| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <157002302784.1302756.2073486805381846919.stgit@alrua-x1>
Date: Wed, 02 Oct 2019 15:30:27 +0200
From: Toke Høiland-Jørgensen <toke@...hat.com>
To: Daniel Borkmann <daniel@...earbox.net>
Cc: Alexei Starovoitov <ast@...nel.org>,
Martin KaFai Lau <kafai@...com>,
Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
Marek Majkowski <marek@...udflare.com>,
Lorenz Bauer <lmb@...udflare.com>,
David Miller <davem@...emloft.net>,
Jesper Dangaard Brouer <brouer@...hat.com>,
netdev@...r.kernel.org, bpf@...r.kernel.org
Subject: [PATCH bpf-next 3/9] xdp: Support setting and getting device chain
map
From: Toke Høiland-Jørgensen <toke@...hat.com>
This adds support to rtnetlink for setting and getting the per-device XDP
chain map. The map is set by means of a new netlink attribute that contains
a pointer to a BPF map of the XDP chain type. If such an attribute is
included, it will be inserted into the struct net_device so that the XDP
chain call code will pick it up on program execution.
To prevent old userspace programs that do not understand the chain map
attribute from messing up the chain call order, a netlink message with no
chain map attribute set will be rejected if a chain map has already been
installed.
When installing a new chain call map, an XDP program fd must also be
provided, otherwise the operation will be rejected.
Signed-off-by: Toke Høiland-Jørgensen <toke@...hat.com>
---
include/linux/netdevice.h | 3 ++-
include/uapi/linux/if_link.h | 2 ++
net/core/dev.c | 42 ++++++++++++++++++++++++++++++++++++------
net/core/rtnetlink.c | 23 +++++++++++++++++++++++
4 files changed, 63 insertions(+), 7 deletions(-)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 48cc71aae466..60f3b510b175 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1941,6 +1941,7 @@ struct net_device {
unsigned int real_num_rx_queues;
struct bpf_prog __rcu *xdp_prog;
+ struct bpf_map __rcu *xdp_chain_map;
unsigned long gro_flush_timeout;
rx_handler_func_t __rcu *rx_handler;
void __rcu *rx_handler_data;
@@ -3702,7 +3703,7 @@ struct sk_buff *dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
typedef int (*bpf_op_t)(struct net_device *dev, struct netdev_bpf *bpf);
int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
- int fd, u32 flags);
+ int prog_fd, int chain_map_fd, u32 flags);
u32 __dev_xdp_query(struct net_device *dev, bpf_op_t xdp_op,
enum bpf_netdev_command cmd);
int xdp_umem_query(struct net_device *dev, u16 queue_id);
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 8aec8769d944..e7a704387608 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -976,6 +976,8 @@ enum {
IFLA_XDP_DRV_PROG_ID,
IFLA_XDP_SKB_PROG_ID,
IFLA_XDP_HW_PROG_ID,
+ IFLA_XDP_CHAIN_MAP_FD,
+ IFLA_XDP_CHAIN_MAP_ID,
__IFLA_XDP_MAX,
};
diff --git a/net/core/dev.c b/net/core/dev.c
index 7a456c6a7ad8..0aa5106339e7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8177,9 +8177,15 @@ static int dev_xdp_install(struct net_device *dev, bpf_op_t bpf_op,
static void dev_xdp_uninstall(struct net_device *dev)
{
+ struct bpf_map *chain_map = NULL;
struct netdev_bpf xdp;
bpf_op_t ndo_bpf;
+ /* Remove chain map */
+ rcu_swap_protected(dev->xdp_chain_map, chain_map, 1);
+ if(chain_map)
+ bpf_map_put_with_uref(chain_map);
+
/* Remove generic XDP */
WARN_ON(dev_xdp_install(dev, generic_xdp_install, NULL, 0, NULL));
@@ -8207,15 +8213,17 @@ static void dev_xdp_uninstall(struct net_device *dev)
