On Wed, Feb 19, 2020 at 11:11 PM Lingpeng Chen <forrest0579@xxxxxxxxx> wrote:
>
> Currently 5-tuple(sip+dip+sport+dport+proto) can't identify a
> uniq connection because there may be multi net namespace.
> For example, there may be a chance that netns a and netns b all
> listen on 127.0.0.1:8080 and the client with same port 40782
> connect to them. Without netns number, sock ops program
> can't distinguish them.
> Using bpf_get_netns_id helper to get current connection
> netns id to distinguish connections.
>
> Signed-off-by: Lingpeng Chen <forrest0579@xxxxxxxxx>
> ---
> include/uapi/linux/bpf.h | 9 ++++++++-
> net/core/filter.c | 20 ++++++++++++++++++++
> 2 files changed, 28 insertions(+), 1 deletion(-)
>
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index f1d74a2bd234..e79082f78b74 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -2892,6 +2892,12 @@ union bpf_attr {
> * Obtain the 64bit jiffies
> * Return
> * The 64 bit jiffies
> + *
> + * u64 bpf_get_netns_id(struct bpf_sock_ops *bpf_socket)
> + * Description
> + * Obtain netns id of sock
> + * Return
> + * The current netns inum
> */
> #define __BPF_FUNC_MAPPER(FN) \
> FN(unspec), \
> @@ -3012,7 +3018,8 @@ union bpf_attr {
> FN(probe_read_kernel_str), \
> FN(tcp_send_ack), \
> FN(send_signal_thread), \
> - FN(jiffies64),
> + FN(jiffies64), \
> + FN(get_netns_id),
>
> /* integer value in 'imm' field of BPF_CALL instruction selects which helper
> * function eBPF program intends to call
> diff --git a/net/core/filter.c b/net/core/filter.c
> index c180871e606d..5302ec9f7c0d 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -4421,6 +4421,24 @@ static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = {
> .arg2_type = ARG_ANYTHING,
> };
>
> +BPF_CALL_1(bpf_get_netns_id_sock_ops, struct bpf_sock_ops_kern *, bpf_sock)
I guess we only need bpf_get_netns_id,
> +{
> +#ifdef CONFIG_NET_NS
> + struct sock *sk = bpf_sock->sk;
> +
> + return (u64)sk->sk_net.net->ns.inum;
> +#else
> + return 0;
> +#endif
> +}
> +
> +static const struct bpf_func_proto bpf_get_netns_id_sock_ops_proto = {
and bpf_get_netns_id_proto.
> + .func = bpf_get_netns_id_sock_ops,
> + .gpl_only = false,
> + .ret_type = RET_INTEGER,
> + .arg1_type = ARG_PTR_TO_CTX,
> +};
> +
> const struct ipv6_bpf_stub *ipv6_bpf_stub __read_mostly;
> EXPORT_SYMBOL_GPL(ipv6_bpf_stub);
>
> @@ -6218,6 +6236,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
> case BPF_FUNC_tcp_sock:
> return &bpf_tcp_sock_proto;
> #endif /* CONFIG_INET */
> + case BPF_FUNC_get_netns_id:
> + return &bpf_get_netns_id_sock_ops_proto;
> default:
> return bpf_base_func_proto(func_id);
> }
> --
> 2.20.1
>
