Currently, when eth_get_headlen calls flow dissector, it doesn't pass any
skb. Because we use passed skb to lookup associated networking namespace
to find whether we have a BPF program attached or not, we always use
C-based flow dissector in this case.
The goal of this patch series is to add new networking namespace argument
to the eth_get_headlen and make BPF flow dissector programs be able to
work in the skb-less case.
The series goes like this:
* use new kernel context (struct bpf_flow_dissector) for flow dissector
programs; this makes it easy to distinguish between skb and no-skb
case and supports calling BPF flow dissector on a chunk of raw data
* convert BPF_PROG_TEST_RUN to use raw data
* plumb network namespace into __skb_flow_dissect from all callers
* handle no-skb case in __skb_flow_dissect
* update eth_get_headlen to include net namespace argument and
convert all existing users
* add selftest to make sure bpf_skb_load_bytes is not allowed in
the no-skb mode
* extend test_progs to exercise skb-less flow dissection as well
* stop adjusting nhoff/thoff by ETH_HLEN in BPF_PROG_TEST_RUN
v6:
* more suggestions by Alexei:
* eth_get_headlen now takes net dev, not net namespace
* test skb-less case via tun eth_get_headlen
* fix return errors in bpf_flow_load
* don't adjust nhoff/thoff by ETH_HLEN
v5:
* API changes have been submitted via bpf/stable tree
v4:
* prohibit access to vlan fields as well (otherwise, inconsistent
between skb/skb-less cases)
* drop extra unneeded check for skb->vlan_present in bpf_flow.c
v3:
* new kernel xdp_buff-like context per Alexei suggestion
* drop skb_net helper
* properly clamp flow_keys->nhoff
v2:
* moved temporary skb from stack into percpu (avoids memset of ~200 bytes
per packet)
* tightened down access to __sk_buff fields from flow dissector programs to
avoid touching shinfo (whitelist only relevant fields)
* addressed suggestions from Willem
Stanislav Fomichev (9):
flow_dissector: switch kernel context to struct bpf_flow_dissector
bpf: when doing BPF_PROG_TEST_RUN for flow dissector use no-skb mode
net: plumb network namespace into __skb_flow_dissect
flow_dissector: handle no-skb use case
net: pass net_device argument to the eth_get_headlen
selftests/bpf: add flow dissector bpf_skb_load_bytes helper test
selftests/bpf: run flow dissector tests in skb-less mode
selftests/bpf: properly return error from bpf_flow_load
bpf/flow_dissector: don't adjust nhoff by ETH_HLEN in
BPF_PROG_TEST_RUN
.../net/ethernet/aquantia/atlantic/aq_ring.c | 3 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
drivers/net/ethernet/hisilicon/hns/hns_enet.c | 2 +-
.../net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +-
drivers/net/ethernet/intel/fm10k/fm10k_main.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 3 +-
drivers/net/ethernet/intel/iavf/iavf_txrx.c | 2 +-
drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +-
drivers/net/ethernet/intel/igb/igb_main.c | 2 +-
drivers/net/ethernet/intel/igc/igc_main.c | 2 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +-
.../net/ethernet/intel/ixgbevf/ixgbevf_main.c | 3 +-
.../net/ethernet/mellanox/mlx5/core/en_tx.c | 2 +-
drivers/net/tun.c | 3 +-
include/linux/etherdevice.h | 2 +-
include/linux/skbuff.h | 28 +++--
include/net/flow_dissector.h | 7 ++
include/net/sch_generic.h | 11 +-
net/bpf/test_run.c | 48 +++-----
net/core/filter.c | 105 ++++++++++++----
net/core/flow_dissector.c | 90 +++++++-------
net/ethernet/eth.c | 8 +-
.../selftests/bpf/flow_dissector_load.c | 2 +-
.../selftests/bpf/flow_dissector_load.h | 24 +++-
.../selftests/bpf/prog_tests/flow_dissector.c | 113 ++++++++++++++++--
.../prog_tests/flow_dissector_load_bytes.c | 48 ++++++++
tools/testing/selftests/bpf/progs/bpf_flow.c | 79 +++++++-----
27 files changed, 411 insertions(+), 186 deletions(-)
create mode 100644 tools/testing/selftests/bpf/prog_tests/flow_dissector_load_bytes.c
--
2.21.0.593.g511ec345e18-goog
