From patchwork Fri Jul 7 16:50:16 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 117212 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9f45:0:b0:3ea:f831:8777 with SMTP id v5csp3411488vqx; Fri, 7 Jul 2023 10:06:24 -0700 (PDT) X-Google-Smtp-Source: APBJJlHCrhDWYbr6gHyGxjLIVXgW/8QHvF7tZ9J6stjUCOHGXT44uik7u05vvJX/43oSt39XbpeS X-Received: by 2002:aa7:d349:0:b0:51e:16ae:b6d7 with SMTP id m9-20020aa7d349000000b0051e16aeb6d7mr3900144edr.33.1688749583920; Fri, 07 Jul 2023 10:06:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688749583; cv=none; d=google.com; s=arc-20160816; b=p7mmRZp4+FpQa3o/zU/0zoYTwrQ3xX3bLSDgeEubqdWAbdij0UO8QjcjBVdm4DaHey /N9RVp8zP3Pw4hrUafMDngPlaWdpHnktdLzuPM7fAYdLBssspbzbB8mjVqF/bmsYM7Ve O0HIWYCCTFCng80839rZ2bLUShEKCJullI4c/18WLWpCCSpnyU0Jb/Hi6/CdXvbEuLQV PldbPAAZBAKh0cPlmHgiMbL9owbSJ21BWvHZgbu+X3gDpRpOVnSo+hVhfnfb0+IBpbti cgSIYOs25p8/cPY4wrU09u4eF2oPirupQ5OI9jmYOX/0XaaDSxrQQGjFhAFOh5xWCRwP Zwow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=50Mq7yDH4SaalwjOr9VWbgSV3HaqQVn5wwG7OgrzEBE=; fh=VusOKYt88zM3iWaOywQ/hawvU4RzPdXGLQgarLJkZ1M=; b=tKY79WZa+x8nTiZmUSSvbov4SeY09mfmj7jjPgEgc5Rkma9EyTMu51ibdJzvAyCuaA 4hhbEMziBgIuPjAKRUGH82szsXgXABvJ1FttiU7Nt0E4S0Mg/JdKZiveoITCB7SrqM6d Balz5NnV4/p4I350MqQz8gbsGUOlWWxh6jgxzKv0jGcymtB9Fm4IOfl13GvQwPEPaMpN EbXGba44hak6mTuR/Sf5hhg0Mb0JtFpuwljxcP7Th9jiNgvDij3adqY54lzPgEkdhSwf okVqdR5TGqqBIaR4TkaEEwurVk4o4YW7Y+llxg6CjxPqiiyEgrMyYpuq1pqp1HoxFrHW i4GA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=OfqFSHot; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=DNp3goPr; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id u6-20020a05640207c600b0051e19aae8d1si2424006edy.378.2023.07.07.10.06.00; Fri, 07 Jul 2023 10:06:23 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=OfqFSHot; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=DNp3goPr; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232910AbjGGQvJ (ORCPT + 99 others); Fri, 7 Jul 2023 12:51:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59658 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231594AbjGGQvG (ORCPT ); Fri, 7 Jul 2023 12:51:06 -0400 Received: from wout3-smtp.messagingengine.com (wout3-smtp.messagingengine.com [64.147.123.19]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9120B210C; Fri, 7 Jul 2023 09:51:05 -0700 (PDT) Received: from compute2.internal (compute2.nyi.internal [10.202.2.46]) by mailout.west.internal (Postfix) with ESMTP id DC9EB320015C; Fri, 7 Jul 2023 12:51:03 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute2.internal (MEProxy); Fri, 07 Jul 2023 12:51:05 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm1; t=1688748663; x= 1688835063; bh=50Mq7yDH4SaalwjOr9VWbgSV3HaqQVn5wwG7OgrzEBE=; b=O fqFSHotl5MPw+omR7FqaSYyuuht7W7DDKg+v2/eHGO1wiruemdRLo1MTeEaSxivu s0RqOqhl4TFy4MgwyB4y9pfFdIHne6J062sLfU9D9ZnbB8TpHa13+MCwHJTNR3Pd ziLU2yztrAr5IEK8z4JTnpozUddATvo+j/auSNyRTkzoeM2lPRp6Peun6mMavK6y 197s9men4fwMgPuiWCLujuhJ4L7PDLsyZKK5ZxqoyvkRAQuHUwLLfkwONCmcu6qJ k7m9G86SQbFaB8Y95lt7N2uu88MhVOKWEBERHBWC3bVK5dEOFAylvWalPVSpmXBd blu7/MSzz303GiEMx0ioA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1688748663; x= 1688835063; bh=50Mq7yDH4SaalwjOr9VWbgSV3HaqQVn5wwG7OgrzEBE=; b=D Np3goPrOcaNvkVar8Cni9qJJJxRiaNmv68DIU97gBo83H1Shc3FaPPL9oTLGfT7w dScyySdJRWCiMJJ9bge8rxrHAamfreAqNRiLBCFxBCPWuFw4cmpOFSN6xw4JHGmw XOBKoAzWz9QJ3NSbvWsbw6lxVKgEcUYX9Uk0WCzPapCEj4ZXro8wKYdYDCKyibh5 5d0zn8nCfiNT2q1GIo6msaVFV8uxw9iROpCVRmGKNZ/QoveToLk4v4svwTSiSfu0 rtES0SaHXVtkEKv+EPPQUmX/pXX+GZBKLQosL6RIIJwu1uTt/DwdjX1Y0Km+h21b +dXMHUSiB7lnsy9SNntdg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedviedrvddugddutdehucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucgfrhhlucfvnfffucdljedtmdenucfjughrpefhvf evufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffrghnihgvlhcuighuuceo ugiguhesugiguhhuuhdrgiihiieqnecuggftrfgrthhtvghrnhepgfefgfegjefhudeike dvueetffelieefuedvhfehjeeljeejkefgffeghfdttdetnecuvehluhhsthgvrhfuihii vgeptdenucfrrghrrghmpehmrghilhhfrhhomhepugiguhesugiguhhuuhdrgiihii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 7 Jul 2023 12:51:02 -0400 (EDT) From: Daniel Xu To: pablo@netfilter.org, kuba@kernel.org, edumazet@google.com, davem@davemloft.net, kadlec@netfilter.org, pabeni@redhat.com, dsahern@kernel.org, fw@strlen.de, daniel@iogearbox.net Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH bpf-next v3 1/6] netfilter: defrag: Add glue hooks for enabling/disabling defrag Date: Fri, 7 Jul 2023 10:50:16 -0600 Message-ID: <8a20b0a3fff75bce1bed207631fe4f56abc3e99d.1688748455.git.dxu@dxuuu.xyz> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,SPF_PASS, T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1770782283764969008?= X-GMAIL-MSGID: =?utf-8?q?1770782283764969008?= We want to be able to enable/disable IP packet defrag from core bpf/netfilter code. In other words, execute code from core that could possibly be built as a module. To help avoid symbol resolution errors, use glue hooks that the modules will register callbacks with during module init. Signed-off-by: Daniel Xu Reviewed-by: Florian Westphal --- include/linux/netfilter.h | 12 ++++++++++++ net/ipv4/netfilter/nf_defrag_ipv4.c | 16 +++++++++++++++- net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 10 ++++++++++ net/netfilter/core.c | 6 ++++++ 4 files changed, 43 insertions(+), 1 deletion(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index d4fed4c508ca..77a637b681f2 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -481,6 +481,18 @@ struct nfnl_ct_hook { }; extern const struct nfnl_ct_hook __rcu *nfnl_ct_hook; +struct nf_defrag_v4_hook { + int (*enable)(struct net *net); + void (*disable)(struct net *net); +}; +extern const struct nf_defrag_v4_hook __rcu *nf_defrag_v4_hook; + +struct nf_defrag_v6_hook { + int (*enable)(struct net *net); + void (*disable)(struct net *net); +}; +extern const struct nf_defrag_v6_hook __rcu *nf_defrag_v6_hook; + /* * nf_skb_duplicated - TEE target has sent a packet * diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c index e61ea428ea18..1f3e0e893b7a 100644 --- a/net/ipv4/netfilter/nf_defrag_ipv4.c +++ b/net/ipv4/netfilter/nf_defrag_ipv4.