Introduce a new helper that allows assigning a previously-found socket
to the skb as the packet is received towards the stack, to cause the
stack to guide the packet towards that socket subject to local routing
configuration. The intention is to support TProxy use cases more
directly from eBPF programs attached at TC ingress, to simplify and
streamline Linux stack configuration in scale environments with Cilium.
Normally in ip{,6}_rcv_core(), the skb will be orphaned, dropping any
existing socket reference associated with the skb. Existing tproxy
implementations in netfilter get around this restriction by running the
tproxy logic after ip_rcv_core() in the PREROUTING table. However, this
is not an option for TC-based logic (including eBPF programs attached at
TC ingress).
This series introduces the BPF helper bpf_sk_assign() to associate the
socket with the skb on the ingress path as the packet is passed up the
stack. The initial patch in the series simply takes a reference on the
socket to ensure safety, but later patches relax this for listen
sockets.
To ensure delivery to the relevant socket, we still consult the routing
table, for full examples of how to configure see the tests in patch #5;
the simplest form of the route would look like this:
$ ip route add local default dev lo
This series is laid out as follows:
* Patch 1 extends the eBPF API to add sk_assign() and defines a new
socket free function to allow the later paths to understand when the
socket associated with the skb should be kept through receive.
* Patches 2-3 optimize the receive path to avoid taking a reference on
listener sockets during receive.
* Patches 4-5 extends the selftests with examples of the new
functionality and validation of correct behaviour.
Changes since v4:
* Fix build with CONFIG_INET disabled
* Rebase
Changes since v3:
* Use sock_gen_put() directly instead of sock_edemux() from sock_pfree()
* Commit message wording fixups
* Add acks from Martin, Lorenz
* Rebase
Changes since v2:
* Add selftests for UDP socket redirection
* Drop the early demux optimization patch (defer for more testing)
* Fix check for orphaning after TC act return
* Tidy up the tests to clean up properly and be less noisy.
Changes since v1:
* Replace the metadata_dst approach with using the skb->destructor to
determine whether the socket has been prefetched. This is much
simpler.
* Avoid taking a reference on listener sockets during receive
* Restrict assigning sockets across namespaces
* Restrict assigning SO_REUSEPORT sockets
* Fix cookie usage for socket dst check
* Rebase the tests against test_progs infrastructure
* Tidy up commit messages
Joe Stringer (4):
bpf: Add socket assign support
net: Track socket refcounts in skb_steal_sock()
bpf: Don't refcount LISTEN sockets in sk_assign()
selftests: bpf: Extend sk_assign tests for UDP
Lorenz Bauer (1):
selftests: bpf: add test for sk_assign
include/net/inet6_hashtables.h | 3 +-
include/net/inet_hashtables.h | 3 +-
include/net/sock.h | 46 ++-
include/uapi/linux/bpf.h | 25 +-
net/core/filter.c | 35 +-
net/core/sock.c | 12 +
net/ipv4/ip_input.c | 3 +-
net/ipv4/udp.c | 6 +-
net/ipv6/ip6_input.c | 3 +-
net/ipv6/udp.c | 9 +-
net/sched/act_bpf.c | 3 +
tools/include/uapi/linux/bpf.h | 25 +-
.../selftests/bpf/prog_tests/sk_assign.c | 309 ++++++++++++++++++
.../selftests/bpf/progs/test_sk_assign.c | 204 ++++++++++++
14 files changed, 662 insertions(+), 24 deletions(-)
create mode 100644 tools/testing/selftests/bpf/prog_tests/sk_assign.c
create mode 100644 tools/testing/selftests/bpf/progs/test_sk_assign.c
--
2.20.1
