct bpf_prog_info info = {}; + __u32 info_len = sizeof(info); + char xdp_filename[PATH_MAX]; + struct bpf_object *obj; + int prog_fd; + int err; + + snprintf(xdp_filename, sizeof(xdp_filename), "%s_kern.o", argv0); + err = bpf_prog_load(xdp_filename, BPF_PROG_TYPE_XDP, &obj, &prog_fd); + if (err < 0) { + fprintf(stderr, "Error: bpf_prog_load: %s\n", strerror(-err)); + return err; + } + err = bpf_obj_get_info_by_fd(prog_fd, &info, &info_len); + if (err < 0) { + fprintf(stderr, "Error: bpf_obj_get_info_by_fd: %s\n", strerror(-err)); + goto out; + } + attached_prog_id = info.id; + signal(SIGINT, cleanup); + signal(SIGTERM, cleanup); + err = bpf_set_link_xdp_fd(ifindex, prog_fd, XDP_FLAGS_UPDATE_IF_NOEXIST); + if (err < 0) { + fprintf(stderr, "Error: bpf_set_link_xdp_fd: %s\n", strerror(-err)); + signal(SIGINT, SIG_DFL); + signal(SIGTERM, SIG_DFL); + attached_prog_id = 0; + goto out; + } + err = 0; +out: + bpf_object__close(obj); + return err; +} + +static int syncookie_open_bpf_maps(__u32 prog_id, int *values_map_fd, int *ports_map_fd) +{ + struct bpf_prog_info prog_info; + __u32 map_ids[3]; + __u32 info_len; + int prog_fd; + int err; + int i; + + *values_map_fd = -1; + *ports_map_fd = -1; + + prog_fd = bpf_prog_get_fd_by_id(prog_id); + if (prog_fd < 0) { + fprintf(stderr, "Error: bpf_prog_get_fd_by_id: %s\n", strerror(-prog_fd)); + return prog_fd; + } + + prog_info = (struct bpf_prog_info) { + .nr_map_ids = 3, + .map_ids = (__u64)map_ids, + }; + info_len = sizeof(prog_info); + + err = bpf_obj_get_info_by_fd(prog_fd, &prog_info, &info_len); + if (err != 0) { + fprintf(stderr, "Error: bpf_obj_get_info_by_fd: %s\n", strerror(-err)); + goto out; + } + + if (prog_info.type != BPF_PROG_TYPE_XDP) { + fprintf(stderr, "Error: BPF prog type is not BPF_PROG_TYPE_XDP\n"); + err = -ENOENT; + goto out; + } + if (prog_info.nr_map_ids != 2) { + fprintf(stderr, "Error: Found %u BPF maps, expected 2\n", + prog_info.nr_map_ids); + err = -ENOENT; + goto out; + } + + for (i = 0; i < prog_info.nr_map_ids; i++) { + struct bpf_map_info map_info = {}; + int map_fd; + + err = bpf_map_get_fd_by_id(map_ids[i]); + if (err < 0) { + fprintf(stderr, "Error: bpf_map_get_fd_by_id: %s\n", strerror(-err)); + goto err_close_map_fds; + } + map_fd = err; + + info_len = sizeof(map_info); + err = bpf_obj_get_info_by_fd(map_fd, &map_info, &info_len); + if (err != 0) { + fprintf(stderr, "Error: bpf_obj_get_info_by_fd: %s\n", strerror(-err)); + close(map_fd); + goto err_close_map_fds; + } + if (strcmp(map_info.name, "values") == 0) { + *values_map_fd = map_fd; + continue; + } + if (strcmp(map_info.name, "allowed_ports") == 0) { + *ports_map_fd = map_fd; + continue; + } + close(map_fd); + goto err_close_map_fds; + } + + err = 0; + goto out; + +err_close_map_fds: + if (*values_map_fd != -1) + close(*values_map_fd); + if (*ports_map_fd != -1) + close(*ports_map_fd); + *values_map_fd = -1; + *ports_map_fd = -1; + +out: + close(prog_fd); + return err; +} + +int main(int argc, char *argv[]) +{ + int values_map_fd, ports_map_fd; + __u64 tcpipopts; + bool firstiter; + __u64 prevcnt; + __u32 prog_id; + char *ports; + int err = 0; + + parse_options(argc, argv, &ifindex, &prog_id, &tcpipopts, &ports); + + if (prog_id == 0) { + err = bpf_get_link_xdp_id(ifindex, &prog_id, 0); + if (err < 0) { + fprintf(stderr, "Error: bpf_get_link_xdp_id: %s\n", strerror(-err)); + goto out; + } + if (prog_id == 0) { + err = syncookie_attach(argv[0], ifindex); + if (err < 0) + goto out; + prog_id = attached_prog_id; + } + } + + err = syncookie_open_bpf_maps(prog_id, &values_map_fd, &ports_map_fd); + if (err < 0) + goto out; + + if (ports) { + __u16 port_last = 0; + __u32 port_idx = 0; + char *p = ports; + + fprintf(stderr, "Replacing allowed ports\n"); + + while (p && *p != '\0') { + char *token = strsep(&p, ","); + __u16 port; + + port = parse_arg_ul(argv[0], token, UINT16_MAX); + err = bpf_map_update_elem(ports_map_fd, &port_idx, &port, BPF_ANY); + if (err != 0) { + fprintf(stderr, "Error: bpf_map_update_elem: %s\n", strerror(-err)); + fprintf(stderr, "Failed to add port %u (index %u)\n", + port, port_idx); + goto out_close_maps; + } + fprintf(stderr, "Added port %u\n", port); + port_idx++; + } + err = bpf_map_update_elem(ports_map_fd, &port_idx, &port_last, BPF_ANY); + if (err != 0) { + fprintf(stderr, "Error: bpf_map_update_elem: %s\n", strerror(-err)); + fprintf(stderr, "Failed to add the terminator value 0 (index %u)\n", + port_idx); + goto out_close_maps; + } + } + + if (tcpipopts) { + __u32 key = 0; + + fprintf(stderr, "Replacing TCP/IP options\n"); + + err = bpf_map_update_elem(values_map_fd, &key, &tcpipopts, BPF_ANY); + if (err != 0) { + fprintf(stderr, "Error: bpf_map_update_elem: %s\n", strerror(-err)); + goto out_close_maps; + } + } + + if ((ports || tcpipopts) && attached_prog_id == 0) + goto out_close_maps; + + prevcnt = 0; + firstiter = true; + while (true) { + __u32 key = 1; + __u64 value; + + err = bpf_map_lookup_elem(values_map_fd, &key, &value); + if (err != 0) { + fprintf(stderr, "Error: bpf_map_lookup_elem: %s\n", strerror(-err)); + goto out_close_maps; + } + if (firstiter) { + prevcnt = value; + firstiter = false; + } + printf("SYNACKs generated: %llu (total %llu)\n", value - prevcnt, value); + prevcnt = value; + sleep(1); + } + +out_close_maps: + close(values_map_fd); + close(ports_map_fd); +out: + return err == 0 ? 0 : 1; +}