Date:   Tue, 08 Oct 2019 11:00:10 +0200
From:   Toke Høiland-Jørgensen <toke@...hat.com>
To:     Daniel Borkmann <daniel@...earbox.net>
Cc:     Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Marek Majkowski <marek@...udflare.com>,
        Lorenz Bauer <lmb@...udflare.com>,
        Alan Maguire <alan.maguire@...cle.com>,
        Jesper Dangaard Brouer <brouer@...hat.com>,
        David Miller <davem@...emloft.net>, netdev@...r.kernel.org,
        bpf@...r.kernel.org
Subject: Re: [PATCH bpf-next v2 1/5] bpf: Support injecting chain calls into BPF programs on load

Daniel Borkmann <daniel@...earbox.net> writes:

> On Mon, Oct 07, 2019 at 12:11:31PM +0200, Toke Høiland-Jørgensen wrote:
>> Alexei Starovoitov <alexei.starovoitov@...il.com> writes:
>> > On Fri, Oct 04, 2019 at 07:22:41PM +0200, Toke Høiland-Jørgensen wrote:
>> >> From: Toke Høiland-Jørgensen <toke@...hat.com>
>> >> 
>> >> This adds support for injecting chain call logic into eBPF programs before
>> >> they return. The code injection is controlled by a flag at program load
>> >> time; if the flag is set, the verifier will add code to every BPF_EXIT
>> >> instruction that first does a lookup into a chain call structure to see if
>> >> it should call into another program before returning. The actual calls
>> >> reuse the tail call infrastructure.
>> >> 
>> >> Ideally, it shouldn't be necessary to set the flag on program load time,
>> >> but rather inject the calls when a chain call program is first loaded.
>> >> However, rewriting the program reallocates the bpf_prog struct, which is
>> >> obviously not possible after the program has been attached to something.
>> >> 
>> >> One way around this could be a sysctl to force the flag one (for enforcing
>> >> system-wide support). Another could be to have the chain call support
>> >> itself built into the interpreter and JIT, which could conceivably be
>> >> re-run each time we attach a new chain call program. This would also allow
>> >> the JIT to inject direct calls to the next program instead of using the
>> >> tail call infrastructure, which presumably would be a performance win. The
>> >> drawback is, of course, that it would require modifying all the JITs.
>> >> 
>> >> Signed-off-by: Toke Høiland-Jørgensen <toke@...hat.com>
>> > ...
>> >>  
>> >> +static int bpf_inject_chain_calls(struct bpf_verifier_env *env)
>> >> +{
>> >> +	struct bpf_prog *prog = env->prog;
>> >> +	struct bpf_insn *insn = prog->insnsi;
>> >> +	int i, cnt, delta = 0, ret = -ENOMEM;
>> >> +	const int insn_cnt = prog->len;
>> >> +	struct bpf_array *prog_array;
>> >> +	struct bpf_prog *new_prog;
>> >> +	size_t array_size;
>> >> +
>> >> +	struct bpf_insn call_next[] = {
>> >> +		BPF_LD_IMM64(BPF_REG_2, 0),
>> >> +		/* Save real return value for later */
>> >> +		BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
>> >> +		/* First try tail call with index ret+1 */
>> >> +		BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
>> >> +		BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 1),
>> >> +		BPF_RAW_INSN(BPF_JMP | BPF_TAIL_CALL, 0, 0, 0, 0),
>> >> +		/* If that doesn't work, try with index 0 (wildcard) */
>> >> +		BPF_MOV64_IMM(BPF_REG_3, 0),
>> >> +		BPF_RAW_INSN(BPF_JMP | BPF_TAIL_CALL, 0, 0, 0, 0),
>> >> +		/* Restore saved return value and exit */
>> >> +		BPF_MOV64_REG(BPF_REG_0, BPF_REG_6),
>> >> +		BPF_EXIT_INSN()
>> >> +	};
>> >
>> > How did you test it?
>> > With the only test from patch 5?
>> > +int xdp_drop_prog(struct xdp_md *ctx)
>> > +{
>> > +       return XDP_DROP;
>> > +}
>> >
>> > Please try different program with more than one instruction.
>> > And then look at above asm and think how it can be changed to
>> > get valid R1 all the way to each bpf_exit insn.
>> > Do you see amount of headaches this approach has?
>> 
>> Ah yes, that's a good point. It seems that I totally overlooked that
>> issue, somehow...
>> 
>> > The way you explained the use case of XDP-based firewall plus XDP-based
>> > IPS/IDS it's about "knows nothing" admin that has to deal with more than
>> > one XDP application on an unfamiliar server.
>> > This is the case of debugging.
>> 
>> This is not about debugging. The primary use case is about deploying
>> multiple, independently developed, XDP-enabled applications on the same
>> server.
>> 
>> Basically, we want the admin to be able to do:
>> 
>> # yum install MyIDS
>> # yum install MyXDPFirewall
>> 
>> and then have both of those *just work* in XDP mode, on the same
>> interface.
>
> How is the user space loader side handled in this situation, meaning,
> what are your plans on this regard?

I am planning to write a loader that supports this which can be used
stand-alone or as a library (either a standalone library, or as part of
libbpf). Applications can then use the library functions to load itself,
or ship an eBPF binary and have the user load it as needed (depending on
what makes sense for its use case).

> Reason I'm asking is that those independently developed, XDP-enabled
> applications today might on startup simply forcefully remove what is
> currently installed on XDP layer at device X, and then override it
> with their own program, meaning both of MyIDS and MyXDPFirewall would
> remove each other's programs on start.

Yes, they could. I'm hoping to establish sufficiently strong conventions
that they won't :)

> This will still require some sort of cooperation, think of something
> like systemd service files or the like where the former would then act
> as the loader to link these together in the background (perhaps also
> allowing to specify some sort of a dependency between well-known
> ones).

I am imagining something like a manifest file where an application can
specify which return codes it will return that it makes sense to chain
on. E.g., a firewall could say "chain after me when I return XDP_PASS".
In general, chaining on XDP_PASS will probably be the most common.

> How would an admin ad-hoc insert his xdpdump program in between,
> meaning what tooling do you have in mind here?

xdpdump would do something like this:

xdpdump_attach(after=my_firewall, action=drop) {
  my_prog_fd = load_prog(xdpdump.so)
  other_prog_fd = find_prog_fd(name=my_firewall)
  existing_prog_id = bpf_prog_chain_get(other_prog_fd, action)
  if (existing_prog_id) {
     existing_prog_fd = bpf_get_fd_by_id(existing_prog_id);
     bpf_prog_chain_add(my_prog_fd, action, existing_prog_fd);
  }
  bpf_prog_chain_add(other_prog_fd, action, my_prog_fd);
}

xdpdump_detach() {
  bpf_prog_chain_add(other_prog_fd, action, existing_prog_fd);
}

> And how would daemons update their own installed programs at runtime?

Like above; you attach the chain actions to your new prog first, then
atomically replace it with the old one.

> Right now it's simply atomic update of whatever is currently
> installed, but with chained progs, they would need to send it to
> whatever central daemon is managing all these instead of just calling
> bpf() and do the attaching by themselves, or is the expectation that
> the application would need to iterate its own chain via
> BPF_PROG_CHAIN_GET and resetup everything by itself?

I'm expecting each application to "play nice" like above, with the help
of a library. In particular, I want to avoid having a userspace daemon
that needs to keep state. If the kernel keeps the state, different
userspace applications can cooperatively insert and remove themselves
using that state. Similar to how they today can install themselves on
*different* interfaces, but still have to avoid replacing each other...

-Toke

Powered by blists - more mailing lists