netdev - Re: [PATCH bpf-next v4 00/15] implement bpf iterator for tcp and udp sockets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 23 Jun 2020 14:59:00 -0700
From:   Martin KaFai Lau <kafai@...com>
To:     Yonghong Song <yhs@...com>
CC:     <bpf@...r.kernel.org>, <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>, <kernel-team@...com>
Subject: Re: [PATCH bpf-next v4 00/15] implement bpf iterator for tcp and udp
 sockets

On Tue, Jun 23, 2020 at 09:17:49AM -0700, Yonghong Song wrote:
> bpf iterator implments traversal of kernel data structures and these
> data structures are passed to a bpf program for processing.
> This gives great flexibility for users to examine kernel data
> structure without using e.g. /proc/net which has limited and
> fixed format.
> 
> Commit 138d0be35b14 ("net: bpf: Add netlink and ipv6_route bpf_iter targets")
> implemented bpf iterators for netlink and ipv6_route.
> This patch set intends to implement bpf iterators for tcp and udp.
> 
> Currently, /proc/net/tcp is used to print tcp4 stats and /proc/net/tcp6
> is used to print tcp6 stats. /proc/net/udp[6] have similar usage model.
> In contrast, only one tcp iterator is implemented and it is bpf program
> resposibility to filter based on socket family. The same is for udp.
> This will avoid another unnecessary traversal pass if users want
> to check both tcp4 and tcp6.
> 
> Several helpers are also implemented in this patch
>   bpf_skc_to_{tcp, tcp6, tcp_timewait, tcp_request, udp6}_sock
> The argument for these helpers is not a fixed btf_id. For example,
>   bpf_skc_to_tcp(struct sock_common *), or
>   bpf_skc_to_tcp(struct sock *), or
>   bpf_skc_to_tcp(struct inet_sock *), ...
> are all valid. At runtime, the helper will check whether pointer cast
> is legal or not. Please see Patch #5 for details.
> 
> Since btf_id's for both arguments and return value are known at
> build time, the btf_id's are pre-computed once vmlinux btf becomes
> valid. Jiri's "adding d_path helper" patch set
>   https://lore.kernel.org/bpf/20200616100512.2168860-1-jolsa@kernel.org/T/
> provides a way to pre-compute btf id during vmlinux build time.
> This can be applied here as well. A followup patch can convert
> to build time btf id computation after Jiri's patch landed.
> 
> Changelogs:
>   v3 -> v4:
>     - fix bpf_skc_to_{tcp_timewait, tcp_request} helper implementation
>       as just checking sk->sk_state is not enough (Martin)
>     - fix a few kernel test robot reported failures
>     - move bpf_tracing_net.h from libbpf to selftests (Andrii)
>     - remove __weak attribute from selftests CONFIG_HZ variables (Andrii)
>   v2 -> v3:
>     - change sock_cast*/SOCK_CAST* names to btf_sock* names for generality (Martin)
>     - change gpl_license to false (Martin)
>     - fix helper to cast to tcp timewait/request socket. (Martin)
>   v1 -> v2:
>     - guard init_sock_cast_types() defination properly with CONFIG_NET (Martin)
>     - reuse the btf_ids, computed for new helper argument, for return
>       values (Martin)
>     - using BTF_TYPE_EMIT to express intent of btf type generation (Andrii)
>     - abstract out common net macros into bpf_tracing_net.h (Andrii)
Acked-by: Martin KaFai Lau <kafai@...com>