* dev_change_xdp_fd - set or clear a bpf program for a device rx path
* @dev: device
* @extack: netlink extended ack
- * @fd: new program fd or negative value to clear
+ * @prog_fd: new program fd or negative value to clear
+ * @chain_map_fd: new chain map fd or negative value to clear
* @flags: xdp-related flags
*
* Set or clear a bpf program for a device
*/
int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
- int fd, u32 flags)
+ int prog_fd, int chain_map_fd, u32 flags)
{
const struct net_device_ops *ops = dev->netdev_ops;
+ struct bpf_map *chain_map = NULL;
enum bpf_netdev_command query;
struct bpf_prog *prog = NULL;
bpf_op_t bpf_op, bpf_chk;
@@ -8237,7 +8245,7 @@ int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
if (bpf_op == bpf_chk)
bpf_chk = generic_xdp_install;
- if (fd >= 0) {
+ if (prog_fd >= 0) {
u32 prog_id;
if (!offload && __dev_xdp_query(dev, bpf_chk, XDP_QUERY_PROG)) {
@@ -8251,7 +8259,7 @@ int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
return -EBUSY;
}
- prog = bpf_prog_get_type_dev(fd, BPF_PROG_TYPE_XDP,
+ prog = bpf_prog_get_type_dev(prog_fd, BPF_PROG_TYPE_XDP,
bpf_op == ops->ndo_bpf);
if (IS_ERR(prog))
return PTR_ERR(prog);
@@ -8267,13 +8275,35 @@ int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
return 0;
}
} else {
+ if (chain_map_fd >= 0)
+ return -EINVAL;
+
if (!__dev_xdp_query(dev, bpf_op, query))
return 0;
}
+ if (chain_map_fd >= 0) {
+ chain_map = bpf_map_get_with_uref(chain_map_fd);
+ if (IS_ERR(chain_map))
+ return PTR_ERR(chain_map);
+
+ if (chain_map->map_type != BPF_MAP_TYPE_XDP_CHAIN) {
+ NL_SET_ERR_MSG(extack, "invalid chain map type");
+ bpf_map_put_with_uref(chain_map);
+ return -EINVAL;
+ }
+ }
+
err = dev_xdp_install(dev, bpf_op, extack, flags, prog);
- if (err < 0 && prog)
- bpf_prog_put(prog);
+ if (err < 0) {
+ if (prog)
+ bpf_prog_put(prog);
+ } else {
+ rcu_swap_protected(dev->xdp_chain_map, chain_map, 1);
+ }
+
+ if(chain_map)
+ bpf_map_put_with_uref(chain_map);
return err;
}
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 49fa910b58af..d6123efdff80 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1427,6 +1427,7 @@ static int rtnl_xdp_report_one(struct sk_buff *skb, struct net_device *dev,
static int rtnl_xdp_fill(struct sk_buff *skb, struct net_device *dev)
{
+ struct bpf_map *chain_map;
struct nlattr *xdp;
u32 prog_id;
int err;
@@ -1461,6 +1462,13 @@ static int rtnl_xdp_fill(struct sk_buff *skb, struct net_device *dev)
goto err_cancel;
}
+ chain_map = rcu_dereference(dev->xdp_chain_map);
+ if (chain_map) {
+ err = nla_put_u32(skb, IFLA_XDP_CHAIN_MAP_ID, chain_map->id);
+ if (err)
+ goto err_cancel;
+ }
+
nla_nest_end(skb, xdp);
return 0;
@@ -2756,12 +2764,27 @@ static int do_setlink(const struct sk_buff *skb,
}
if (xdp[IFLA_XDP_FD]) {
+ int chain_map_fd = -1;
+
+ if (xdp[IFLA_XDP_CHAIN_MAP_FD]) {
+ chain_map_fd = nla_get_s32(xdp[IFLA_XDP_CHAIN_MAP_FD]);
+ } else if (dev->xdp_chain_map) {
+ NL_SET_ERR_MSG(extack, "no chain map attribute, but chain map loaded");
+ err = -EINVAL;
+ goto errout;
+ }
+
err = dev_change_xdp_fd(dev, extack,
nla_get_s32(xdp[IFLA_XDP_FD]),
+ chain_map_fd,
xdp_flags);
if (err)
goto errout;
status |= DO_SETLINK_NOTIFY;
+ } else if (xdp[IFLA_XDP_CHAIN_MAP_FD]) {
+ err = -EINVAL;
+ NL_SET_ERR_MSG(extack, "chain map attribute invalid without prog fd");
+ goto errout;
}
}
Powered by blists - more mailing lists