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include #include @@ -113,17 +114,30 @@ static void __net_exit defrag4_net_exit(struct net *net) } } +static const struct nf_defrag_v4_hook defrag_hook = { + .enable = nf_defrag_ipv4_enable, + .disable = nf_defrag_ipv4_disable, +}; + static struct pernet_operations defrag4_net_ops = { .exit = defrag4_net_exit, }; static int __init nf_defrag_init(void) { - return register_pernet_subsys(&defrag4_net_ops); + int err; + + err = register_pernet_subsys(&defrag4_net_ops); + if (err) + return err; + + rcu_assign_pointer(nf_defrag_v4_hook, &defrag_hook); + return err; } static void __exit nf_defrag_fini(void) { + rcu_assign_pointer(nf_defrag_v4_hook, NULL); unregister_pernet_subsys(&defrag4_net_ops); } diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c index cb4eb1d2c620..f7c7ee31c472 100644 --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include @@ -96,6 +97,11 @@ static void __net_exit defrag6_net_exit(struct net *net) } } +static const struct nf_defrag_v6_hook defrag_hook = { + .enable = nf_defrag_ipv6_enable, + .disable = nf_defrag_ipv6_disable, +}; + static struct pernet_operations defrag6_net_ops = { .exit = defrag6_net_exit, }; @@ -114,6 +120,9 @@ static int __init nf_defrag_init(void) pr_err("nf_defrag_ipv6: can't register pernet ops\n"); goto cleanup_frag6; } + + rcu_assign_pointer(nf_defrag_v6_hook, &defrag_hook); + return ret; cleanup_frag6: @@ -124,6 +133,7 @@ static int __init nf_defrag_init(void) static void __exit nf_defrag_fini(void) { + rcu_assign_pointer(nf_defrag_v6_hook, NULL); unregister_pernet_subsys(&defrag6_net_ops); nf_ct_frag6_cleanup(); } diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 5f76ae86a656..34845155bb85 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -680,6 +680,12 @@ EXPORT_SYMBOL_GPL(nfnl_ct_hook); const struct nf_ct_hook __rcu *nf_ct_hook __read_mostly; EXPORT_SYMBOL_GPL(nf_ct_hook); +const struct nf_defrag_v4_hook __rcu *nf_defrag_v4_hook __read_mostly; +EXPORT_SYMBOL_GPL(nf_defrag_v4_hook); + +const struct nf_defrag_v6_hook __rcu *nf_defrag_v6_hook __read_mostly; +EXPORT_SYMBOL_GPL(nf_defrag_v6_hook); + #if IS_ENABLED(CONFIG_NF_CONNTRACK) u8 nf_ctnetlink_has_listener; EXPORT_SYMBOL_GPL(nf_ctnetlink_has_listener); From patchwork Fri Jul 7 16:50:17 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 117209 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9f45:0:b0:3ea:f831:8777 with SMTP id v5csp3402089vqx; Fri, 7 Jul 2023 09:52:51 -0700 (PDT) X-Google-Smtp-Source: APBJJlFJJXD+mH3jV/JomTf5pUBPlX6bv7wOZ0ibiHoAT4Kvbw81u1VUSVTiKqENmnFh6cEhFMdF X-Received: by 2002:a17:903:230b:b0:1b8:9461:6729 with SMTP id d11-20020a170903230b00b001b894616729mr6469453plh.2.1688748771099; Fri, 07 Jul 2023 09:52:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688748771; cv=none; d=google.com; s=arc-20160816; b=QyDjqs96U+8aE0sAckCkVQGoaxn9B5Frwc0TZYLL+sZK91kNm4o1J4SW54IS7lBnBH AKCbvWxjqbGmj4k29by/D2TizcarZj5SOf7I7AUAp1Q74rx/gW0Kg2aBhUR57wgNfgbE +RMTO1RfCe5WNsgOTftDR/RXpOr9gUWQ+LO5CtbXg+L3yg2HiztTSAI0IwYgEH4HihGi aNwse1Zx1fP9NOHCcleDCSdFyvj0NozPmPm6BrEnI37b49QIO22MOFLgt9g8+zGM0L4B aqTgYihWrK0fULFi6M+HTzAAEIefwXfEQPbPzq8Ico6nLePOC8gTs0JBDiTiHHlZURdI YLCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=VezMYB4YicTitKIY+TkEFPi41YfCsLE9uPWHuApXvaI=; fh=wU41e3yXtxQHl3wYNxs+WjCc4AuGpMNbqqWrws1ssUw=; b=Of/dFRuCnZfFe0ZWTavYjEiiTxktBHXBzUGKVLJaJsHZO/I6fvNctOCw8aBsGT4/AQ 7969Kz+VrpfoP0bMYUVkmld/WPezOutA5QXRGLsIW0FmYYSvwhXLubvaMIHDO039wBDQ Pt6vEYGAS/OhQH+RuOkXGClk90+MbdWGHfwaHG41aOfCQhciCFnPMBgdSOoHHWJzZOrg +jLWCn2QU5ejjDNNh+lJTv0saiKUIX7eaMiXK/s827JpxX6X+8cQP5TS/zgT+pboW0HB YE99t7qjCfj/zQyuygmiYk1NM/Stm6uCnF9cV8FhwnbeBLRK2Ztcpojm56yq78z1iGX5 3I5Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=oIXiUHeK; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=HMuEc9RH; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id km15-20020a17090327cf00b001b82a4d3ea7si3782796plb.249.2023.07.07.09.52.38; Fri, 07 Jul 2023 09:52:51 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=oIXiUHeK; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=HMuEc9RH; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232920AbjGGQvQ (ORCPT + 99 others); Fri, 7 Jul 2023 12:51:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59758 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232931AbjGGQvO (ORCPT ); Fri, 7 Jul 2023 12:51:14 -0400 Received: from wnew2-smtp.messagingengine.com (wnew2-smtp.messagingengine.com [64.147.123.27]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A61C72119; Fri, 7 Jul 2023 09:51:11 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailnew.west.internal (Postfix) with ESMTP id DC54C2B00067; Fri, 7 Jul 2023 12:51:07 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute1.internal (MEProxy); Fri, 07 Jul 2023 12:51:10 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm1; t=1688748667; x= 1688755867; bh=VezMYB4YicTitKIY+TkEFPi41YfCsLE9uPWHuApXvaI=; b=o IXiUHeK5rYHaRz2mqUJCyH3N7bpSNlHaNTW53lDL6vwB2H0bcYaN07Y7226GYkZG CPCGMBOEIFzA2mhPXV9tikdNF21/Q+u8G3ohcfvmJFU1xNpQ3I2KUtoFNhO4kEbc CrH685S3GxYnwQX1QpIS4htQOQnu/gVH6m9GAKlcyh88dGTACsE493tGFcn0hrzf Vbmby9DLnkapCZvsXVwTGR2yxi71CJFxybCulaohdFWraWiZV9og5iEFZtDT/I/2 T3IgTjhyw1LZdCnASBYLzNXEoLrVOeA/8EAYsEoE33EE9pVqOk5QwMtU/+/khDUJ L0RullPKDWNZd5QiD3G0Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1688748667; x= 1688755867; bh=VezMYB4YicTitKIY+TkEFPi41YfCsLE9uPWHuApXvaI=; b=H MuEc9RHecFlhMQYG0dl1lRWw+hZmdNIhXk+e5syBdN8CqQmpONt87rWZ47kt4D4A 1VeIfRu/v9ZlGNNleTshTn20cGXe8Cbf2gWdb8keFco3jHmepG3OUTpScCxdWv4T 1HU2VTLV6/ixqGj6n4x4gv/3xD3RkB3Ie5nCC5Ar+AgxIlRW94e84Nu0VUh3LWP4 c79QtK/S8k2tQ+44e9+OtErD4B3Mb2oAj1bUgmt8nLMh2mCwWbVTXxLWYUWLFfIw xjeHmA3PGCHTOKc9lC6fgheF4Hr3We9jSjJJn7sPMluUrPoSLjW+k7Mfdt6cnfCY tyQsACjwt5ZrAwg93dzmw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedviedrvddugddutdehucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucgfrhhlucfvnfffucdljedtmdenucfjughrpefhvf evufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffrghnihgvlhcuighuuceo ugiguhesugiguhhuuhdrgiihiieqnecuggftrfgrthhtvghrnhepjeegveeljeehvdevud duffffleelveejueegjedvhedvhedvheethfejgedtieeinecuffhomhgrihhnpehnvght fhhilhhtvghrrdhpfhenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrih hlfhhrohhmpegugihusegugihuuhhurdighiii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 7 Jul 2023 12:51:05 -0400 (EDT) From: Daniel Xu To: ast@kernel.org, kuba@kernel.org, daniel@iogearbox.net, davem@davemloft.net, edumazet@google.com, kadlec@netfilter.org, andrii@kernel.org, pabeni@redhat.com, pablo@netfilter.org, fw@strlen.de Cc: martin.lau@linux.dev, song@kernel.org, yhs@fb.com, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, dsahern@kernel.org Subject: [PATCH bpf-next v3 2/6] netfilter: bpf: Support BPF_F_NETFILTER_IP_DEFRAG in netfilter link Date: Fri, 7 Jul 2023 10:50:17 -0600 Message-ID: <3b1c20ea7eb2f77065c683e21a2a5d457a57011d.1688748455.git.dxu@dxuuu.xyz> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1770781431356576063?