netdev - Re: [PATCH bpf-next v9 0/5] New BPF helpers to accelerate synproxy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAEf4BzYnVK_1J_m-W8UxfFZNhZ1BpbRs=zQWwN3eejvSBJRrXw@mail.gmail.com>
Date:   Tue, 10 May 2022 16:59:34 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Maxim Mikityanskiy <maximmi@...dia.com>
Cc:     bpf <bpf@...r.kernel.org>, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Networking <netdev@...r.kernel.org>,
        Tariq Toukan <tariqt@...dia.com>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Eric Dumazet <edumazet@...gle.com>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        David Ahern <dsahern@...nel.org>,
        Shuah Khan <shuah@...nel.org>,
        Jesper Dangaard Brouer <hawk@...nel.org>,
        Nathan Chancellor <nathan@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Joe Stringer <joe@...ium.io>,
        Florent Revest <revest@...omium.org>,
        "open list:KERNEL SELFTEST FRAMEWORK" 
        <linux-kselftest@...r.kernel.org>,
        Toke Høiland-Jørgensen <toke@...e.dk>,
        Kumar Kartikeya Dwivedi <memxor@...il.com>,
        Florian Westphal <fw@...len.de>, pabeni@...hat.com
Subject: Re: [PATCH bpf-next v9 0/5] New BPF helpers to accelerate synproxy

On Tue, May 10, 2022 at 12:21 PM Maxim Mikityanskiy <maximmi@...dia.com> wrote:
>
> On 2022-05-07 00:51, Andrii Nakryiko wrote:
> > On Tue, May 3, 2022 at 10:14 AM Maxim Mikityanskiy <maximmi@...dia.com> wrote:
> >>
> >> The first patch of this series is a documentation fix.
> >>
> >> The second patch allows BPF helpers to accept memory regions of fixed
> >> size without doing runtime size checks.
> >>
> >> The two next patches add new functionality that allows XDP to
> >> accelerate iptables synproxy.
> >>
> >> v1 of this series [1] used to include a patch that exposed conntrack
> >> lookup to BPF using stable helpers. It was superseded by series [2] by
> >> Kumar Kartikeya Dwivedi, which implements this functionality using
> >> unstable helpers.
> >>
> >> The third patch adds new helpers to issue and check SYN cookies without
> >> binding to a socket, which is useful in the synproxy scenario.
> >>
> >> The fourth patch adds a selftest, which includes an XDP program and a
> >> userspace control application. The XDP program uses socketless SYN
> >> cookie helpers and queries conntrack status instead of socket status.
> >> The userspace control application allows to tune parameters of the XDP
> >> program. This program also serves as a minimal example of usage of the
> >> new functionality.
> >>
> >> The last patch exposes the new helpers to TC BPF.
> >>
> >> The draft of the new functionality was presented on Netdev 0x15 [3].
> >>
> >> v2 changes:
> >>
> >> Split into two series, submitted bugfixes to bpf, dropped the conntrack
> >> patches, implemented the timestamp cookie in BPF using bpf_loop, dropped
> >> the timestamp cookie patch.
> >>
> >> v3 changes:
> >>
> >> Moved some patches from bpf to bpf-next, dropped the patch that changed
> >> error codes, split the new helpers into IPv4/IPv6, added verifier
> >> functionality to accept memory regions of fixed size.
> >>
> >> v4 changes:
> >>
> >> Converted the selftest to the test_progs runner. Replaced some
> >> deprecated functions in xdp_synproxy userspace helper.
> >>
> >> v5 changes:
> >>
> >> Fixed a bug in the selftest. Added questionable functionality to support
> >> new helpers in TC BPF, added selftests for it.
> >>
> >> v6 changes:
> >>
> >> Wrap the new helpers themselves into #ifdef CONFIG_SYN_COOKIES, replaced
> >> fclose with pclose and fixed the MSS for IPv6 in the selftest.
> >>
> >> v7 changes:
> >>
> >> Fixed the off-by-one error in indices, changed the section name to
> >> "xdp", added missing kernel config options to vmtest in CI.
> >>
> >> v8 changes:
> >>
> >> Properly rebased, dropped the first patch (the same change was applied
> >> by someone else), updated the cover letter.
> >>
> >> v9 changes:
> >>
> >> Fixed selftests for no_alu32.
> >>
> >> [1]: https://lore.kernel.org/bpf/20211020095815.GJ28644@breakpoint.cc/t/
> >> [2]: https://lore.kernel.org/bpf/20220114163953.1455836-1-memxor@gmail.com/
> >> [3]: https://netdevconf.info/0x15/session.html?Accelerating-synproxy-with-XDP
> >>
> >> Maxim Mikityanskiy (5):
> >>    bpf: Fix documentation of th_len in bpf_tcp_{gen,check}_syncookie
> >>    bpf: Allow helpers to accept pointers with a fixed size
> >>    bpf: Add helpers to issue and check SYN cookies in XDP
> >>    bpf: Add selftests for raw syncookie helpers
> >>    bpf: Allow the new syncookie helpers to work with SKBs
> >>
> >
> > Is it expected that your selftests will fail on s390x? Please check [0]
>
> I see it fails with:
>
> test_synproxy:FAIL:ethtool -K tmp0 tx off unexpected error: 32512 (errno 2)
>
> errno 2 is ENOENT, probably the ethtool binary is missing from the s390x
> image? When reviewing v6, you said you added ethtool to the CI image.
> Maybe it was added to x86_64 only? Could you add it to s390x?
>

Could be that it was outdated in s390x, but with [0] just merged in it
should have pretty recent one.

  [0] https://github.com/libbpf/ci/pull/16

> [1]:
> https://patchwork.kernel.org/project/netdevbpf/patch/20220422172422.4037988-6-maximmi@nvidia.com/
>
> >    [0] https://github.com/kernel-patches/bpf/runs/6277764463?check_suite_focus=true#step:6:6130
> >
> >>   include/linux/bpf.h                           |  10 +
> >>   include/net/tcp.h                             |   1 +
> >>   include/uapi/linux/bpf.h                      |  88 +-
> >>   kernel/bpf/verifier.c                         |  26 +-
> >>   net/core/filter.c                             | 128 +++
> >>   net/ipv4/tcp_input.c                          |   3 +-
> >>   scripts/bpf_doc.py                            |   4 +
> >>   tools/include/uapi/linux/bpf.h                |  88 +-
> >>   tools/testing/selftests/bpf/.gitignore        |   1 +
> >>   tools/testing/selftests/bpf/Makefile          |   5 +-
> >>   .../selftests/bpf/prog_tests/xdp_synproxy.c   | 144 +++
> >>   .../selftests/bpf/progs/xdp_synproxy_kern.c   | 819 ++++++++++++++++++
> >>   tools/testing/selftests/bpf/xdp_synproxy.c    | 466 ++++++++++
> >>   13 files changed, 1761 insertions(+), 22 deletions(-)
> >>   create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c
> >>   create mode 100644 tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c
> >>   create mode 100644 tools/testing/selftests/bpf/xdp_synproxy.c
> >>
> >> --
> >> 2.30.2
> >>
>