netdev - Re: [PATCH net-next v4 1/3] Add a helper function to get socket cookie in eBPF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20170320155343.GC80094@ast-mbp.thefacebook.com>
Date:   Mon, 20 Mar 2017 08:53:44 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Chenbo Feng <chenbofeng.kernel@...il.com>
Cc:     netdev@...r.kernel.org, Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Lorenzo Colitti <lorenzo@...gle.com>,
        Willem de Bruijn <willemb@...gle.com>,
        Chenbo Feng <fengc@...gle.com>
Subject: Re: [PATCH net-next v4 1/3] Add a helper function to get socket
 cookie in eBPF

On Sun, Mar 19, 2017 at 05:08:42PM -0700, Chenbo Feng wrote:
> From: Chenbo Feng <fengc@...gle.com>
> 
> Retrieve the socket cookie generated by sock_gen_cookie() from a sk_buff
> with a known socket. Generates a new cookie if one was not yet set.If
> the socket pointer inside sk_buff is NULL, 0 is returned. The helper
> function coud be useful in monitoring per socket networking traffic
> statistics and provide a unique socket identifier per namespace.
> 
> Signed-off-by: Chenbo Feng <chenbofeng.kernel@...il.com>

Acked-by: Alexei Starovoitov <ast@...nel.org>

> @@ -2633,6 +2646,8 @@ sk_filter_func_proto(enum bpf_func_id func_id)
>  	switch (func_id) {
>  	case BPF_FUNC_skb_load_bytes:
>  		return &bpf_skb_load_bytes_proto;
> +	case BPF_FUNC_get_socket_cookie:
> +		return &bpf_get_socket_cookie_proto;
>  	default:
>  		return bpf_base_func_proto(func_id);
>  	}
> @@ -2692,6 +2707,8 @@ tc_cls_act_func_proto(enum bpf_func_id func_id)
>  		return &bpf_get_smp_processor_id_proto;
>  	case BPF_FUNC_skb_under_cgroup:
>  		return &bpf_skb_under_cgroup_proto;
> +	case BPF_FUNC_get_socket_cookie:
> +		return &bpf_get_socket_cookie_proto;
>  	default:
>  		return bpf_base_func_proto(func_id);

Not related to this patch, but we probably need a separate cleanup
to enable these two new helpers on lwt and cg_skb.
All of them should probably be calling sk_filter_func_proto() instead
of bpf_base_func_proto().