Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Lorenz Bauer <lmb@cloudflare.com>
To: jakub@cloudflare.com, john.fastabend@gmail.com,
	Alexei Starovoitov <ast@kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>
Cc: kernel-team@cloudflare.com, Lorenz Bauer <lmb@cloudflare.com>,
	netdev@vger.kernel.org, bpf@vger.kernel.org
Subject: [PATCH bpf-next 0/6] Allow updating sockmap / sockhash from BPF
Date: Wed, 19 Aug 2020 10:24:30 +0100	[thread overview]
Message-ID: <20200819092436.58232-1-lmb@cloudflare.com> (raw)

We're currently building a control plane for our BPF socket dispatch
work. As part of that, we have a need to create a copy of an existing
sockhash, to allow us to change the keys. I previously proposed allowing
privileged userspace to look up sockets, which doesn't work due to
security concerns (see [1]).

In follow up discussions during BPF office hours we identified bpf_iter
as a possible solution: instead of accessing sockets from user space
we can iterate the source sockhash, and insert the values into a new
map. Enabling this requires two pieces: the ability to iterate
sockmap and sockhash, as well as being able to call map_update_elem
from BPF.

This patch set implements the latter: it's now possible to update
sockmap from BPF context. As a next step, we can implement bpf_iter
for sockmap.

The patches are organised as follows:
* Patches 1-3 are cleanups and simplifications, to make reasoning
  about the subsequent patches easier.
* Patch 4 makes map_update_elem return a PTR_TO_SOCKET_OR_NULL for
  sockmap / sockhash lookups.
* Patch 5 enables map_update_elem from BPF. There is some locking
  here that I'm not entirely sure about. Feedback much appreciated.
* Patch 6 adds a selftest.

1: https://lore.kernel.org/bpf/20200310174711.7490-1-lmb@cloudflare.com/

Lorenz Bauer (6):
  net: sk_msg: simplify sk_psock initialization
  bpf: sockmap: merge sockmap and sockhash update functions
  bpf: sockmap: call sock_map_update_elem directly
  bpf: override the meaning of ARG_PTR_TO_MAP_VALUE for sockmap and
    sockhash
  bpf: sockmap: allow update from BPF
  selftests: bpf: test sockmap update from BPF

 include/linux/bpf.h                           |   7 +
 include/linux/skmsg.h                         |  17 ---
 kernel/bpf/syscall.c                          |   5 +-
 kernel/bpf/verifier.c                         |  46 +++++-
 net/core/skmsg.c                              |  34 ++++-
 net/core/sock_map.c                           | 137 ++++++++----------
 net/ipv4/tcp_bpf.c                            |  13 +-
 net/ipv4/udp_bpf.c                            |   9 +-
 .../selftests/bpf/prog_tests/sockmap_basic.c  |  76 ++++++++++
 .../selftests/bpf/progs/test_sockmap_copy.c   |  48 ++++++
 10 files changed, 274 insertions(+), 118 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/test_sockmap_copy.c

-- 
2.25.1


             reply	other threads:[~2020-08-19  9:37 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-19  9:24 Lorenz Bauer [this message]
2020-08-19  9:24 ` [PATCH bpf-next 1/6] net: sk_msg: simplify sk_psock initialization Lorenz Bauer
2020-08-19 20:05   ` John Fastabend
2020-08-19  9:24 ` [PATCH bpf-next 2/6] bpf: sockmap: merge sockmap and sockhash update functions Lorenz Bauer
2020-08-19 15:48   ` Jakub Kicinski
2020-08-19 18:50   ` Yonghong Song
2020-08-19 20:11   ` John Fastabend
2020-08-19  9:24 ` [PATCH bpf-next 3/6] bpf: sockmap: call sock_map_update_elem directly Lorenz Bauer
2020-08-19 19:15   ` Yonghong Song
2020-08-19 20:29   ` John Fastabend
2020-08-19  9:24 ` [PATCH bpf-next 4/6] bpf: override the meaning of ARG_PTR_TO_MAP_VALUE for sockmap and sockhash Lorenz Bauer
2020-08-19 20:13   ` Yonghong Song
2020-08-20 12:33     ` Lorenz Bauer
2020-08-19 20:51   ` John Fastabend
2020-08-19  9:24 ` [PATCH bpf-next 5/6] bpf: sockmap: allow update from BPF Lorenz Bauer
2020-08-19 20:35   ` Yonghong Song
2020-08-19 21:22   ` John Fastabend
2020-08-19 22:41     ` John Fastabend
2020-08-20 11:33       ` Lorenz Bauer
2020-08-20 14:45         ` Yonghong Song
2020-08-19  9:24 ` [PATCH bpf-next 6/6] selftests: bpf: test sockmap " Lorenz Bauer
2020-08-19 20:45   ` Yonghong Song
2020-08-20 11:58     ` Lorenz Bauer
2020-08-20 14:49       ` Yonghong Song
2020-08-20 16:12         ` Lorenz Bauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200819092436.58232-1-lmb@cloudflare.com \
    --to=lmb@cloudflare.com \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=jakub@cloudflare.com \
    --cc=john.fastabend@gmail.com \
    --cc=kernel-team@cloudflare.com \
    --cc=netdev@vger.kernel.org \
    --subject='Re: [PATCH bpf-next 0/6] Allow updating sockmap / sockhash from BPF' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).