= X-GMAIL-MSGID: =?utf-8?q?1770781431356576063?= This commit adds support for enabling IP defrag using pre-existing netfilter defrag support. Basically all the flag does is bump a refcnt while the link the active. Checks are also added to ensure the prog requesting defrag support is run _after_ netfilter defrag hooks. Signed-off-by: Daniel Xu Reviewed-by: Florian Westphal --- include/uapi/linux/bpf.h | 5 ++ net/netfilter/nf_bpf_link.c | 129 ++++++++++++++++++++++++++++++--- tools/include/uapi/linux/bpf.h | 5 ++ 3 files changed, 128 insertions(+), 11 deletions(-) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 60a9d59beeab..04ac77481583 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -1170,6 +1170,11 @@ enum bpf_link_type { */ #define BPF_F_KPROBE_MULTI_RETURN (1U << 0) +/* link_create.netfilter.flags used in LINK_CREATE command for + * BPF_PROG_TYPE_NETFILTER to enable IP packet defragmentation. + */ +#define BPF_F_NETFILTER_IP_DEFRAG (1U << 0) + /* When BPF ldimm64's insn[0].src_reg != 0 then this can have * the following extensions: * diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c index c36da56d756f..5b72aa246577 100644 --- a/net/netfilter/nf_bpf_link.c +++ b/net/netfilter/nf_bpf_link.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 #include #include +#include #include #include @@ -23,8 +24,98 @@ struct bpf_nf_link { struct nf_hook_ops hook_ops; struct net *net; u32 dead; + bool defrag; }; +static int bpf_nf_enable_defrag(struct bpf_nf_link *link) +{ + const struct nf_defrag_v4_hook __maybe_unused *v4_hook; + const struct nf_defrag_v6_hook __maybe_unused *v6_hook; + int err; + + switch (link->hook_ops.pf) { +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) + case NFPROTO_IPV4: + rcu_read_lock(); + v4_hook = rcu_dereference(nf_defrag_v4_hook); + if (!v4_hook) { + rcu_read_unlock(); + err = request_module("nf_defrag_ipv4"); + if (err) + return err < 0 ? err : -EINVAL; + + rcu_read_lock(); + v4_hook = rcu_dereference(nf_defrag_v4_hook); + if (!v4_hook) { + WARN_ONCE(1, "nf_defrag_ipv4 bad registration"); + err = -ENOENT; + goto out_v4; + } + } + + err = v4_hook->enable(link->net); +out_v4: + rcu_read_unlock(); + return err; +#endif +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + case NFPROTO_IPV6: + rcu_read_lock(); + v6_hook = rcu_dereference(nf_defrag_v6_hook); + if (!v6_hook) { + rcu_read_unlock(); + err = request_module("nf_defrag_ipv6"); + if (err) + return err < 0 ? err : -EINVAL; + + rcu_read_lock(); + v6_hook = rcu_dereference(nf_defrag_v6_hook); + if (!v6_hook) { + WARN_ONCE(1, "nf_defrag_ipv6_hooks bad registration"); + err = -ENOENT; + goto out_v6; + } + } + + err = v6_hook->enable(link->net); +out_v6: + rcu_read_unlock(); + return err; +#endif + default: + return -EAFNOSUPPORT; + } +} + +static void bpf_nf_disable_defrag(struct bpf_nf_link *link) +{ + const struct nf_defrag_v4_hook __maybe_unused *v4_hook; + const struct nf_defrag_v6_hook __maybe_unused *v6_hook; + + switch (link->hook_ops.pf) { +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) + case NFPROTO_IPV4: + rcu_read_lock(); + v4_hook = rcu_dereference(nf_defrag_v4_hook); + if (v4_hook) + v4_hook->disable(link->net); + rcu_read_unlock(); + + break; +#endif +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + case NFPROTO_IPV6: + rcu_read_lock(); + v6_hook = rcu_dereference(nf_defrag_v6_hook); + if (v6_hook) + v6_hook->disable(link->net); + rcu_read_unlock(); + + break; + } +#endif +} + static void bpf_nf_link_release(struct bpf_link *link) { struct bpf_nf_link *nf_link = container_of(link, struct bpf_nf_link, link); @@ -37,6 +128,9 @@ static void bpf_nf_link_release(struct bpf_link *link) */ if (!cmpxchg(&nf_link->dead, 0, 1)) nf_unregister_net_hook(nf_link->net, &nf_link->hook_ops); + + if (nf_link->defrag) + bpf_nf_disable_defrag(nf_link); } static void bpf_nf_link_dealloc(struct bpf_link *link) @@ -92,6 +186,8 @@ static const struct bpf_link_ops bpf_nf_link_lops = { static int bpf_nf_check_pf_and_hooks(const union bpf_attr *attr) { + int prio; + switch (attr->link_create.netfilter.pf) { case NFPROTO_IPV4: case NFPROTO_IPV6: @@ -102,19 +198,18 @@ static int bpf_nf_check_pf_and_hooks(const union bpf_attr *attr) return -EAFNOSUPPORT; } - if (attr->link_create.netfilter.flags) + if (attr->link_create.netfilter.flags & ~BPF_F_NETFILTER_IP_DEFRAG) return -EOPNOTSUPP; - /* make sure conntrack confirm is always last. - * - * In the future, if userspace can e.g. request defrag, then - * "defrag_requested && prio before NF_IP_PRI_CONNTRACK_DEFRAG" - * should fail. - */ - switch (attr->link_create.netfilter.priority) { - case NF_IP_PRI_FIRST: return -ERANGE; /* sabotage_in and other warts */ - case NF_IP_PRI_LAST: return -ERANGE; /* e.g. conntrack confirm */ - } + /* make sure conntrack confirm is always last */ + prio = attr->link_create.netfilter.priority; + if (prio == NF_IP_PRI_FIRST) + return -ERANGE; /* sabotage_in and other warts */ + else if (prio == NF_IP_PRI_LAST) + return -ERANGE; /* e.g. conntrack confirm */ + else if ((attr->link_create.netfilter.flags & BPF_F_NETFILTER_IP_DEFRAG) && + prio <= NF_IP_PRI_CONNTRACK_DEFRAG) + return -ERANGE; /* cannot use defrag if prog runs before nf_defrag */ return 0; } @@ -156,6 +251,18 @@ int bpf_nf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog) return err; } + if (attr->link_create.netfilter.flags & BPF_F_NETFILTER_IP_DEFRAG) { + err = bpf_nf_enable_defrag(link); + if (err) { + bpf_link_cleanup(&link_primer); + return err; + } + /* only mark defrag enabled if enabling succeeds so cleanup path + * doesn't