netdev - [RFC PATCH 0/3] BPF socket filter to deal with skb frags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri,  8 Jun 2018 23:00:04 +0200
From:   Tushar Dave <tushar.n.dave@...cle.com>
To:     netdev@...r.kernel.org, ast@...nel.org, daniel@...earbox.net,
        davem@...emloft.net, john.fastabend@...il.com,
        jakub.kicinski@...ronome.com, kafai@...com, rdna@...com,
        quentin.monnet@...ronome.com, brakmo@...com, acme@...hat.com
Subject: [RFC PATCH 0/3] BPF socket filter to deal with skb frags

This RFC allows bpf socket filter programs to look into complete skb
i.e. linear and non-linear part of skb. (patch1)

For a proof of concept I'm using RDS sample program that uses bpf socket
filter and inspect skb packet data from linear and non-linear part e.g.
skb frags. (patch 2 and 3)

I'm sharing this RFC to get some feedback on direction.

Details:
patch1 adds new bpf helper function and needed infrastructure so that
socket(sk) filter based eBPF program can retrieve non-linear part of skb
(e.g. skb frags) unlike current socket filter that only deals with
linear skb. This patch adds very basic functionality and for now allow
socket filter programs to only read packet data (from linear and
non-linear part of) skb. The idea behind this patch is to add eBPF
helper that allow socket filter based ebpf program to walk through the
skb frag using bpf tail call. This way ebpf program can do deep packet
inspection (i.e. allows to look into headers as well as payload).

patch2 adds sample ebpf socket filter program that uses rds socket. The
sample program opens an rds socket, attach ebpf program to rds socket
and uses bpf helper added in patch 1 to look into skb. For a test,
current ebpf program only prints first few bytes from skb->data and skb
frags.

patch3 allows rds_recv_incoming to invoke bpf socket filter program if
any program is attached to rds socket.

FYI, I'm also working on a follow-up patchset that deals with *struct
scatterlist* to allow RDS filtering for IB/RDMA use cases that do not
have an sk_buff.

Thanks.
-Tushar

Tushar Dave (3):
  ebpf: add next_skb_frag bpf helper for sk filter
  samples/bpf: add sample RDS program
  rds: invoke sk filter attached to rds socket

 include/linux/filter.h                    |   2 +
 include/uapi/linux/bpf.h                  |  10 +-
 net/core/filter.c                         |  44 ++++-
 net/rds/recv.c                            |  17 ++
 samples/bpf/Makefile                      |   3 +
 samples/bpf/rds_skb_kern.c                |  87 +++++++++
 samples/bpf/rds_skb_user.c                | 311 ++++++++++++++++++++++++++++++
 tools/include/uapi/linux/bpf.h            |  10 +-
 tools/testing/selftests/bpf/bpf_helpers.h |   2 +
 9 files changed, 482 insertions(+), 4 deletions(-)
 create mode 100644 samples/bpf/rds_skb_kern.c
 create mode 100644 samples/bpf/rds_skb_user.c

-- 
1.8.3.1