From patchwork Mon Jun 26 23:02:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 113149 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp7812092vqr; Mon, 26 Jun 2023 16:09:35 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6GTeNj+OP56G9MGnSHNU/3ArVfvYCCJgwKJluk3bsFlOLFX88AXkK7OypHT5aOusbRdXqL X-Received: by 2002:a05:6808:2a63:b0:3a1:dac8:9c1f with SMTP id fu3-20020a0568082a6300b003a1dac89c1fmr4283148oib.29.1687820974897; Mon, 26 Jun 2023 16:09:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1687820974; cv=none; d=google.com; s=arc-20160816; b=hniyuKk0KXP4iJ2bZNVcKF0rA5rWfgMkZSAkM5Dffo6VDs+mT1vIf5AeHssfyq4TGX DCw9o56PxwbAyOBZ+0SrtwfDbQU8/Bv13f4xShnZhitCCIneB3ocRsUfO7Lf94jtDo6S 6CAU8veYIroMT2oRAjCok5Nw6iDUXdSVW0H4pfJwDDGAAlRK0zUaTIchIQSop4SOTD/1 57ksWzABi3bUw8c2qYKtxcJ/pC9PEYPNDN+fW2udyboU2fi2Rs0eJkicfxF+eT6xKNX9 bF4nFWf5PARvKMOb2o/9P7AiTSjhyraKsV7LvC0bOJJLyai9q+e7tX3Q9ynSGGqz8d7o c+dw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=6b8JNzZ9nHf7gmJe2DR3IE4e9XIkJuXbimCGs/vSd/M=; fh=X4BkhRPAI3LmvXZRXYHMNdGLcN/9blnffB8mpBf/KLA=; b=UmclUC0sAOuROsximKbKJj4GsbrmPxTZT+Fx8PnA1Sq9gIw+ChAuQCRYsQ/ecTI8ws mEdB2TGmoJSHYDalLSKaJ1+2oMVlPRDMEbCUTu5pQ4jQwo/Fc3W9ufb4zsXHPCT01Dk+ 9gCSNr56Nb/cl7jLWHOC5+yDgL+qZqqqE04YWSOCBdUHjj6cdfqDMP1G3IbtuhOvUzcU 4Wqu4J3rw2x8ysD28t5so036s/G4UkXsS/Ee9NWGV0MxNjTRYGA45/hJZUgypkSAhNLo cg29v8hk/N0syOnkFWINAjZbqfJ7KB7rW5yoq3R4XLiXEhi2ENba78hU4+lPlS9E6L6H 1kJQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=hUlRbSOv; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=GWge2Zbp; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id s15-20020a63dc0f000000b005575a1d0e2csi5814851pgg.269.2023.06.26.16.09.22; Mon, 26 Jun 2023 16:09:34 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=hUlRbSOv; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=GWge2Zbp; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229823AbjFZXCu (ORCPT + 99 others); Mon, 26 Jun 2023 19:02:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51172 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229704AbjFZXCa (ORCPT ); Mon, 26 Jun 2023 19:02:30 -0400 Received: from new3-smtp.messagingengine.com (new3-smtp.messagingengine.com [66.111.4.229]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5D8C110DB; Mon, 26 Jun 2023 16:02:29 -0700 (PDT) Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailnew.nyi.internal (Postfix) with ESMTP id 63445582914; Mon, 26 Jun 2023 19:02:28 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute3.internal (MEProxy); Mon, 26 Jun 2023 19:02:28 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm1; t=1687820548; x= 1687827748; bh=6b8JNzZ9nHf7gmJe2DR3IE4e9XIkJuXbimCGs/vSd/M=; b=h UlRbSOvbGdVTP9mq/hwOXnTs4E0qglcpDth6gzoSTd+vcXWRZxKrvVPjAIBuhIQ7 HqfmDdZTNy3VHPVcJJN/3cNp/cjy1aoBCRIz8emdGW2WNnPPe58ehW3l9B1sWink 44TuFHn6YAgM7gHCRYa8nUzBT6x0oCXnI9M9p7sqoOCRcUqnRWQqKMmjGUPIduXs NSAaWmVdhsZjsldHm8a1JhUXIUBwH3SDdIQ8ONFyULEasv1ii0+5lQFLnWwPyUMY fbOsqy/qYyIaW9V0696iTndrHYvVpfNAniQcjKLbUtCyISZ3cLNni0PBL1wa1gyE eCywaJhT6CHvic7M3x8Ew== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1687820548; x= 1687827748; bh=6b8JNzZ9nHf7gmJe2DR3IE4e9XIkJuXbimCGs/vSd/M=; b=G Wge2ZbpLNg+JUeRkVe2Cp14zoqrHUQ0lGt+tgbhb0ul+PjPEc4ih6F01Vi0DnKM2 e0Q6ghnJCBl3upU1OHC6XVu0EpxJDG5aHSAP9snAALj0vxjmxRgaip+rtzp62aZq 5plzTsTiBnMUzsIFakmFB/iNmMSARpMRnds/UV+JyPPvx8ysSXp3/OuQrcbMIWIl kf3gqaQnM9tKlFAyzvGf0uixTg17KzkqW23NTcJj64guV7E1gorVJ0T+5umye7Vl BXp0RAne132qqvLgBSIw6cY8gYHq39h+KDd+43/jLTQRuKZRjy5uLPZ3wiI6q7UQ ioLtS32RyLb1/tGicxgDQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrgeehgedgudejucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucgfrhhlucfvnfffucdljedtmdenucfjughrpefhvf evufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffrghnihgvlhcuighuuceo ugiguhesugiguhhuuhdrgiihiieqnecuggftrfgrthhtvghrnhepjeegveeljeehvdevud duffffleelveejueegjedvhedvhedvheethfejgedtieeinecuffhomhgrihhnpehnvght fhhilhhtvghrrdhpfhenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrih hlfhhrohhmpegugihusegugihuuhhurdighiii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Mon, 26 Jun 2023 19:02:25 -0400 (EDT) From: Daniel Xu To: daniel@iogearbox.net, edumazet@google.com, kuba@kernel.org, fw@strlen.de, pabeni@redhat.com, pablo@netfilter.org, andrii@kernel.org, davem@davemloft.net, ast@kernel.org, kadlec@netfilter.org Cc: martin.lau@linux.dev, song@kernel.org, yhs@fb.com, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, dsahern@kernel.org Subject: [PATCH bpf-next 4/7] netfilter: bpf: Support BPF_F_NETFILTER_IP_DEFRAG in netfilter link Date: Mon, 26 Jun 2023 17:02:11 -0600 Message-Id: <242c66138bf4ec8aa26b29d736fb48242b4164ce.1687819413.git.dxu@dxuuu.xyz> X-Mailer: git-send-email 2.40.1 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1769808566372937896?= X-GMAIL-MSGID: =?utf-8?q?1769808566372937896?= This commit adds support for enabling IP defrag using pre-existing netfilter defrag support. Basically all the flag does is bump a refcnt while the link the active. Checks are also added to ensure the prog requesting defrag support is run _after_ netfilter defrag hooks. Signed-off-by: Daniel Xu --- include/uapi/linux/bpf.h | 5 ++ net/netfilter/nf_bpf_link.c | 108 +++++++++++++++++++++++++++++---- tools/include/uapi/linux/bpf.h | 5 ++ 3 files changed, 107 insertions(+), 11 deletions(-) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 60a9d59beeab..04ac77481583 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -1170,6 +1170,11 @@ enum bpf_link_type { */ #define BPF_F_KPROBE_MULTI_RETURN (1U << 0) +/* link_create.netfilter.flags used in LINK_CREATE command for + * BPF_PROG_TYPE_NETFILTER to enable IP packet defragmentation. + */ +#define BPF_F_NETFILTER_IP_DEFRAG (1U << 0) + /* When BPF ldimm64's insn[0].src_reg != 0 then this can have * the following extensions: * diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c index c36da56d756f..a8015dbce12a 100644 --- a/net/netfilter/nf_bpf_link.c +++ b/net/netfilter/nf_bpf_link.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 #include #include +#include #include #include @@ -23,8 +24,77 @@ struct bpf_nf_link { struct nf_hook_ops hook_ops; struct net *net; u32 dead; + bool defrag; }; +static int bpf_nf_enable_defrag(struct bpf_nf_link *link) +{ + int err; + + switch (link->hook_ops.pf) { +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) + case NFPROTO_IPV4: + const struct nf_defrag_v4_hook *v4_hook; + + err = request_module("nf_defrag_ipv4"); + if (err) + return err; + + rcu_read_lock(); + v4_hook = rcu_dereference(nf_defrag_v4_hook); + err = v4_hook->enable(link->net); + rcu_read_unlock(); + + return err; +#endif +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + case NFPROTO_IPV6: + const struct nf_defrag_v6_hook *v6_hook; + + err = request_module("nf_defrag_ipv6_hooks"); + if (err) + return err; + + rcu_read_lock(); + v6_hook = rcu_dereference(nf_defrag_v6_hook); + err = v6_hook->enable(link->net); + rcu_read_unlock(); + + return