disable without a corresponding enable + */ + link->defrag = true; + } + err = nf_register_net_hook(net, &link->hook_ops); if (err) { bpf_link_cleanup(&link_primer); diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 60a9d59beeab..04ac77481583 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -1170,6 +1170,11 @@ enum bpf_link_type { */ #define BPF_F_KPROBE_MULTI_RETURN (1U << 0) +/* link_create.netfilter.flags used in LINK_CREATE command for + * BPF_PROG_TYPE_NETFILTER to enable IP packet defragmentation. + */ +#define BPF_F_NETFILTER_IP_DEFRAG (1U << 0) + /* When BPF ldimm64's insn[0].src_reg != 0 then this can have * the following extensions: * From patchwork Fri Jul 7 16:50:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 117220 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9f45:0:b0:3ea:f831:8777 with SMTP id v5csp3415662vqx; Fri, 7 Jul 2023 10:12:17 -0700 (PDT) X-Google-Smtp-Source: APBJJlFkE/T0DdpoKz6nZk7j/kE+iVKOcTyzMlmEh24XVoJ0qZ1TMnkC16DFKMSVhWO+B/Mu4tQy X-Received: by 2002:a17:907:8184:b0:992:6656:4043 with SMTP id iy4-20020a170907818400b0099266564043mr4114748ejc.53.1688749937109; Fri, 07 Jul 2023 10:12:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688749937; cv=none; d=google.com; s=arc-20160816; b=PUar0eRiYPsjq7zx4FAjsHKjXSLL5v5Qi1XT8Rwe3GvylYzVr3cXu8Uqa9EsBEKZUq HyTzv5sL0oplTEYQaAzMjb4F47eObMuu4dpFHWCZRwPo+1qjLMpaRnywxaKXUNB+qo+H fJI6oyG/MXGxXe2j0mniz7uEiWI9S/Hc0ujU0CTYhkrt3zqDb0OVDYl9pI0TynuR2exI pIzeEEmy+/atvYWsxpiA2n8aR3lyvS9iSLaybm+oGCjmWKy0bQOnyXZU0V6pX/9JMlOi ubGqCB98j9ZEmpVnkSnUFpiWG7FSHLdbi1Lr6LbdslLmSI9A7pmmjPPYxKsQ0PqbHPJs VDcQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=FoKm3yKhKCBi4WaMIZuBtdvEh2SuGoVcGT/CE3PLqoA=; fh=VusOKYt88zM3iWaOywQ/hawvU4RzPdXGLQgarLJkZ1M=; b=x+ZPUs36WGnfjS8vyZeOIcWqn1fZhULO6x6ru5UO78Ldujs6sRg2pOrew0Qk2uKl6b GyUA9cc/aZ2yy8wdOtIeb/vZ4Kkk+RDECftiaPmPMK5Wc6vArGA+F816yMb8PyBPn/ei SFUcDWLw5DHir9EO4THEp9J9/BlmkICU0Z8j3u+tu768Khr6lcq4aL8FjjM5rv4efole E0mIRkXZVJqAnJmS2GR1NDLcDIGU/2hI0+hIMTBzBt7kiMFYcgcdIuhH/FwuuYkAGREP s3Z69RpvN6gY3TQUFA+dlCuovch5asz2mYvtP1o3Ca0dkUXA6TpKaM4szOzU2W9c/OjD 0Jxg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=CpxGoRIp; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=QDfYGk3x; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id z12-20020a170906240c00b009934b1eb56dsi2366689eja.11.2023.07.07.10.11.52; Fri, 07 Jul 2023 10:12:17 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=CpxGoRIp; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=QDfYGk3x; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232960AbjGGQvT (ORCPT + 99 others); Fri, 7 Jul 2023 12:51:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59770 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232941AbjGGQvO (ORCPT ); Fri, 7 Jul 2023 12:51:14 -0400 Received: from wout3-smtp.messagingengine.com (wout3-smtp.messagingengine.com [64.147.123.19]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ACD5D213F; Fri, 7 Jul 2023 09:51:13 -0700 (PDT) Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.west.internal (Postfix) with ESMTP id 10E5E3200938; Fri, 7 Jul 2023 12:51:11 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute3.internal (MEProxy); Fri, 07 Jul 2023 12:51:13 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm1; t=1688748671; x= 1688835071; bh=FoKm3yKhKCBi4WaMIZuBtdvEh2SuGoVcGT/CE3PLqoA=; b=C pxGoRIpbUCuQHC1kMtptwC/nXVPgw0FdIcUX373heYLLSE+iGY3QDgw8Qog8iUwQ FuOb63921KrskCllt6uThhF8DgKihR0Dgr1/N9/KywDhfNELwfbB8vD/oLNRHstt srYuTzk1cJYOOQ+yMUNlsE+i8028Pg7OUPSiuXw0t+RLVHTTS6idix1IWtuXYGtZ u0WWDg085T8oFNsOsBs5Rrr+L/Rm5NUO42EWxD03GqX4+8fmGC4uxu/yvWmjfJK2 CwrXRhRSuqc4QCcqGIsBTPPnwsI3Xzotc3iJEgZ27F7TEpCAvIa4cUctYaqFWDNo VWzPEZL5WeT+JbGIoN0/A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1688748671; x= 1688835071; bh=FoKm3yKhKCBi4WaMIZuBtdvEh2SuGoVcGT/CE3PLqoA=; b=Q DfYGk3xUcWSyYfR+RC0Us6MfKvC4LXJ1CAQ689aBL9chjm3Tr8sVAL5nva/k11im 7qAHuv+ZdnDBsO03LPe/ScxLuir6zTE9B3hmJII1cDHaHbGkedNjm4bfm2edWuqC U39FP9vizPXpWmkEl8QnCJ18mlanbZ+COxb/+1DlRfFQmFxtkpboE9jaGUddznvg fcrvbpxOqBdR83kdwNLPQH8Oi1BsBXBG7NvsYWs/W7vNwVH/suB/R/MwE49bOwB1 8hQxz+5zVlwXo64aCWwV6K6Vykx4niTWnDgRWf+zll6UM5lhbEVSFqqGwnrttI9S /HpO5Qx6skqTKnZtYGzJQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedviedrvddugddutdegucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucgfrhhlucfvnfffucdljedtmdenucfjughrpefhvf evufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffrghnihgvlhcuighuuceo ugiguhesugiguhhuuhdrgiihiieqnecuggftrfgrthhtvghrnhepgfefgfegjefhudeike dvueetffelieefuedvhfehjeeljeejkefgffeghfdttdetnecuvehluhhsthgvrhfuihii vgeptdenucfrrghrrghmpehmrghilhhfrhhomhepugiguhesugiguhhuuhdrgiihii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 7 Jul 2023 12:51:10 -0400 (EDT) From: Daniel Xu To: pablo@netfilter.org, kuba@kernel.org, edumazet@google.com, davem@davemloft.net, kadlec@netfilter.org, pabeni@redhat.com, dsahern@kernel.org, fw@strlen.de, daniel@iogearbox.net Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH bpf-next v3 3/6] netfilter: bpf: Prevent defrag module unload while link active Date: Fri, 7 Jul 2023 10:50:18 -0600 Message-ID: <7549d65daa702ba89aa3e43d5a1bbd562d569a99.1688748455.git.dxu@dxuuu.xyz> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,SPF_PASS, T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1770782653892083662?= X-GMAIL-MSGID: =?utf-8?q?1770782653892083662?