mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 18:09:57 +00:00
![Jakub Sitnicki](/assets/img/avatar_default.png)
Add a new program type BPF_PROG_TYPE_SK_LOOKUP with a dedicated attach type BPF_SK_LOOKUP. The new program kind is to be invoked by the transport layer when looking up a listening socket for a new connection request for connection oriented protocols, or when looking up an unconnected socket for a packet for connection-less protocols. When called, SK_LOOKUP BPF program can select a socket that will receive the packet. This serves as a mechanism to overcome the limits of what bind() API allows to express. Two use-cases driving this work are: (1) steer packets destined to an IP range, on fixed port to a socket 192.0.2.0/24, port 80 -> NGINX socket (2) steer packets destined to an IP address, on any port to a socket 198.51.100.1, any port -> L7 proxy socket In its run-time context program receives information about the packet that triggered the socket lookup. Namely IP version, L4 protocol identifier, and address 4-tuple. Context can be further extended to include ingress interface identifier. To select a socket BPF program fetches it from a map holding socket references, like SOCKMAP or SOCKHASH, and calls bpf_sk_assign(ctx, sk, ...) helper to record the selection. Transport layer then uses the selected socket as a result of socket lookup. In its basic form, SK_LOOKUP acts as a filter and hence must return either SK_PASS or SK_DROP. If the program returns with SK_PASS, transport should look for a socket to receive the packet, or use the one selected by the program if available, while SK_DROP informs the transport layer that the lookup should fail. This patch only enables the user to attach an SK_LOOKUP program to a network namespace. Subsequent patches hook it up to run on local delivery path in ipv4 and ipv6 stacks. Suggested-by: Marek Majkowski <marek@cloudflare.com> Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200717103536.397595-3-jakub@cloudflare.com
68 lines
1.5 KiB
C
68 lines
1.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _BPF_NETNS_H
|
|
#define _BPF_NETNS_H
|
|
|
|
#include <linux/mutex.h>
|
|
#include <uapi/linux/bpf.h>
|
|
|
|
enum netns_bpf_attach_type {
|
|
NETNS_BPF_INVALID = -1,
|
|
NETNS_BPF_FLOW_DISSECTOR = 0,
|
|
NETNS_BPF_SK_LOOKUP,
|
|
MAX_NETNS_BPF_ATTACH_TYPE
|
|
};
|
|
|
|
static inline enum netns_bpf_attach_type
|
|
to_netns_bpf_attach_type(enum bpf_attach_type attach_type)
|
|
{
|
|
switch (attach_type) {
|
|
case BPF_FLOW_DISSECTOR:
|
|
return NETNS_BPF_FLOW_DISSECTOR;
|
|
case BPF_SK_LOOKUP:
|
|
return NETNS_BPF_SK_LOOKUP;
|
|
default:
|
|
return NETNS_BPF_INVALID;
|
|
}
|
|
}
|
|
|
|
/* Protects updates to netns_bpf */
|
|
extern struct mutex netns_bpf_mutex;
|
|
|
|
union bpf_attr;
|
|
struct bpf_prog;
|
|
|
|
#ifdef CONFIG_NET
|
|
int netns_bpf_prog_query(const union bpf_attr *attr,
|
|
union bpf_attr __user *uattr);
|
|
int netns_bpf_prog_attach(const union bpf_attr *attr,
|
|
struct bpf_prog *prog);
|
|
int netns_bpf_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype);
|
|
int netns_bpf_link_create(const union bpf_attr *attr,
|
|
struct bpf_prog *prog);
|
|
#else
|
|
static inline int netns_bpf_prog_query(const union bpf_attr *attr,
|
|
union bpf_attr __user *uattr)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int netns_bpf_prog_attach(const union bpf_attr *attr,
|
|
struct bpf_prog *prog)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int netns_bpf_prog_detach(const union bpf_attr *attr,
|
|
enum bpf_prog_type ptype)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int netns_bpf_link_create(const union bpf_attr *attr,
|
|
struct bpf_prog *prog)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
#endif
|
|
|
|
#endif /* _BPF_NETNS_H */
|