On Wed, Jun 15, 2022 at 6:49 AM Maxim Mikityanskiy <maximmi@xxxxxxxxxx> wrote: > > The first patch of this series is a documentation fix. > > The second patch allows BPF helpers to accept memory regions of fixed > size without doing runtime size checks. > > The two next patches add new functionality that allows XDP to > accelerate iptables synproxy. > > v1 of this series [1] used to include a patch that exposed conntrack > lookup to BPF using stable helpers. It was superseded by series [2] by > Kumar Kartikeya Dwivedi, which implements this functionality using > unstable helpers. > > The third patch adds new helpers to issue and check SYN cookies without > binding to a socket, which is useful in the synproxy scenario. > > The fourth patch adds a selftest, which includes an XDP program and a > userspace control application. The XDP program uses socketless SYN > cookie helpers and queries conntrack status instead of socket status. > The userspace control application allows to tune parameters of the XDP > program. This program also serves as a minimal example of usage of the > new functionality. > > The last two patches expose the new helpers to TC BPF and extend the > selftest. > > The draft of the new functionality was presented on Netdev 0x15 [3]. > > v2 changes: > > Split into two series, submitted bugfixes to bpf, dropped the conntrack > patches, implemented the timestamp cookie in BPF using bpf_loop, dropped > the timestamp cookie patch. > > v3 changes: > > Moved some patches from bpf to bpf-next, dropped the patch that changed > error codes, split the new helpers into IPv4/IPv6, added verifier > functionality to accept memory regions of fixed size. > > v4 changes: > > Converted the selftest to the test_progs runner. Replaced some > deprecated functions in xdp_synproxy userspace helper. > > v5 changes: > > Fixed a bug in the selftest. Added questionable functionality to support > new helpers in TC BPF, added selftests for it. > > v6 changes: > > Wrap the new helpers themselves into #ifdef CONFIG_SYN_COOKIES, replaced > fclose with pclose and fixed the MSS for IPv6 in the selftest. > > v7 changes: > > Fixed the off-by-one error in indices, changed the section name to > "xdp", added missing kernel config options to vmtest in CI. > > v8 changes: > > Properly rebased, dropped the first patch (the same change was applied > by someone else), updated the cover letter. > > v9 changes: > > Fixed selftests for no_alu32. > > v10 changes: > > Selftests for s390x were blacklisted due to lack of support of kfunc, > rebased the series, split selftests to separate commits, created > ARG_PTR_TO_FIXED_SIZE_MEM and packed arg_size, addressed the rest of > comments. Applied. Please follow up with a patch to add: CONFIG_NETFILTER_SYNPROXY=y CONFIG_NETFILTER_XT_TARGET_CT=y CONFIG_NETFILTER_XT_MATCH_STATE=y CONFIG_IP_NF_FILTER=y CONFIG_IP_NF_TARGET_SYNPROXY=y CONFIG_IP_NF_RAW=y to selftests/bpf/config. Otherwise folks will not know what to enable when they see test_synproxy:FAIL:iptables -t raw -I PREROUTING -i tmp1 -p tcp -m tcp --syn --dport 8080 -j CT --notrack unexpected error: 256 (errno 22)