= While in practice we could handle the module being unloaded while a netfilter link (that requested defrag) was active, it's a better user experience to prevent the defrag module from going away. It would violate user expectations if fragmented packets started showing up if some other part of the system tried to unload defrag module. Signed-off-by: Daniel Xu Reviewed-by: Florian Westphal --- include/linux/netfilter.h | 3 +++ net/ipv4/netfilter/nf_defrag_ipv4.c | 1 + net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 1 + net/netfilter/nf_bpf_link.c | 25 +++++++++++++++++++++-- 4 files changed, 28 insertions(+), 2 deletions(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 77a637b681f2..a160dc1e23bf 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include @@ -482,12 +483,14 @@ struct nfnl_ct_hook { extern const struct nfnl_ct_hook __rcu *nfnl_ct_hook; struct nf_defrag_v4_hook { + struct module *owner; int (*enable)(struct net *net); void (*disable)(struct net *net); }; extern const struct nf_defrag_v4_hook __rcu *nf_defrag_v4_hook; struct nf_defrag_v6_hook { + struct module *owner; int (*enable)(struct net *net); void (*disable)(struct net *net); }; diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c index 1f3e0e893b7a..fb133bf3131d 100644 --- a/net/ipv4/netfilter/nf_defrag_ipv4.c +++ b/net/ipv4/netfilter/nf_defrag_ipv4.c @@ -115,6 +115,7 @@ static void __net_exit defrag4_net_exit(struct net *net) } static const struct nf_defrag_v4_hook defrag_hook = { + .owner = THIS_MODULE, .enable = nf_defrag_ipv4_enable, .disable = nf_defrag_ipv4_disable, }; diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c index f7c7ee31c472..29d31721c9c0 100644 --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c @@ -98,6 +98,7 @@ static void __net_exit defrag6_net_exit(struct net *net) } static const struct nf_defrag_v6_hook defrag_hook = { + .owner = THIS_MODULE, .enable = nf_defrag_ipv6_enable, .disable = nf_defrag_ipv6_disable, }; diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c index 5b72aa246577..77ffbf26ba3d 100644 --- a/net/netfilter/nf_bpf_link.c +++ b/net/netfilter/nf_bpf_link.c @@ -2,6 +2,7 @@ #include #include #include +#include #include #include @@ -53,7 +54,15 @@ static int bpf_nf_enable_defrag(struct bpf_nf_link *link) } } + /* Prevent defrag module from going away while in use */ + if (!try_module_get(v4_hook->owner)) { + err = -ENOENT; + goto out_v4; + } + err = v4_hook->enable(link->net); + if (err) + module_put(v4_hook->owner); out_v4: rcu_read_unlock(); return err; @@ -77,7 +86,15 @@ static int bpf_nf_enable_defrag(struct bpf_nf_link *link) } } + /* Prevent defrag module from going away while in use */ + if (!try_module_get(v6_hook->owner)) { + err = -ENOENT; + goto out_v6; + } + err = v6_hook->enable(link->net); + if (err) + module_put(v6_hook->owner); out_v6: rcu_read_unlock(); return err; @@ -97,8 +114,10 @@ static void bpf_nf_disable_defrag(struct bpf_nf_link *link) case NFPROTO_IPV4: rcu_read_lock(); v4_hook = rcu_dereference(nf_defrag_v4_hook); - if (v4_hook) + if (v4_hook) { v4_hook->disable(link->net); + module_put(v4_hook->owner); + } rcu_read_unlock(); break; @@ -107,8 +126,10 @@ static void bpf_nf_disable_defrag(struct bpf_nf_link *link) case NFPROTO_IPV6: rcu_read_lock(); v6_hook = rcu_dereference(nf_defrag_v6_hook); - if (v6_hook) + if (v6_hook) { v6_hook->disable(link->net); + module_put(v6_hook->owner); + } rcu_read_unlock(); break; From patchwork Fri Jul 7 16:50:19 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 117208 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9f45:0:b0:3ea:f831:8777 with SMTP id v5csp3402075vqx; Fri, 7 Jul 2023 09:52:49 -0700 (PDT) X-Google-Smtp-Source: APBJJlFOMLCmVvxvHIuzY3G3btDpKogPxt8in8/XB6p0n8A7SOAEZBrYUMwXVHewGCsXYXyxqBvh X-Received: by 2002:a05:6870:a111:b0:1b0:4412:ee87 with SMTP id m17-20020a056870a11100b001b04412ee87mr6371321oae.23.1688748769182; Fri, 07 Jul 2023 09:52:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688748769; cv=none; d=google.com; s=arc-20160816; b=NZHqTyYWHZhDRRwLV/rJRw0j/2aQPOV550xGbmZrPR9++dobrJLffXiBDX4mYx6q9/ z5IkIOx18ERW2Wl+qzEfANyqA67hG0rD601uvwIyyUE5nUkxX//k4MxmUKm7s9R69YKX QH+cFLEHoGbon3JEXWzwHwmd1+ncs5BJjt7K9zAO3DHjX/saatWIMEzgaKpO9QjR0BCO EjoH5gUiwwBtChQs5/qvn+LT601Dv9IPG+nrI+xwm58IWV+otbHVsPO8VcBr8StPALfR kFWwuF10461me72APTe6Od1w69ShsASg/l6OtwEN5qD63GOyFYqIcsLispsBBf3HsSUn v5Yw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=C5gTyD3ZK69kBeMGtv3ULDgMyW30wlIrQqdN4DdpOCA=; fh=xP84MhPv2QMWGtxKCG0l2g+AwbN8g2oybIamq23n1sM=; b=Z+amt3WQ73y6W0+762eXkjpLxtIP0iw++3InnxedMQjZFUt0j2JXdXr+lPlHilACGj 88Ry4HOxNuUpEgRMcAFSn0X66H+AWW13Rd4mIDE6DWNIh3ObuzPgV4qmbZml9b3nku6Q zkROgIUSW6UDoiMRt0UhoQxFjVK1XpA8GN4VnXvJ1ouIQipoUamgZ7DdA/CShR4irGOf YJCFk5FfvLekv5cWsc+Csux92y1TtrmTS12msxO+GXiKLUueZ5uZWRTAPyqu/oTw7ESf j4aNWolKzx+tJE8yGAxcTENA3q6sn4BM+fj+oTiH56phbHra6wxVbdtw+mDcefCpAI9u i19A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=5ylpP1mi; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=HnXsQ06F; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id c5-20020a631c05000000b0053f6910ccc8si4091124pgc.747.2023.07.07.09.52.35; Fri, 07 Jul 2023 09:52:49 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=5ylpP1mi; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=HnXsQ06F; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233022AbjGGQva (ORCPT + 99 others); Fri, 7 Jul 2023 12:51:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59896 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232966AbjGGQvU (ORCPT ); Fri, 7 Jul 2023 12:51:20 -0400 Received: from wout3-smtp.messagingengine.com (wout3-smtp.messagingengine.com [64.147.123.19]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BEF37210C; Fri, 7 Jul 2023 09:51:17 -0700 (PDT) Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.west.internal (Postfix) with ESMTP id 917CA32001C6; Fri, 7 Jul 2023 12:51:15 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Fri, 07 Jul 2023 12:51:17 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm1; t=1688748675; x= 1688835075; bh=C5gTyD3ZK69kBeMGtv3ULDgMyW30wlIrQqdN4DdpOCA=; b=5 ylpP1mihx5lXocGkIaxYB+bGqJJHwKqe7lrUm0DM3dz0325bRPnGOlrMbrjunV+j kRxmY6oIcKVm7XJxLfpkMDJ4cw3TgLPkRzHA7K7/E+jUUqKVle/1azUQCm/JsW7n ngTwgXCnjMZfBjc/Io1G0s3v7f5fcd4MPB3vfAmc35vTDUGwK4twBynQ7+aanMSn xVG7UfE9hdJjuaTGw0Sqn8WVeslJm+YDJUyORKnh7isop8wMnR0goCL6AZGXZN6n IrAaA9eL5mGgbOeAc7dcjRH3HXrYe+e6kzysFPXz5EJJKreNwjM+d3FGu9Yk1a5h Zg0RmhbsRiouBSozbxt+A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1688748675; x= 1688835075; bh=C5gTyD3ZK69kBeMGtv3ULDgMyW30wlIrQqdN4DdpOCA=; b=H nXsQ06F1OlTkwF5knu1BATNQ2EvkjoaKmw7+FWGTZaUl1DqI2ZgN7+pDrAdYYR+u OL1FNP+KwKrFY/s2/s8e+2sfUsWV8HsVllYWRLlTf9BUNyL4jDpOXgG/9uJMZQ/2 ZGzbcVhe2CB8Tm0sbkoLQslU5BsdPMiXSxFoU/xXPkcm0rEMYlGiWRnVohFmVBeZ jXiaRkO3B4PJFf0WqmQDZimKae4HSvTKRkqPUVKCo86A+XhR3p4R+QpjNhJ0Hj7g d357PowSsyokFHbgk9gEQDIEz3PetLyQaNcmCdF9gwIQ0B68K4vfYfSeWEmbCdxj kkLZWpsa9yY4HChSAM6Zw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedviedrvddugddutdehucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucgfrhhlucfvnfffucdljedtmdenucfjughrpefhvf evufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffrghnihgvlhcuighuuceo ugiguhesugiguhhuuhdrgiihiieqnecuggftrfgrthhtvghrnhepgfefgfegjefhudeike dvueetffelieefuedvhfehjeeljeejkefgffeghfdttdetnecuvehluhhsthgvrhfuihii vgeptdenucfrrghrrghmpehmrghilhhfrhhomhepugiguhesugiguhhuuhdrgiihii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 7 Jul 2023 12:51:13 -0400 (EDT) From: Daniel Xu To: andrii@kernel.org, shuah@kernel.org, daniel@iogearbox.net, ast@kernel.org, fw@strlen.de Cc: martin.lau@linux.dev, song@kernel.org, yhs@fb.com, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, mykolal@fb.com, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, dsahern@kernel.org Subject: [PATCH bpf-next v3 4/6] bpf: selftests: Support not connecting client socket Date: Fri, 7 Jul 2023 10:50:19 -0600 Message-ID: <6d4095f283a6aace70ec325ad62e1dd3fc4a5287.1688748455.git.dxu@dxuuu.xyz> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,SPF_PASS, T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1770781429464715713?= X-GMAIL-MSGID: =?utf-8?q?1770781429464715713?= For connectionless protocols or raw sockets we do not want to actually connect() to the server. Signed-off-by: Daniel Xu --- tools/testing/selftests/bpf/network_helpers.c | 5 +++-- tools/testing/selftests/bpf/network_helpers.h | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c index a105c0cd008a..d5c78c08903b 100644 --- a/tools/testing/selftests/bpf/network_helpers.c +++ b/tools/testing/selftests/bpf/network_helpers.c @@ -301,8 +301,9 @@ int connect_to_fd_opts(int server_fd, const struct network_helper_opts *opts) strlen(opts->cc) + 1)) goto error_close; - if (connect_fd_to_addr(fd, &addr, addrlen, opts->must_fail)) - goto error_close; + if (!opts->noconnect) + if (connect_fd_to_addr(fd, &addr, addrlen, opts->must_fail)) + goto error_close; return fd; diff --git a/tools/testing/selftests/bpf/network_helpers.h b/tools/testing/selftests/bpf/network_helpers.h index 694185644da6..87894dc984dd 100644 --- a/tools/testing/selftests/bpf/network_helpers.h +++ b/tools/testing/selftests/bpf/network_helpers.h @@ -21,6 +21,7 @@ struct network_helper_opts { const char *cc; int timeout_ms; bool must_fail; + bool noconnect; }; /* ipv4 test vector */ From patchwork Fri Jul 7 16:50:20 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 117213 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9f45:0:b0:3ea:f831:8777 with SMTP id v5csp3413958vqx; Fri, 7 Jul 2023 10:09:52 -0700 (PDT) X-Google-Smtp-Source: APBJJlFGz1365a3LeDCxOLtIN45k3D+4qZXBO2FtRSYcF4ShBdLtbgXGM9Eg4Lu/zGPMQsbKxhP7 X-Received: by 2002:a17:907:1390:b0:992:8092:c109 with SMTP id vs16-20020a170907139000b009928092c109mr4212749ejb.51.1688749791865; Fri, 07 Jul 2023 10:09:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688749791; cv=none; d=google.com; s=arc-20160816; b=grGhhqAvdBAbVCgqluU1VtzjZGORFdaaa8Zx6Zt4WSoWONIIuCHa6HsMbrph6l0C72 Uo7RyKnDlHO/+gQkmr6rI65pqEACNGBSz0Q/prca26nwoR0Z+tW7oqRldhztDNDlexOw kSuugZaYQohofrmSAdpBVlK0RRYUOWSbbs1yvtKy515X8tZHUaehnRng1W7IcNVd30k0 56rkgmNyEtk3wRn0TnEIOtrXV2oFLZyfhEQSDhKARx28I7NeyAeoR0QOyu75R7D3D3lr eKMMjd8+QC5e+TQKKlqkxCg/nZkicmRLHDBQSyDYA7C5h8V/37VtHZoQ9gjNvhWOMK8Y jexg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=jCzr01pZ2u8uI49LnXSVMw7KSVSfUH7qENNmnpv8K+w=; fh=xP84MhPv2QMWGtxKCG0l2g+AwbN8g2oybIamq23n1sM=; b=fN0KOsQvc+vzn0BqBXjEY92Wkg+UZkeY4K21mWhgLtxEGF6ynlhTOF8oPn9pbMG+5O w5tWjwHPcsipBPi44YcoBqI/m1Oj2ErLyLQxdK8ZkHLQpKwCm0qp2l7Wo7ddkN2n629V hKCY/KBQo4k082NCHcpdslIz6f2I9Pl7dkbkZTu2xhcQqVEoxHxt5OXY0J5DFKOKrEwW 39eGQqaTsFVUz+Duu+b45LMy4PE4cBPvvp3fU+I782xFZpua6gwnz29wecmLPFIufjeh iy/AR5PrKgmB6sKcC/t3YwufSpbBk7mVEU0GkiqhFwdDJWrs43O0dbavoCFc+zX7VVNS +/4w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b="NM9a/fHU"; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=f63JbEt1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id k9-20020a1709061c0900b0099327546526si960162ejg.506.2023.07.07.10.09.27; Fri, 07 Jul 2023 10:09:51 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b="NM9a/fHU"; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=f63JbEt1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233000AbjGGQvd (ORCPT + 99 others); Fri, 7 Jul 2023 12:51:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233013AbjGGQv3 (ORCPT ); Fri, 7 Jul 2023 12:51:29 -0400 Received: from wout3-smtp.messagingengine.com (wout3-smtp.messagingengine.com [64.147.123.19]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B220B26A2; Fri, 7 Jul 2023 09:51:21 -0700 (PDT) Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.west.internal (Postfix) with ESMTP id 79831320077A; Fri, 7 Jul 2023 12:51:19 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Fri, 07 Jul 2023 12:51:21 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm1; t=1688748678; x= 1688835078; bh=jCzr01pZ2u8uI49LnXSVMw7KSVSfUH7qENNmnpv8K+w=; b=N M9a/fHU+sAtF01f0VlLA1ct1vLKtuK1DtAXRcznpcMttlNBGHix89tgucxwMEMZl EwkiUDo32GzO8cTr9M216skbVJzIu5v7U1UsYFIl256sf+ZnAd18IXArSivKosCa bvCRvByOFSty205mbTCTiwFXYblJH2slsu63diVLvMLaxniEWs1lXtJedz32OKXa PZnivKemQdzBgEqZLde5n1a9ykuTDE946kRpupm68SguuxSEIWXxmeZf3mibXaTT /Fy/yYPRDYC0PvX6gORsiSo+At/vZYH4Bo1TRKXXbzZZqw0J/2EQ2dk+8LkV+GCi 3sQx8C1mF2jmA+EYOS7uw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1688748678; x= 1688835078; bh=jCzr01pZ2u8uI49LnXSVMw7KSVSfUH7qENNmnpv8K+w=; b=f 63JbEt1Z/WFGq5pHpihxYFUxsgZ7hYJac912GHOms1yYCPPneN73Jg+BurgeCgJ4 lduOjYvznUehElM6s3LKphW0QicrXDNhlT+4vd8O6EzxW0TAJliMpLYqJ8LlDW5K ANiaR5fI+9oirJCiQHA1v8nCiptbVzwJRVW1WNnQ37COxSbvoRHv1KldZiozFWTf XPmQRPRBQtA3lmoQCsY5E12RMtnICWNo5pG/MYwJNSiizWVyPqqPgqvdCLRl7jtv pE/Vm8M+HoyWqUF+duc3NmqG2t/Hk3IDXFXi0rLRfHL8O5qQ7Tej1+mI18ca65c9 q57K3SueHvYT7aA+5tonA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedviedrvddugddutdehucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucgfrhhlucfvnfffucdljedtmdenucfjughrpefhvf evufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffrghnihgvlhcuighuuceo ugiguhesugiguhhuuhdrgiihiieqnecuggftrfgrthhtvghrnhepgfefgfegjefhudeike dvueetffelieefuedvhfehjeeljeejkefgffeghfdttdetnecuvehluhhsthgvrhfuihii vgeptdenucfrrghrrghmpehmrghilhhfrhhomhepugiguhesugiguhhuuhdrgiihii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 7 Jul 2023 12:51:17 -0400 (EDT) From: Daniel Xu To: andrii@kernel.org, shuah@kernel.org, daniel@iogearbox.net, ast@kernel.org, fw@strlen.de Cc: martin.lau@linux.dev, song@kernel.org, yhs@fb.com, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, mykolal@fb.com, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, dsahern@kernel.org Subject: [PATCH bpf-next v3 5/6] bpf: selftests: Support custom type and proto for client sockets Date: Fri, 7 Jul 2023 10:50:20 -0600 Message-ID: X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,SPF_PASS, T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1770782502026038567?