netdev - Re: [PATCH v3 bpf-next 2/2] selftest/bpf: Implement sample UNIX domain socket iterator program.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 6 Aug 2021 16:33:22 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Kuniyuki Iwashima <kuniyu@...zon.co.jp>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...nel.org>,
        Benjamin Herrenschmidt <benh@...zon.com>,
        Kuniyuki Iwashima <kuni1840@...il.com>,
        bpf <bpf@...r.kernel.org>, Networking <netdev@...r.kernel.org>
Subject: Re: [PATCH v3 bpf-next 2/2] selftest/bpf: Implement sample UNIX
 domain socket iterator program.

On Wed, Aug 4, 2021 at 12:09 AM Kuniyuki Iwashima <kuniyu@...zon.co.jp> wrote:
>
> If there are no abstract sockets, this prog can output the same result
> compared to /proc/net/unix.
>
>   # cat /sys/fs/bpf/unix | head -n 2
>   Num       RefCount Protocol Flags    Type St Inode Path
>   ffff9ab7122db000: 00000002 00000000 00010000 0001 01 10623 private/defer
>
>   # cat /proc/net/unix | head -n 2
>   Num       RefCount Protocol Flags    Type St Inode Path
>   ffff9ab7122db000: 00000002 00000000 00010000 0001 01 10623 private/defer
>
> According to the analysis by Yonghong Song (See the link), the BPF verifier
> cannot load the code in the comment to print the name of the abstract UNIX
> domain socket due to LLVM optimisation.  It can be uncommented once the
> LLVM code gen is improved.
>
> Link: https://lore.kernel.org/netdev/1994df05-8f01-371f-3c3b-d33d7836878c@fb.com/

Our patchworks tooling, used to apply patches, is using Link: tag to
record original discussion, so this will be quite confusing if you use
the same "Link: " for referencing relevant discussions. Please use
standard link reference syntax:

According to the analysis by Yonghong Song ([0]), ...

...

  [0] https://lore.kernel.org/netdev/1994df05-8f01-371f-3c3b-d33d7836878c@fb.com/


> Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.co.jp>
> ---
>  .../selftests/bpf/prog_tests/bpf_iter.c       | 16 ++++
>  tools/testing/selftests/bpf/progs/bpf_iter.h  |  8 ++
>  .../selftests/bpf/progs/bpf_iter_unix.c       | 86 +++++++++++++++++++
>  .../selftests/bpf/progs/bpf_tracing_net.h     |  4 +
>  4 files changed, 114 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/progs/bpf_iter_unix.c
>

[...]

> diff --git a/tools/testing/selftests/bpf/progs/bpf_iter.h b/tools/testing/selftests/bpf/progs/bpf_iter.h
> index 3d83b185c4bc..d92648621bcb 100644
> --- a/tools/testing/selftests/bpf/progs/bpf_iter.h
> +++ b/tools/testing/selftests/bpf/progs/bpf_iter.h
> @@ -12,6 +12,7 @@
>  #define tcp6_sock tcp6_sock___not_used
>  #define bpf_iter__udp bpf_iter__udp___not_used
>  #define udp6_sock udp6_sock___not_used
> +#define bpf_iter__unix bpf_iter__unix___not_used
>  #define bpf_iter__bpf_map_elem bpf_iter__bpf_map_elem___not_used
>  #define bpf_iter__bpf_sk_storage_map bpf_iter__bpf_sk_storage_map___not_used
>  #define bpf_iter__sockmap bpf_iter__sockmap___not_used
> @@ -32,6 +33,7 @@
>  #undef tcp6_sock
>  #undef bpf_iter__udp
>  #undef udp6_sock
> +#undef bpf_iter__unix
>  #undef bpf_iter__bpf_map_elem
>  #undef bpf_iter__bpf_sk_storage_map
>  #undef bpf_iter__sockmap
> @@ -103,6 +105,12 @@ struct udp6_sock {
>         struct ipv6_pinfo inet6;
>  } __attribute__((preserve_access_index));
>
> +struct bpf_iter__unix {
> +       struct bpf_iter_meta *meta;
> +       struct unix_sock *unix_sk;
> +       uid_t uid __attribute__((aligned(8)));

just fyi, aligned doesn't matter here, CO-RE will relocate offsets
appropriately anyways

> +} __attribute__((preserve_access_index));
> +
>  struct bpf_iter__bpf_map_elem {
>         struct bpf_iter_meta *meta;
>         struct bpf_map *map;

[...]

> +SEC("iter/unix")
> +int dump_unix(struct bpf_iter__unix *ctx)
> +{
> +       struct unix_sock *unix_sk = ctx->unix_sk;
> +       struct sock *sk = (struct sock *)unix_sk;
> +       struct seq_file *seq;
> +       __u32 seq_num;
> +
> +       if (!unix_sk)
> +               return 0;
> +
> +       seq = ctx->meta->seq;
> +       seq_num = ctx->meta->seq_num;
> +       if (seq_num == 0)
> +               BPF_SEQ_PRINTF(seq, "Num       RefCount Protocol Flags    "
> +                              "Type St Inode Path\n");

nit: please keep format strings on a single line

> +
> +       BPF_SEQ_PRINTF(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
> +                      unix_sk,
> +                      sk->sk_refcnt.refs.counter,
> +                      0,
> +                      sk->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
> +                      sk->sk_type,
> +                      sk->sk_socket ?
> +                      (sk->sk_state == TCP_ESTABLISHED ? SS_CONNECTED : SS_UNCONNECTED) :
> +                      (sk->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING),
> +                      sock_i_ino(sk));
> +

[...]