| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 3 Dec 2018 19:54:12 -0800
From: Stanislav Fomichev <sdf@...ichev.me>
To: Song Liu <liu.song.a23@...il.com>
Cc: sdf@...gle.com, Networking <netdev@...r.kernel.org>,
"David S . Miller" <davem@...emloft.net>,
Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
simon.horman@...ronome.com
Subject: Re: [PATCH bpf-next 2/3] bpf: add BPF_PROG_TEST_RUN support for flow
dissector
On 12/03, Stanislav Fomichev wrote:
> On 12/03, Song Liu wrote:
> > On Mon, Dec 3, 2018 at 11:00 AM Stanislav Fomichev <sdf@...gle.com> wrote:
> > >
> > > The input is packet data, the output is struct bpf_flow_key. This should
> > > make it easy to test flow dissector programs without elaborate
> > > setup.
> > >
> > > Signed-off-by: Stanislav Fomichev <sdf@...gle.com>
> > > ---
> > > include/linux/bpf.h | 3 ++
> > > net/bpf/test_run.c | 76 +++++++++++++++++++++++++++++++++++++++++----
> > > net/core/filter.c | 1 +
> > > 3 files changed, 74 insertions(+), 6 deletions(-)
> > >
> > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> > > index e82b7039fc66..7a572d15d5dd 100644
> > > --- a/include/linux/bpf.h
> > > +++ b/include/linux/bpf.h
> > > @@ -373,6 +373,9 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
> > > union bpf_attr __user *uattr);
> > > int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
> > > union bpf_attr __user *uattr);
> > > +int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog,
> > > + const union bpf_attr *kattr,
> > > + union bpf_attr __user *uattr);
> > >
> > > /* an array of programs to be executed under rcu_lock.
> > > *
> > > diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> > > index c89c22c49015..bfa05d31c6e3 100644
> > > --- a/net/bpf/test_run.c
> > > +++ b/net/bpf/test_run.c
> > > @@ -14,21 +14,33 @@
> > > #include <net/tcp.h>
> > >
> > > static __always_inline u32 bpf_test_run_one(struct bpf_prog *prog, void *ctx,
> > > - struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE])
> > > + struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE],
> > > + struct bpf_flow_keys *flow_keys)
> > > {
> > > u32 ret;
> > >
> > > preempt_disable();
> > > rcu_read_lock();
> > > bpf_cgroup_storage_set(storage);
> > > - ret = BPF_PROG_RUN(prog, ctx);
> > > +
> > > + switch (prog->type) {
> > > + case BPF_PROG_TYPE_FLOW_DISSECTOR:
> > > + ret = __skb_flow_bpf_dissect(prog, ctx, &flow_keys_dissector,
> > > + flow_keys);
> > > + break;
> > > + default:
> > > + ret = BPF_PROG_RUN(prog, ctx);
> > > + break;
> > > + }
> > > +
> >
> > Is it possible to fold the logic above into bpf_prog_test_run_flow_dissector()?
> > In that way, the logic flow is similar to other bpf_prog_test_run_XXX()
> > functions.
> I can probably do everything that __skb_flow_bpf_dissect does inside of
> bpf_prog_test_run_flow_dissector (pass flow_keys in cb); that would remove
> this ugly program type check down the stack. But my additional goal here was
> to test __skb_flow_bpf_dissect itself as well.
>
> Attached some possible prototype below. The only issue I see with that
> approach is that we need to clear flow_keys on each test iteration.
> I think in my current patch I'm actually missing a memset(&flow_keys, 0, ...)
> for each iteration of __skb_flow_bpf_dissect;
> I haven't tested multiple runs :-/
>
> So I'd prefer to continue doing this prog type check (plus, add a missing
> memset for flow_keys on each iteration in v2). WDYT?
I think I found another problem with not using __skb_flow_bpf_dissect:
I want to add some clamping to the thoff/nhoff returned by the bpf
program (to be safe); it's probably better to keep all this logic in one
place.
