On Tue, May 10, 2022 at 12:21 PM Maxim Mikityanskiy <maximmi@xxxxxxxxxx> wrote: > > On 2022-05-07 00:51, Andrii Nakryiko wrote: > > On Tue, May 3, 2022 at 10:14 AM Maxim Mikityanskiy <maximmi@xxxxxxxxxx> wrote: > >> > >> The first patch of this series is a documentation fix. > >> > >> The second patch allows BPF helpers to accept memory regions of fixed > >> size without doing runtime size checks. > >> > >> The two next patches add new functionality that allows XDP to > >> accelerate iptables synproxy. > >> > >> v1 of this series [1] used to include a patch that exposed conntrack > >> lookup to BPF using stable helpers. It was superseded by series [2] by > >> Kumar Kartikeya Dwivedi, which implements this functionality using > >> unstable helpers. > >> > >> The third patch adds new helpers to issue and check SYN cookies without > >> binding to a socket, which is useful in the synproxy scenario. > >> > >> The fourth patch adds a selftest, which includes an XDP program and a > >> userspace control application. The XDP program uses socketless SYN > >> cookie helpers and queries conntrack status instead of socket status. > >> The userspace control application allows to tune parameters of the XDP > >> program. This program also serves as a minimal example of usage of the > >> new functionality. > >> > >> The last patch exposes the new helpers to TC BPF. > >> > >> The draft of the new functionality was presented on Netdev 0x15 [3]. > >> > >> v2 changes: > >> > >> Split into two series, submitted bugfixes to bpf, dropped the conntrack > >> patches, implemented the timestamp cookie in BPF using bpf_loop, dropped > >> the timestamp cookie patch. > >> > >> v3 changes: > >> > >> Moved some patches from bpf to bpf-next, dropped the patch that changed > >> error codes, split the new helpers into IPv4/IPv6, added verifier > >> functionality to accept memory regions of fixed size. > >> > >> v4 changes: > >> > >> Converted the selftest to the test_progs runner. Replaced some > >> deprecated functions in xdp_synproxy userspace helper. > >> > >> v5 changes: > >> > >> Fixed a bug in the selftest. Added questionable functionality to support > >> new helpers in TC BPF, added selftests for it. > >> > >> v6 changes: > >> > >> Wrap the new helpers themselves into #ifdef CONFIG_SYN_COOKIES, replaced > >> fclose with pclose and fixed the MSS for IPv6 in the selftest. > >> > >> v7 changes: > >> > >> Fixed the off-by-one error in indices, changed the section name to > >> "xdp", added missing kernel config options to vmtest in CI. > >> > >> v8 changes: > >> > >> Properly rebased, dropped the first patch (the same change was applied > >> by someone else), updated the cover letter. > >> > >> v9 changes: > >> > >> Fixed selftests for no_alu32. > >> > >> [1]: https://lore.kernel.org/bpf/20211020095815.GJ28644@xxxxxxxxxxxxx/t/ > >> [2]: https://lore.kernel.org/bpf/20220114163953.1455836-1-memxor@xxxxxxxxx/ > >> [3]: https://netdevconf.info/0x15/session.html?Accelerating-synproxy-with-XDP > >> > >> Maxim Mikityanskiy (5): > >> bpf: Fix documentation of th_len in bpf_tcp_{gen,check}_syncookie > >> bpf: Allow helpers to accept pointers with a fixed size > >> bpf: Add helpers to issue and check SYN cookies in XDP > >> bpf: Add selftests for raw syncookie helpers > >> bpf: Allow the new syncookie helpers to work with SKBs > >> > > > > Is it expected that your selftests will fail on s390x? Please check [0] > > I see it fails with: > > test_synproxy:FAIL:ethtool -K tmp0 tx off unexpected error: 32512 (errno 2) > > errno 2 is ENOENT, probably the ethtool binary is missing from the s390x > image? When reviewing v6, you said you added ethtool to the CI image. > Maybe it was added to x86_64 only? Could you add it to s390x? > Could be that it was outdated in s390x, but with [0] just merged in it should have pretty recent one. [0] https://github.com/libbpf/ci/pull/16 > [1]: > https://patchwork.kernel.org/project/netdevbpf/patch/20220422172422.4037988-6-maximmi@xxxxxxxxxx/ > > > [0] https://github.com/kernel-patches/bpf/runs/6277764463?check_suite_focus=true#step:6:6130 > > > >> include/linux/bpf.h | 10 + > >> include/net/tcp.h | 1 + > >> include/uapi/linux/bpf.h | 88 +- > >> kernel/bpf/verifier.c | 26 +- > >> net/core/filter.c | 128 +++ > >> net/ipv4/tcp_input.c | 3 +- > >> scripts/bpf_doc.py | 4 + > >> tools/include/uapi/linux/bpf.h | 88 +- > >> tools/testing/selftests/bpf/.gitignore | 1 + > >> tools/testing/selftests/bpf/Makefile | 5 +- > >> .../selftests/bpf/prog_tests/xdp_synproxy.c | 144 +++ > >> .../selftests/bpf/progs/xdp_synproxy_kern.c | 819 ++++++++++++++++++ > >> tools/testing/selftests/bpf/xdp_synproxy.c | 466 ++++++++++ > >> 13 files changed, 1761 insertions(+), 22 deletions(-) > >> create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c > >> create mode 100644 tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c > >> create mode 100644 tools/testing/selftests/bpf/xdp_synproxy.c > >> > >> -- > >> 2.30.2 > >> >
