netdev - Re: [PATCH v3 bpf-next 2/2] selftest/bpf: Implement sample UNIX domain socket iterator program.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Sat, 7 Aug 2021 09:09:58 +0900
From:   Kuniyuki Iwashima <kuniyu@...zon.co.jp>
To:     <andrii.nakryiko@...il.com>
CC:     <andrii@...nel.org>, <ast@...nel.org>, <benh@...zon.com>,
        <bpf@...r.kernel.org>, <daniel@...earbox.net>,
        <davem@...emloft.net>, <john.fastabend@...il.com>, <kafai@...com>,
        <kpsingh@...nel.org>, <kuba@...nel.org>, <kuni1840@...il.com>,
        <kuniyu@...zon.co.jp>, <netdev@...r.kernel.org>,
        <songliubraving@...com>, <yhs@...com>
Subject: Re: [PATCH v3 bpf-next 2/2] selftest/bpf: Implement sample UNIX domain socket iterator program.

From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
Date:   Fri, 6 Aug 2021 16:33:22 -0700
> On Wed, Aug 4, 2021 at 12:09 AM Kuniyuki Iwashima <kuniyu@...zon.co.jp> wrote:
> >
> > If there are no abstract sockets, this prog can output the same result
> > compared to /proc/net/unix.
> >
> >   # cat /sys/fs/bpf/unix | head -n 2
> >   Num       RefCount Protocol Flags    Type St Inode Path
> >   ffff9ab7122db000: 00000002 00000000 00010000 0001 01 10623 private/defer
> >
> >   # cat /proc/net/unix | head -n 2
> >   Num       RefCount Protocol Flags    Type St Inode Path
> >   ffff9ab7122db000: 00000002 00000000 00010000 0001 01 10623 private/defer
> >
> > According to the analysis by Yonghong Song (See the link), the BPF verifier
> > cannot load the code in the comment to print the name of the abstract UNIX
> > domain socket due to LLVM optimisation.  It can be uncommented once the
> > LLVM code gen is improved.
> >
> > Link: https://lore.kernel.org/netdev/1994df05-8f01-371f-3c3b-d33d7836878c@fb.com/
> 
> Our patchworks tooling, used to apply patches, is using Link: tag to
> record original discussion, so this will be quite confusing if you use
> the same "Link: " for referencing relevant discussions. Please use
> standard link reference syntax:
> 
> According to the analysis by Yonghong Song ([0]), ...
> 
> ...
> 
>   [0] https://lore.kernel.org/netdev/1994df05-8f01-371f-3c3b-d33d7836878c@fb.com/

I'll use this format.


> 
> 
> > Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.co.jp>
> > ---
> >  .../selftests/bpf/prog_tests/bpf_iter.c       | 16 ++++
> >  tools/testing/selftests/bpf/progs/bpf_iter.h  |  8 ++
> >  .../selftests/bpf/progs/bpf_iter_unix.c       | 86 +++++++++++++++++++
> >  .../selftests/bpf/progs/bpf_tracing_net.h     |  4 +
> >  4 files changed, 114 insertions(+)
> >  create mode 100644 tools/testing/selftests/bpf/progs/bpf_iter_unix.c
> >
> 
> [...]
> 
> > diff --git a/tools/testing/selftests/bpf/progs/bpf_iter.h b/tools/testing/selftests/bpf/progs/bpf_iter.h
> > index 3d83b185c4bc..d92648621bcb 100644
> > --- a/tools/testing/selftests/bpf/progs/bpf_iter.h
> > +++ b/tools/testing/selftests/bpf/progs/bpf_iter.h
> > @@ -12,6 +12,7 @@
> >  #define tcp6_sock tcp6_sock___not_used
> >  #define bpf_iter__udp bpf_iter__udp___not_used
> >  #define udp6_sock udp6_sock___not_used
> > +#define bpf_iter__unix bpf_iter__unix___not_used
> >  #define bpf_iter__bpf_map_elem bpf_iter__bpf_map_elem___not_used
> >  #define bpf_iter__bpf_sk_storage_map bpf_iter__bpf_sk_storage_map___not_used
> >  #define bpf_iter__sockmap bpf_iter__sockmap___not_used
> > @@ -32,6 +33,7 @@
> >  #undef tcp6_sock
> >  #undef bpf_iter__udp
> >  #undef udp6_sock
> > +#undef bpf_iter__unix
> >  #undef bpf_iter__bpf_map_elem
> >  #undef bpf_iter__bpf_sk_storage_map
> >  #undef bpf_iter__sockmap
> > @@ -103,6 +105,12 @@ struct udp6_sock {
> >         struct ipv6_pinfo inet6;
> >  } __attribute__((preserve_access_index));
> >
> > +struct bpf_iter__unix {
> > +       struct bpf_iter_meta *meta;
> > +       struct unix_sock *unix_sk;
> > +       uid_t uid __attribute__((aligned(8)));
> 
> just fyi, aligned doesn't matter here, CO-RE will relocate offsets
> appropriately anyways

Thank you, I'll remove it.


> 
> > +} __attribute__((preserve_access_index));
> > +
> >  struct bpf_iter__bpf_map_elem {
> >         struct bpf_iter_meta *meta;
> >         struct bpf_map *map;
> 
> [...]
> 
> > +SEC("iter/unix")
> > +int dump_unix(struct bpf_iter__unix *ctx)
> > +{
> > +       struct unix_sock *unix_sk = ctx->unix_sk;
> > +       struct sock *sk = (struct sock *)unix_sk;
> > +       struct seq_file *seq;
> > +       __u32 seq_num;
> > +
> > +       if (!unix_sk)
> > +               return 0;
> > +
> > +       seq = ctx->meta->seq;
> > +       seq_num = ctx->meta->seq_num;
> > +       if (seq_num == 0)
> > +               BPF_SEQ_PRINTF(seq, "Num       RefCount Protocol Flags    "
> > +                              "Type St Inode Path\n");
> 
> nit: please keep format strings on a single line

I'll fix it.

Thanks for review.


> 
> > +
> > +       BPF_SEQ_PRINTF(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
> > +                      unix_sk,
> > +                      sk->sk_refcnt.refs.counter,
> > +                      0,
> > +                      sk->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
> > +                      sk->sk_type,
> > +                      sk->sk_socket ?
> > +                      (sk->sk_state == TCP_ESTABLISHED ? SS_CONNECTED : SS_UNCONNECTED) :
> > +                      (sk->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING),
> > +                      sock_i_ino(sk));
> > +
> 
> [...]