I can probably pass flow_keys in the skb->cb, so I don't have to add
flow_keys to the bpf_test_run_one/bpf_test_run signatures. I'll send v2
shortly, let me know if it addresses your point.
> ---
>
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index e82b7039fc66..7a572d15d5dd 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -373,6 +373,9 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
> union bpf_attr __user *uattr);
> int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
> union bpf_attr __user *uattr);
> +int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog,
> + const union bpf_attr *kattr,
> + union bpf_attr __user *uattr);
>
> /* an array of programs to be executed under rcu_lock.
> *
> diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> index c89c22c49015..04387ef1f95a 100644
> --- a/net/bpf/test_run.c
> +++ b/net/bpf/test_run.c
> @@ -220,3 +220,60 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
> kfree(data);
> return ret;
> }
> +
> +int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog,
> + const union bpf_attr *kattr,
> + union bpf_attr __user *uattr)
> +{
> + struct bpf_flow_keys flow_keys = {};
> + u32 size = kattr->test.data_size_in;
> + u32 repeat = kattr->test.repeat;
> + struct bpf_skb_data_end *cb;
> + u32 retval, duration;
> + struct sk_buff *skb;
> + struct sock *sk;
> + void *data;
> + int ret;
> +
> + if (prog->type != BPF_PROG_TYPE_FLOW_DISSECTOR)
> + return -EINVAL;
> +
> + data = bpf_test_init(kattr, size, NET_SKB_PAD + NET_IP_ALIGN,
> + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
> + if (IS_ERR(data))
> + return PTR_ERR(data);
> +
> + sk = kzalloc(sizeof(*sk), GFP_USER);
> + if (!sk) {
> + kfree(data);
> + return -ENOMEM;
> + }
> + sock_net_set(sk, current->nsproxy->net_ns);
> + sock_init_data(NULL, sk);
> +
> + skb = build_skb(data, 0);
> + if (!skb) {
> + kfree(data);
> + kfree(sk);
> + return -ENOMEM;
> + }
> + skb->sk = sk;
> +
> + skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
> + __skb_put(skb, size);
> + skb->protocol = eth_type_trans(skb,
> + current->nsproxy->net_ns->loopback_dev);
> + skb_reset_network_header(skb);
> +
> + cb = (struct bpf_skb_data_end *)skb->cb;
> + memset(cb, 0, sizeof(cb));
> + cb->qdisc_cb.flow_keys = &flow_keys;
> +
> + retval = bpf_test_run(prog, skb, repeat, &duration);
> +
> + ret = bpf_test_finish(kattr, uattr, &flow_keys, sizeof(flow_keys),
> + retval, duration);
> + kfree_skb(skb);
> + kfree(sk);
> + return ret;
> +}
> diff --git a/net/core/filter.c b/net/core/filter.c
> index bd0df75dc7b6..4eae6102399d 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -7657,6 +7657,7 @@ const struct bpf_verifier_ops flow_dissector_verifier_ops = {
> };
>
> const struct bpf_prog_ops flow_dissector_prog_ops = {
> + .test_run = bpf_prog_test_run_flow_dissector,
> };
>
> int sk_detach_filter(struct sock *sk)
>
> > Thanks,
> > Song
> >
> >
> > > rcu_read_unlock();
> > > preempt_enable();
> > >
> > > return ret;
> > > }
> > >
> > > -static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time)
> > > +static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time,
> > > + struct bpf_flow_keys *flow_keys)
> > > {
> > > struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = { 0 };
> > > enum bpf_cgroup_storage_type stype;
> > > @@ -49,7 +61,7 @@ static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time)
> > > repeat = 1;