err; +#endif + default: + return -EAFNOSUPPORT; + } +} + +static void bpf_nf_disable_defrag(struct bpf_nf_link *link) +{ + switch (link->hook_ops.pf) { +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) + case NFPROTO_IPV4: + const struct nf_defrag_v4_hook *v4_hook; + + rcu_read_lock(); + v4_hook = rcu_dereference(nf_defrag_v4_hook); + v4_hook->disable(link->net); + rcu_read_unlock(); + + break; +#endif +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + case NFPROTO_IPV6: + const struct nf_defrag_v6_hook *v6_hook; + + rcu_read_lock(); + v6_hook = rcu_dereference(nf_defrag_v6_hook); + v6_hook->disable(link->net); + rcu_read_unlock(); + + break; + } +#endif +} + static void bpf_nf_link_release(struct bpf_link *link) { struct bpf_nf_link *nf_link = container_of(link, struct bpf_nf_link, link); @@ -37,6 +107,9 @@ static void bpf_nf_link_release(struct bpf_link *link) */ if (!cmpxchg(&nf_link->dead, 0, 1)) nf_unregister_net_hook(nf_link->net, &nf_link->hook_ops); + + if (nf_link->defrag) + bpf_nf_disable_defrag(nf_link); } static void bpf_nf_link_dealloc(struct bpf_link *link) @@ -92,6 +165,8 @@ static const struct bpf_link_ops bpf_nf_link_lops = { static int bpf_nf_check_pf_and_hooks(const union bpf_attr *attr) { + int prio; + switch (attr->link_create.netfilter.pf) { case NFPROTO_IPV4: case NFPROTO_IPV6: @@ -102,19 +177,18 @@ static int bpf_nf_check_pf_and_hooks(const union bpf_attr *attr) return -EAFNOSUPPORT; } - if (attr->link_create.netfilter.flags) + if (attr->link_create.netfilter.flags & ~BPF_F_NETFILTER_IP_DEFRAG) return -EOPNOTSUPP; - /* make sure conntrack confirm is always last. - * - * In the future, if userspace can e.g. request defrag, then - * "defrag_requested && prio before NF_IP_PRI_CONNTRACK_DEFRAG" - * should fail. - */ - switch (attr->link_create.netfilter.priority) { - case NF_IP_PRI_FIRST: return -ERANGE; /* sabotage_in and other warts */ - case NF_IP_PRI_LAST: return -ERANGE; /* e.g. conntrack confirm */ - } + /* make sure conntrack confirm is always last */ + prio = attr->link_create.netfilter.priority; + if (prio == NF_IP_PRI_FIRST) + return -ERANGE; /* sabotage_in and other warts */ + else if (prio == NF_IP_PRI_LAST) + return -ERANGE; /* e.g. conntrack confirm */ + else if ((attr->link_create.netfilter.flags & BPF_F_NETFILTER_IP_DEFRAG) && + (prio > NF_IP_PRI_FIRST && prio <= NF_IP_PRI_CONNTRACK_DEFRAG)) + return -ERANGE; /* cannot use defrag if prog runs before nf_defrag */ return 0; } @@ -156,6 +230,18 @@ int bpf_nf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog) return err; } + if (attr->link_create.netfilter.flags & BPF_F_NETFILTER_IP_DEFRAG) { + err = bpf_nf_enable_defrag(link); + if (err) { + bpf_link_cleanup(&link_primer); + return err; + } + /* only mark defrag enabled if enabling succeeds so cleanup path + * doesn't disable without a corresponding enable + */ + link->defrag = true; + } + err = nf_register_net_hook(net, &link->hook_ops); if (err) { bpf_link_cleanup(&link_primer); diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 60a9d59beeab..04ac77481583 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -1170,6 +1170,11 @@ enum bpf_link_type { */ #define BPF_F_KPROBE_MULTI_RETURN (1U << 0) +/* link_create.netfilter.flags used in LINK_CREATE command for + * BPF_PROG_TYPE_NETFILTER to enable IP packet defragmentation. + */ +#define BPF_F_NETFILTER_IP_DEFRAG (1U << 0) + /* When BPF ldimm64's insn[0].src_reg != 0 then this can have * the following extensions: *