= X-GMAIL-MSGID: =?utf-8?q?1770782502026038567?= Extend connect_to_fd_opts() to take optional type and protocol parameters for the client socket. These parameters are useful when opening a raw socket to send IP fragments. Signed-off-by: Daniel Xu --- tools/testing/selftests/bpf/network_helpers.c | 21 +++++++++++++------ tools/testing/selftests/bpf/network_helpers.h | 2 ++ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/tools/testing/selftests/bpf/network_helpers.c b/tools/testing/selftests/bpf/network_helpers.c index d5c78c08903b..910d5d0470e6 100644 --- a/tools/testing/selftests/bpf/network_helpers.c +++ b/tools/testing/selftests/bpf/network_helpers.c @@ -270,14 +270,23 @@ int connect_to_fd_opts(int server_fd, const struct network_helper_opts *opts) opts = &default_opts; optlen = sizeof(type); - if (getsockopt(server_fd, SOL_SOCKET, SO_TYPE, &type, &optlen)) { - log_err("getsockopt(SOL_TYPE)"); - return -1; + + if (opts->type) { + type = opts->type; + } else { + if (getsockopt(server_fd, SOL_SOCKET, SO_TYPE, &type, &optlen)) { + log_err("getsockopt(SOL_TYPE)"); + return -1; + } } - if (getsockopt(server_fd, SOL_SOCKET, SO_PROTOCOL, &protocol, &optlen)) { - log_err("getsockopt(SOL_PROTOCOL)"); - return -1; + if (opts->proto) { + protocol = opts->proto; + } else { + if (getsockopt(server_fd, SOL_SOCKET, SO_PROTOCOL, &protocol, &optlen)) { + log_err("getsockopt(SOL_PROTOCOL)"); + return -1; + } } addrlen = sizeof(addr); diff --git a/tools/testing/selftests/bpf/network_helpers.h b/tools/testing/selftests/bpf/network_helpers.h index 87894dc984dd..5eccc67d1a99 100644 --- a/tools/testing/selftests/bpf/network_helpers.h +++ b/tools/testing/selftests/bpf/network_helpers.h @@ -22,6 +22,8 @@ struct network_helper_opts { int timeout_ms; bool must_fail; bool noconnect; + int type; + int proto; }; /* ipv4 test vector */ From patchwork Fri Jul 7 16:50:21 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 117211 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9f45:0:b0:3ea:f831:8777 with SMTP id v5csp3402750vqx; Fri, 7 Jul 2023 09:54:03 -0700 (PDT) X-Google-Smtp-Source: APBJJlHgxfaYcr7IZrm/cZMgQk5O/lSQTwERUm8cdYzKLKs7Emht6GvEYS8KnoDOX5LND47KIDzY X-Received: by 2002:aa7:dad8:0:b0:51d:e59c:6190 with SMTP id x24-20020aa7dad8000000b0051de59c6190mr4054742eds.2.1688748842828; Fri, 07 Jul 2023 09:54:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688748842; cv=none; d=google.com; s=arc-20160816; b=SptFPuUpoxEtqrsnVJFqg3H5Wm4j4ak0PUtI4YrF6BkEIqrZRhSCe1MSj8xYJ5BLG7 gaor5GeIsLR5G/V2bpASfr7lkTa34TD3ljjkQ05cTE2AUiCRLu0mgApGfEYX/bLWj0KN Yvk6kMJ+6AIvy9IuknZC+YizJksC4IAIMFu/LvOd51GRcfLoz+e6L5I5LJ7dJuB9rKU2 hf4PeMgkTYiAYi9JjwcZTTMCRH5Zmm4PQdDqh1qCejHo+EIW8s4VAPts8w+ms0NoY6L1 nczOorh4gRj8V2wLsPTvZhtJFtFD1HjvhUET+i0gw3XGxMr7Jum/jimrAdwEReKaJe1R 1N5A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=KYTx8/AVmAwctDU/Q4rV3rnsQa0jrAaUVq9C4p0inNo=; fh=ZfsJv0Wycz3FSY4YEywSJEsaYsTiMon3CPP5dObie54=; b=xHJuxrClIlgIrP7/UbFSN/976sZCq2z7jAGh54eaUn5DctchB1wkfrJfi2tO5c9Vt6 rzSQ9Q3zNRiBbfsfpKnDvofnYWWDb+bxHmMzmjfUQpEYL16yyesJZw0y0yjC0620c0lN CMNysfR1tozve/nfaoTiJzTAIK7Jkxt8wmoJXGdC66M83V64mOhT2MBKjBvsDhBJzO5y UUWGfYqw1xXqCmyDcH9KvPIEwgVhrdD+J8P8DCmLXR2Q3+L3iMUFO77kPyo1GLOkK5m5 nPzcVVWjX0go95TquYV+Aos5zc//nf2WznXJe86LZHdQPmJrK9hFvwwasgyEOZgZo+y+ WMGA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=c2j3IO6O; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=k79JsGvI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id j9-20020aa7ca49000000b0051df73ddeffsi2527255edt.358.2023.07.07.09.53.38; Fri, 07 Jul 2023 09:54:02 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=c2j3IO6O; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=k79JsGvI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233004AbjGGQvn (ORCPT + 99 others); Fri, 7 Jul 2023 12:51:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59910 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232818AbjGGQvj (ORCPT ); Fri, 7 Jul 2023 12:51:39 -0400 Received: from wout3-smtp.messagingengine.com (wout3-smtp.messagingengine.com [64.147.123.19]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 427F92709; Fri, 7 Jul 2023 09:51:26 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id 7FD093200437; Fri, 7 Jul 2023 12:51:23 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute1.internal (MEProxy); Fri, 07 Jul 2023 12:51:25 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm1; t=1688748683; x= 1688835083; bh=KYTx8/AVmAwctDU/Q4rV3rnsQa0jrAaUVq9C4p0inNo=; b=c 2j3IO6O1XLfm56LLLUr1ouZiqYz1Op6/PKgNGpnhZv2VVwCMBbB0v20nJP/IHE/Z hl1Sz8rGrqX7sdkkoNUms+jSghSy0gHHHjqZhyWi+f5AG40k5krsmbhv/dUiqZsF 4aZyE8S+P6Z+V2nEsDUYe11PIDsTU7SFu10KkZwD1BBKD8VTd8SiRSRtOiMhAbwA Vod17EbFwys3+OVB71Fv4wS5xrWkcYyrdpfF/NnRffuH029OIeZ/z7MqndVk4LPY xkpsvo9+vffGSXM8wbfQOSXiGaNphe7J6734CNCPu0glWR2T7S7HhMW6WJXCRldj ljBm6WdHnn7f4IhFKDYpw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1688748683; x= 1688835083; bh=KYTx8/AVmAwctDU/Q4rV3rnsQa0jrAaUVq9C4p0inNo=; b=k 79JsGvI25lw+MgEgKsM6ptoFRuYG5EhUJotqzSUYGHsNYMzYP85YSKsdqjbdewpJ Kt7cM6841PbK0Y8gr9xjqp2Rg8Ie3oBCI94yC63uedTJ8TEk7IqMGRjyt7llo+WG fae5gdjgQBgcqbbeD5urdZiqtQ40TBacWFYB2nfvRybgahQOYTIZiLPoNkSWT+6Q Rt0o9c/MRfqnUgxHtjZVYZAByF2biJ72aoJrxzbt19oG7QHn+sPR/N35DqdPNTTY kTtnTnpKnxpwOjag7BgHSZ2BzziZr5wMwbBPMEf3G/GXzSwmtwdrVo9TGV8ka60V oi3+6IIGOyBT7vjOnT+lQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedviedrvddugddutdehucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucgfrhhlucfvnfffucdljedtmdenucfjughrpefhvf evufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeffrghnihgvlhcuighuuceo ugiguhesugiguhhuuhdrgiihiieqnecuggftrfgrthhtvghrnhepgfefgfegjefhudeike dvueetffelieefuedvhfehjeeljeejkefgffeghfdttdetnecuvehluhhsthgvrhfuihii vgeptdenucfrrghrrghmpehmrghilhhfrhhomhepugiguhesugiguhhuuhdrgiihii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 7 Jul 2023 12:51:21 -0400 (EDT) From: Daniel Xu To: andrii@kernel.org, shuah@kernel.org, daniel@iogearbox.net, ast@kernel.org, fw@strlen.de Cc: martin.lau@linux.dev, song@kernel.org, yhs@fb.com, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, mykolal@fb.com, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, netfilter-devel@vger.kernel.org, dsahern@kernel.org Subject: [PATCH bpf-next v3 6/6] bpf: selftests: Add defrag selftests Date: Fri, 7 Jul 2023 10:50:21 -0600 Message-ID: <13720a4b7a18b2409357a82eebe57ef388ab9cf1.1688748455.git.dxu@dxuuu.xyz> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,SPF_PASS, T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1770781506586551186?