netdev - Re: [RFC v2 PATCH 0/4] eBPF and struct scatterlist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0d049228-cf44-f37e-213a-03db5da38958@oracle.com>
Date:   Mon, 25 Jun 2018 17:14:12 -0700
From:   Tushar Dave <tushar.n.dave@...cle.com>
To:     ast@...nel.org, daniel@...earbox.net, davem@...emloft.net,
        jakub.kicinski@...ronome.com, quentin.monnet@...ronome.com,
        jiong.wang@...ronome.com, guro@...com, sandipan@...ux.vnet.ibm.com,
        john.fastabend@...il.com, kafai@...com, rdna@...com, brakmo@...com,
        netdev@...r.kernel.org, acme@...hat.com,
        sowmini.varadhan@...cle.com
Subject: Re: [RFC v2 PATCH 0/4] eBPF and struct scatterlist



On 06/19/2018 11:00 AM, Tushar Dave wrote:
> This follows up on https://patchwork.ozlabs.org/cover/927050/
> where the review feedback was to use bpf_skb_load_bytes() to deal with
> linear and non-linear skbs. While that feedback is valid and correct,
> the motivation for this work is to allow eBPF based firewalling for
> kernel modules that do not always get their packet as an sk_buff from
> their downlink drivers. One such instance of this use-case is RDS, which
> can be run both over IB (driver RDMA's a scatterlist to the RDS module)
> or over TCP (TCP passes an sk_buff to the RDS module)
> 
> This RFC (call it v2) uses exiting socket filter infrastructure and
> extend it with new eBPF program type that deals with struct scatterlist.
> For RDS, the integrated approach treats the scatterlist as the common
> denominator, and allows the application to write a filter for processing
> a scatterlist.
> 
> 
> Details:
> Patch 1 adds new eBPF prog type BPF_PROG_TYPE_SOCKET_SG_FILTER which
> uses the existing socket filter infrastructure for bpf program attach
> and load. eBPF program of type BPF_PROG_TYPE_SOCKET_SG_FILTER receives
> struct scatterlist as bpf context contrast to
> BPF_PROG_TYPE_SOCKET_FILTER which deals with struct skb. This new eBPF
> program type allow socket filter to run on packet data that is in form
> form of struct scatterlist.
> 
> Patch 2 adds functionality to run BPF_PROG_TYPE_SOCKET_SG_FILTER socket
> filter program. A bpf helpers bpf_sg_next() is also added so users can
> retrieve sg elements from scatterlist.
> 
> Patch 3 adds socket filter eBPF sample program that uses patch 1 and
> patch 2. The sample program opens an rds socket, attach ebpf program
> (socksg i.e. BPF_PROG_TYPE_SOCKET_SG_FILTER) to rds socket and uses
> bpf_sg_next helper to look into sg. For a test, current ebpf program
> only prints first few bytes from each elements of sg list.
> 
> Finally, patch 4 allows rds_recv_incoming to invoke socket filter
> program which deals with scatterlist.

It would be really helpful to have your thoughts/comments on my
direction. I am planning to put together some complex example for
filtering RDS traffic using eBPF, and so it would be good to have
feedback before I go too far ahead.

Thanks.

-Tushar

> 
> Thanks.
> 
> -Tushar
> 
> Tushar Dave (4):
>    eBPF: Add new eBPF prog type BPF_PROG_TYPE_SOCKET_SG_FILTER
>    ebpf: Add sg_filter_run and sg helper
>    ebpf: Add sample ebpf program for SOCKET_SG_FILTER
>    rds: invoke socket sg filter attached to rds socket
> 
>   include/linux/bpf_types.h                 |   1 +
>   include/linux/filter.h                    |  10 +
>   include/uapi/linux/bpf.h                  |  17 +-
>   kernel/bpf/syscall.c                      |   1 +
>   kernel/bpf/verifier.c                     |   1 +
>   net/core/filter.c                         | 149 ++++++++++++-
>   net/rds/ib.c                              |   1 +
>   net/rds/ib.h                              |   1 +
>   net/rds/ib_recv.c                         |  12 ++
>   net/rds/rds.h                             |   2 +
>   net/rds/recv.c                            |  16 ++
>   net/rds/tcp.c                             |   2 +
>   net/rds/tcp.h                             |   2 +
>   net/rds/tcp_recv.c                        |  38 ++++
>   samples/bpf/Makefile                      |   3 +
>   samples/bpf/bpf_load.c                    |  11 +-
>   samples/bpf/rds_filter_kern.c             |  78 +++++++
>   samples/bpf/rds_filter_user.c             | 339 ++++++++++++++++++++++++++++++
>   tools/bpf/bpftool/prog.c                  |   1 +
>   tools/include/uapi/linux/bpf.h            |  17 +-
>   tools/lib/bpf/libbpf.c                    |   3 +
>   tools/lib/bpf/libbpf.h                    |   2 +
>   tools/testing/selftests/bpf/bpf_helpers.h |   3 +
>   23 files changed, 703 insertions(+), 7 deletions(-)
>   create mode 100644 samples/bpf/rds_filter_kern.c
>   create mode 100644 samples/bpf/rds_filter_user.c
>