Commit 2cf69d3f authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'cgroup-helpers' 



Daniel Borkmann says:

====================
This adds various straight-forward helper improvements and additions to BPF
cgroup based connect(), sendmsg(), recvmsg() and bind-related hooks which
would allow to implement more fine-grained policies and improve current load
balancer limitations we're seeing. For details please see individual patches.
I've tested them on Kubernetes & Cilium and also added selftests for the small
verifier extension. Thanks!
====================

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents f54a5bba 23599ada

include/linux/bpf.h

+2 −0
Original line number Diff line number Diff line
@@ -233,6 +233,7 @@ enum bpf_arg_type { 
	ARG_CONST_SIZE_OR_ZERO,	/* number of bytes accessed from memory or 0 */



	ARG_PTR_TO_CTX,		/* pointer to context */

	ARG_PTR_TO_CTX_OR_NULL,	/* pointer to context or NULL */

	ARG_ANYTHING,		/* any (initialized) argument is ok */

	ARG_PTR_TO_SPIN_LOCK,	/* pointer to bpf_spin_lock */

	ARG_PTR_TO_SOCK_COMMON,	/* pointer to sock_common */
@@ -1500,6 +1501,7 @@ extern const struct bpf_func_proto bpf_get_stack_proto; 
extern const struct bpf_func_proto bpf_sock_map_update_proto;

extern const struct bpf_func_proto bpf_sock_hash_update_proto;

extern const struct bpf_func_proto bpf_get_current_cgroup_id_proto;

extern const struct bpf_func_proto bpf_get_current_ancestor_cgroup_id_proto;

extern const struct bpf_func_proto bpf_msg_redirect_hash_proto;

extern const struct bpf_func_proto bpf_msg_redirect_map_proto;

extern const struct bpf_func_proto bpf_sk_redirect_hash_proto;

include/net/cls_cgroup.h

+6 −1
Original line number Diff line number Diff line
@@ -45,9 +45,14 @@ static inline void sock_update_classid(struct sock_cgroup_data *skcd) 
	sock_cgroup_set_classid(skcd, classid);

}



static inline u32 __task_get_classid(struct task_struct *task)

{

	return task_cls_state(task)->classid;

}



static inline u32 task_get_classid(const struct sk_buff *skb)

{

	u32 classid = task_cls_state(current)->classid;

	u32 classid = __task_get_classid(current);



	/* Due to the nature of the classifier it is required to ignore all

	 * packets originating from softirq context as accessing `current'

include/net/net_namespace.h

+10 −0
Original line number Diff line number Diff line
@@ -168,6 +168,9 @@ struct net { 
#ifdef CONFIG_XFRM

	struct netns_xfrm	xfrm;

#endif



	atomic64_t		net_cookie; /* written once */



#if IS_ENABLED(CONFIG_IP_VS)

	struct netns_ipvs	*ipvs;

#endif
@@ -273,6 +276,8 @@ static inline int check_net(const struct net *net) 


void net_drop_ns(void *);



u64 net_gen_cookie(struct net *net);



#else



static inline struct net *get_net(struct net *net)
@@ -300,6 +305,11 @@ static inline int check_net(const struct net *net) 
	return 1;

}



static inline u64 net_gen_cookie(struct net *net)

{

	return 0;

}



#define net_drop_ns NULL

#endif

include/uapi/linux/bpf.h

+34 −1
Original line number Diff line number Diff line
@@ -2950,6 +2950,37 @@ union bpf_attr { 
 *		restricted to raw_tracepoint bpf programs.

 *	Return

 *		0 on success, or a negative error in case of failure.

 *

 * u64 bpf_get_netns_cookie(void *ctx)

 * 	Description

 * 		Retrieve the cookie (generated by the kernel) of the network

 * 		namespace the input *ctx* is associated with. The network

 * 		namespace cookie remains stable for its lifetime and provides

 * 		a global identifier that can be assumed unique. If *ctx* is

 * 		NULL, then the helper returns the cookie for the initial

 * 		network namespace. The cookie itself is very similar to that

 * 		of bpf_get_socket_cookie() helper, but for network namespaces

 * 		instead of sockets.

 * 	Return

 * 		A 8-byte long opaque number.

 *

 * u64 bpf_get_current_ancestor_cgroup_id(int ancestor_level)

 * 	Description

 * 		Return id of cgroup v2 that is ancestor of the cgroup associated

 * 		with the current task at the *ancestor_level*. The root cgroup

 * 		is at *ancestor_level* zero and each step down the hierarchy

 * 		increments the level. If *ancestor_level* == level of cgroup

 * 		associated with the current task, then return value will be the

 * 		same as that of **bpf_get_current_cgroup_id**\ ().

 *

 * 		The helper is useful to implement policies based on cgroups

 * 		that are upper in hierarchy than immediate cgroup associated

 * 		with the current task.

 *

 * 		The format of returned id and helper limitations are same as in

 * 		**bpf_get_current_cgroup_id**\ ().

 * 	Return

 * 		The id is returned or 0 in case the id could not be retrieved.

 */

#define __BPF_FUNC_MAPPER(FN)		\

	FN(unspec),			\
@@ -3073,7 +3104,9 @@ union bpf_attr { 
	FN(jiffies64),			\

	FN(read_branch_records),	\

	FN(get_ns_current_pid_tgid),	\

	FN(xdp_output),

	FN(xdp_output),			\

	FN(get_netns_cookie),		\

	FN(get_current_ancestor_cgroup_id),



/* integer value in 'imm' field of BPF_CALL instruction selects which helper

 * function eBPF program intends to call

kernel/bpf/core.c

+1 −0
Original line number Diff line number Diff line
@@ -2156,6 +2156,7 @@ const struct bpf_func_proto bpf_get_current_pid_tgid_proto __weak; 
const struct bpf_func_proto bpf_get_current_uid_gid_proto __weak;

const struct bpf_func_proto bpf_get_current_comm_proto __weak;

const struct bpf_func_proto bpf_get_current_cgroup_id_proto __weak;

const struct bpf_func_proto bpf_get_current_ancestor_cgroup_id_proto __weak;

const struct bpf_func_proto bpf_get_local_storage_proto __weak;

const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto __weak;