> > > time_start = ktime_get_ns();
> > > for (i = 0; i < repeat; i++) {
> > > - ret = bpf_test_run_one(prog, ctx, storage);
> > > + ret = bpf_test_run_one(prog, ctx, storage, flow_keys);
> > > if (need_resched()) {
> > > if (signal_pending(current))
> > > break;
> > > @@ -165,7 +177,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
> > > __skb_push(skb, hh_len);
> > > if (is_direct_pkt_access)
> > > bpf_compute_data_pointers(skb);
> > > - retval = bpf_test_run(prog, skb, repeat, &duration);
> > > + retval = bpf_test_run(prog, skb, repeat, &duration, NULL);
> > > if (!is_l2) {
> > > if (skb_headroom(skb) < hh_len) {
> > > int nhead = HH_DATA_ALIGN(hh_len - skb_headroom(skb));
> > > @@ -212,7 +224,7 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
> > > rxqueue = __netif_get_rx_queue(current->nsproxy->net_ns->loopback_dev, 0);
> > > xdp.rxq = &rxqueue->xdp_rxq;
> > >
> > > - retval = bpf_test_run(prog, &xdp, repeat, &duration);
> > > + retval = bpf_test_run(prog, &xdp, repeat, &duration, NULL);
> > > if (xdp.data != data + XDP_PACKET_HEADROOM + NET_IP_ALIGN ||
> > > xdp.data_end != xdp.data + size)
> > > size = xdp.data_end - xdp.data;
> > > @@ -220,3 +232,55 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
> > > kfree(data);
> > > return ret;
> > > }
> > > +
> > > +int bpf_prog_test_run_flow_dissector(struct bpf_prog *prog,
> > > + const union bpf_attr *kattr,
> > > + union bpf_attr __user *uattr)
> > > +{
> > > + struct bpf_flow_keys flow_keys = {};
> > > + u32 size = kattr->test.data_size_in;
> > > + u32 repeat = kattr->test.repeat;
> > > + u32 retval, duration;
> > > + struct sk_buff *skb;
> > > + struct sock *sk;
> > > + void *data;
> > > + int ret;
> > > +
> > > + if (prog->type != BPF_PROG_TYPE_FLOW_DISSECTOR)
> > > + return -EINVAL;
> > > +
> > > + data = bpf_test_init(kattr, size, NET_SKB_PAD + NET_IP_ALIGN,
> > > + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
> > > + if (IS_ERR(data))
> > > + return PTR_ERR(data);
> > > +
> > > + sk = kzalloc(sizeof(*sk), GFP_USER);
> > > + if (!sk) {
> > > + kfree(data);
> > > + return -ENOMEM;
> > > + }
> > > + sock_net_set(sk, current->nsproxy->net_ns);
> > > + sock_init_data(NULL, sk);
> > > +
> > > + skb = build_skb(data, 0);
> > > + if (!skb) {
> > > + kfree(data);
> > > + kfree(sk);
> > > + return -ENOMEM;
> > > + }
> > > + skb->sk = sk;
> > > +
> > > + skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
> > > + __skb_put(skb, size);
> > > + skb->protocol = eth_type_trans(skb,
> > > + current->nsproxy->net_ns->loopback_dev);
> > > + skb_reset_network_header(skb);
> > > +
> > > + retval = bpf_test_run(prog, skb, repeat, &duration, &flow_keys);
> > > +
> > > + ret = bpf_test_finish(kattr, uattr, &flow_keys, sizeof(flow_keys),
> > > + retval, duration);
> > > + kfree_skb(skb);
> > > + kfree(sk);
> > > + return ret;
> > > +}
> > > diff --git a/net/core/filter.c b/net/core/filter.c
> > > index bd0df75dc7b6..4eae6102399d 100644
> > > --- a/net/core/filter.c
> > > +++ b/net/core/filter.c
> > > @@ -7657,6 +7657,7 @@ const struct bpf_verifier_ops flow_dissector_verifier_ops = {
> > > };
> > >
> > > const struct bpf_prog_ops flow_dissector_prog_ops = {
> > > + .test_run = bpf_prog_test_run_flow_dissector,
> > > };
> > >
> > > int sk_detach_filter(struct sock *sk)
> > > --
> > > 2.20.0.rc1.387.gf8505762e3-goog
> > >
Powered by blists - more mailing lists