lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 7 Aug 2019 13:42:08 -0700
From:   Jakub Kicinski <jakub.kicinski@...ronome.com>
To:     "Daniel T. Lee" <danieltimlee@...il.com>
Cc:     Daniel Borkmann <daniel@...earbox.net>,
        Alexei Starovoitov <ast@...nel.org>, netdev@...r.kernel.org
Subject: Re: [v3,1/4] tools: bpftool: add net attach command to attach XDP
 on interface

On Wed,  7 Aug 2019 11:25:06 +0900, Daniel T. Lee wrote:
> By this commit, using `bpftool net attach`, user can attach XDP prog on
> interface. New type of enum 'net_attach_type' has been made, as stated at
> cover-letter, the meaning of 'attach' is, prog will be attached on interface.
> 
> With 'overwrite' option at argument, attached XDP program could be replaced.
> Added new helper 'net_parse_dev' to parse the network device at argument.
> 
> BPF prog will be attached through libbpf 'bpf_set_link_xdp_fd'.
> 
> Signed-off-by: Daniel T. Lee <danieltimlee@...il.com>
> ---
>  tools/bpf/bpftool/net.c | 141 ++++++++++++++++++++++++++++++++++++----
>  1 file changed, 130 insertions(+), 11 deletions(-)
> 
> diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
> index 67e99c56bc88..c05a3fac5cac 100644
> --- a/tools/bpf/bpftool/net.c
> +++ b/tools/bpf/bpftool/net.c
> @@ -55,6 +55,35 @@ struct bpf_attach_info {
>  	__u32 flow_dissector_id;
>  };
>  
> +enum net_attach_type {
> +	NET_ATTACH_TYPE_XDP,
> +	NET_ATTACH_TYPE_XDP_GENERIC,
> +	NET_ATTACH_TYPE_XDP_DRIVER,
> +	NET_ATTACH_TYPE_XDP_OFFLOAD,
> +};
> +
> +static const char * const attach_type_strings[] = {
> +	[NET_ATTACH_TYPE_XDP]		= "xdp",
> +	[NET_ATTACH_TYPE_XDP_GENERIC]	= "xdpgeneric",
> +	[NET_ATTACH_TYPE_XDP_DRIVER]	= "xdpdrv",
> +	[NET_ATTACH_TYPE_XDP_OFFLOAD]	= "xdpoffload",
> +};
> +
> +const size_t max_net_attach_type = ARRAY_SIZE(attach_type_strings);

Nit: in practice max_.._type is num_types - 1, so perhaps rename this
to num_.. or such?

> +static enum net_attach_type parse_attach_type(const char *str)
> +{
> +	enum net_attach_type type;
> +
> +	for (type = 0; type < max_net_attach_type; type++) {
> +		if (attach_type_strings[type] &&
> +		   is_prefix(str, attach_type_strings[type]))

                   ^
this is misaligned by one space

Please try checkpatch with the --strict option to catch these.

> +			return type;
> +	}
> +
> +	return max_net_attach_type;
> +}
> +
>  static int dump_link_nlmsg(void *cookie, void *msg, struct nlattr **tb)
>  {
>  	struct bpf_netdev_t *netinfo = cookie;
> @@ -223,6 +252,97 @@ static int query_flow_dissector(struct bpf_attach_info *attach_info)
>  	return 0;
>  }
>  
> +static int net_parse_dev(int *argc, char ***argv)
> +{
> +	int ifindex;
> +
> +	if (is_prefix(**argv, "dev")) {
> +		NEXT_ARGP();
> +
> +		ifindex = if_nametoindex(**argv);
> +		if (!ifindex)
> +			p_err("invalid devname %s", **argv);
> +
> +		NEXT_ARGP();
> +	} else {
> +		p_err("expected 'dev', got: '%s'?", **argv);
> +		return -1;
> +	}
> +
> +	return ifindex;
> +}
> +
> +static int do_attach_detach_xdp(int progfd, enum net_attach_type attach_type,
> +				int ifindex, bool overwrite)
> +{
> +	__u32 flags = 0;
> +
> +	if (!overwrite)
> +		flags = XDP_FLAGS_UPDATE_IF_NOEXIST;
> +	if (attach_type == NET_ATTACH_TYPE_XDP_GENERIC)
> +		flags |= XDP_FLAGS_SKB_MODE;
> +	if (attach_type == NET_ATTACH_TYPE_XDP_DRIVER)
> +		flags |= XDP_FLAGS_DRV_MODE;
> +	if (attach_type == NET_ATTACH_TYPE_XDP_OFFLOAD)
> +		flags |= XDP_FLAGS_HW_MODE;
> +
> +	return bpf_set_link_xdp_fd(ifindex, progfd, flags);
> +}
> +
> +static int do_attach(int argc, char **argv)
> +{
> +	enum net_attach_type attach_type;
> +	int progfd, ifindex, err = 0;
> +	bool overwrite = false;
> +
> +	/* parse attach args */
> +	if (!REQ_ARGS(5))
> +		return -EINVAL;
> +
> +	attach_type = parse_attach_type(*argv);
> +	if (attach_type == max_net_attach_type) {
> +		p_err("invalid net attach/detach type");

worth adding the type to the error message so that user know which part
of command line was wrong:

	p_err("invalid net attach/detach type '%s'", *argv);

> +		return -EINVAL;
> +	}
> +
> +	NEXT_ARG();

nit: the new line should be before NEXT_ARG(), IOV NEXT_ARG() belongs
to the code which consumed the argument

> +	progfd = prog_parse_fd(&argc, &argv);
> +	if (progfd < 0)
> +		return -EINVAL;
> +
> +	ifindex = net_parse_dev(&argc, &argv);
> +	if (ifindex < 1) {
> +		close(progfd);
> +		return -EINVAL;
> +	}
> +
> +	if (argc) {
> +		if (is_prefix(*argv, "overwrite")) {
> +			overwrite = true;
> +		} else {
> +			p_err("expected 'overwrite', got: '%s'?", *argv);
> +			close(progfd);
> +			return -EINVAL;
> +		}
> +	}
> +
> +	/* attach xdp prog */
> +	if (is_prefix("xdp", attach_type_strings[attach_type]))

I'm still unclear on why this if is needed

> +		err = do_attach_detach_xdp(progfd, attach_type, ifindex,
> +					   overwrite);
> +
> +	if (err < 0) {
> +		p_err("interface %s attach failed",
> +		      attach_type_strings[attach_type]);

Please add the error string, like:

		p_err("interface %s attach failed: %s",
		      attach_type_strings[attach_type], strerror(errno));


> +		return err;
> +	}
> +
> +	if (json_output)
> +		jsonw_null(json_wtr);
> +
> +	return 0;
> +}
> +
>  static int do_show(int argc, char **argv)
>  {
>  	struct bpf_attach_info attach_info = {};
> @@ -231,17 +351,10 @@ static int do_show(int argc, char **argv)
>  	unsigned int nl_pid;
>  	char err_buf[256];
>  
> -	if (argc == 2) {
> -		if (strcmp(argv[0], "dev") != 0)
> -			usage();
> -		filter_idx = if_nametoindex(argv[1]);
> -		if (filter_idx == 0) {
> -			fprintf(stderr, "invalid dev name %s\n", argv[1]);
> -			return -1;
> -		}
> -	} else if (argc != 0) {
> +	if (argc == 2)
> +		filter_idx = net_parse_dev(&argc, &argv);

You should check filter_idx is not negative here, no?

> +	else if (argc != 0)
>  		usage();
> -	}
>  
>  	ret = query_flow_dissector(&attach_info);
>  	if (ret)

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