I'm taking over Alban's work on this.
This series allows sockops programs to access the network namespace
inode and device via (struct bpf_sock_ops)->netns_ino and ->netns_dev.
This can be useful to apply different policies on different network
namespaces.
In the unlikely case where network namespaces are not compiled in
(CONFIG_NET_NS=n), the verifier will generate code to return netns_dev
as usual and will return 0 for netns_ino.
The generated BPF bytecode for netns_ino is loading the correct
inode number at the time of execution.
However, the generated BPF bytecode for netns_dev is loading an
immediate value determined at BPF-load-time by looking at the
initial network namespace. In practice, this works because all netns
currently use the same virtual device. If this was to change, this
code would need to be updated too.
It also adds sockmap and verifier selftests to cover the new fields.
Partial reads work thanks to commit e2f7fc0ac69 ("bpf: fix undefined
behavior in narrow load handling").
v1 patchset can be found at:
https://lkml.org/lkml/2019/4/12/238
Changes since v1:
- add netns_dev (review from Alexei)
- tools/include/uapi/linux/bpf.h: update with netns_dev
- tools/testing/selftests/bpf/test_sockmap_kern.h: print debugs with
- This is a new selftest (review from Song)
v2 patchest can be found at:
https://lkml.org/lkml/2019/4/18/685
Changes since v2:
- replace __u64 by u64 in kernel code (review from Y Song)
- remove unneeded #else branch: program would be rejected in
is_valid_access (review from Y Song)
- allow partial reads (<u64) (review from Y Song)
- standalone patch for the sync (requested by Y Song)
- update commitmsg to refer to netns_ino
- test partial reads on netns_dev (review from Y Song)
- split in two tests
v3 patchset can be found at:
https://lkml.org/lkml/2019/4/26/740
Changes since v3:
- return netns_dev unconditionally and set netns_ino to 0 if
CONFIG_NET_NS is not enabled (review from Jakub Kicinski)
- use bpf_ctx_record_field_size and bpf_ctx_narrow_access_ok instead of
manually deal with partial reads (review from Y Song)
- update commit message to reflect new code and remove note about
partial reads since it was discussed in the review
- use bpf_ctx_range() and offsetofend()
Alban Crequy (4):
bpf: sock ops: add netns ino and dev in bpf context
bpf: sync bpf.h to tools/ for bpf_sock_ops->netns*
selftests: bpf: read netns_ino from struct bpf_sock_ops
selftests: bpf: verifier: read netns_dev and netns_ino from struct
bpf_sock_ops
include/uapi/linux/bpf.h | 2 +
net/core/filter.c | 70 +++++++++++++++++++
tools/include/uapi/linux/bpf.h | 2 +
tools/testing/selftests/bpf/test_sockmap.c | 38 +++++++++-
.../testing/selftests/bpf/test_sockmap_kern.h | 22 ++++++
.../testing/selftests/bpf/verifier/var_off.c | 53 ++++++++++++++
6 files changed, 184 insertions(+), 3 deletions(-)
--
2.21.0