= X-GMAIL-MSGID: =?utf-8?q?1770781506586551186?= These selftests tests 2 major scenarios: the BPF based defragmentation can successfully be done and that packet pointers are invalidated after calls to the kfunc. The logic is similar for both ipv4 and ipv6. In the first scenario, we create a UDP client and UDP echo server. The the server side is fairly straightforward: we attach the prog and simply echo back the message. The on the client side, we send fragmented packets to and expect the reassembled message back from the server. Signed-off-by: Daniel Xu --- tools/testing/selftests/bpf/Makefile | 4 +- .../selftests/bpf/generate_udp_fragments.py | 90 ++++++ .../selftests/bpf/ip_check_defrag_frags.h | 57 ++++ .../bpf/prog_tests/ip_check_defrag.c | 282 ++++++++++++++++++ .../selftests/bpf/progs/ip_check_defrag.c | 104 +++++++ 5 files changed, 535 insertions(+), 2 deletions(-) create mode 100755 tools/testing/selftests/bpf/generate_udp_fragments.py create mode 100644 tools/testing/selftests/bpf/ip_check_defrag_frags.h create mode 100644 tools/testing/selftests/bpf/prog_tests/ip_check_defrag.c create mode 100644 tools/testing/selftests/bpf/progs/ip_check_defrag.c diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index 882be03b179f..619df497fce5 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -565,8 +565,8 @@ TRUNNER_EXTRA_SOURCES := test_progs.c cgroup_helpers.c trace_helpers.c \ network_helpers.c testing_helpers.c \ btf_helpers.c flow_dissector_load.h \ cap_helpers.c test_loader.c xsk.c disasm.c \ - json_writer.c unpriv_helpers.c - + json_writer.c unpriv_helpers.c \ + ip_check_defrag_frags.h TRUNNER_EXTRA_FILES := $(OUTPUT)/urandom_read $(OUTPUT)/bpf_testmod.ko \ $(OUTPUT)/liburandom_read.so \ $(OUTPUT)/xdp_synproxy \ diff --git a/tools/testing/selftests/bpf/generate_udp_fragments.py b/tools/testing/selftests/bpf/generate_udp_fragments.py new file mode 100755 index 000000000000..2b8a1187991c --- /dev/null +++ b/tools/testing/selftests/bpf/generate_udp_fragments.py @@ -0,0 +1,90 @@ +#!/bin/env python3 +# SPDX-License-Identifier: GPL-2.0 + +""" +This script helps generate fragmented UDP packets. + +While it is technically possible to dynamically generate +fragmented packets in C, it is much harder to read and write +said code. `scapy` is relatively industry standard and really +easy to read / write. + +So we choose to write this script that generates a valid C +header. Rerun script and commit generated file after any +modifications. +""" + +import argparse +import os + +from scapy.all import * + + +# These constants must stay in sync with `ip_check_defrag.c` +VETH1_ADDR = "172.16.1.200" +VETH0_ADDR6 = "fc00::100" +VETH1_ADDR6 = "fc00::200" +CLIENT_PORT = 48878 +SERVER_PORT = 48879 +MAGIC_MESSAGE = "THIS IS THE ORIGINAL MESSAGE, PLEASE REASSEMBLE ME" + + +def print_header(f): + f.write("// SPDX-License-Identifier: GPL-2.0\n") + f.write("/* DO NOT EDIT -- this file is generated */\n") + f.write("\n") + f.write("#ifndef _IP_CHECK_DEFRAG_FRAGS_H\n") + f.write("#define _IP_CHECK_DEFRAG_FRAGS_H\n") + f.write("\n") + f.write("#include \n") + f.write("\n") + + +def print_frags(f, frags, v6): + for idx, frag in enumerate(frags): + # 10 bytes per line to keep width in check + chunks = [frag[i : i + 10] for i in range(0, len(frag), 10)] + chunks_fmted = [", ".join([str(hex(b)) for b in chunk]) for chunk in chunks] + suffix = "6" if v6 else "" + + f.write(f"static uint8_t frag{suffix}_{idx}[] = {{\n") + for chunk in chunks_fmted: + f.write(f"\t{chunk},\n") + f.write(f"}};\n") + + +def print_trailer(f): + f.write("\n") + f.write("#endif /* _IP_CHECK_DEFRAG_FRAGS_H */\n") + + +def main(f): + # srcip of 0 is filled in by IP_HDRINCL + sip = "0.0.0.0" + sip6 = VETH0_ADDR6 + dip = VETH1_ADDR + dip6 = VETH1_ADDR6 + sport = CLIENT_PORT + dport = SERVER_PORT + payload = MAGIC_MESSAGE.encode() + + # Disable UDPv4 checksums to keep code simpler + pkt = IP(src=sip,dst=dip) / UDP(sport=sport,dport=dport,chksum=0) / Raw(load=payload) + # UDPv6 requires a checksum + # Also pin the ipv6 fragment header ID, otherwise it's a random value + pkt6 = IPv6(src=sip6,dst=dip6) / IPv6ExtHdrFragment(id=0xBEEF) / UDP(sport=sport,dport=dport) / Raw(load=payload) + + frags = [f.build() for f in pkt.fragment(24)] + frags6 = [f.build() for f in fragment6(pkt6, 72)] + + print_header(f) + print_frags(f, frags, False) + print_frags(f, frags6, True) + print_trailer(f) + + +if __name__ == "__main__": + dir = os.path.dirname(os.path.realpath(__file__)) + header = f"{dir}/ip_check_defrag_frags.h" + with open(header, "w") as f: + main(f) diff --git a/tools/testing/selftests/bpf/ip_check_defrag_frags.h b/tools/testing/selftests/bpf/ip_check_defrag_frags.h new file mode 100644 index 000000000000..70ab7e9fa22b --- /dev/null +++ b/tools/testing/selftests/bpf/ip_check_defrag_frags.h @@ -0,0 +1,57 @@ +// SPDX-License-Identifier: GPL-2.0 +/* DO NOT EDIT -- this file is generated */ + +#ifndef _IP_CHECK_DEFRAG_FRAGS_H +#define _IP_CHECK_DEFRAG_FRAGS_H + +#include + +static uint8_t frag_0[] = { + 0x45, 0x0, 0x0, 0x2c, 0x0, 0x1, 0x20, 0x0, 0x40, 0x11, + 0xac, 0xe8, 0x0, 0x0, 0x0, 0x0, 0xac, 0x10, 0x1, 0xc8, + 0xbe, 0xee, 0xbe, 0xef, 0x0, 0x3a, 0x0, 0x0, 0x54, 0x48, + 0x49, 0x53, 0x20, 0x49, 0x53, 0x20, 0x54, 0x48, 0x45, 0x20, + 0x4f, 0x52, 0x49, 0x47, +}; +static uint8_t frag_1[] = { + 0x45, 0x0, 0x0, 0x2c, 0x0, 0x1, 0x20, 0x3, 0x40, 0x11, + 0xac, 0xe5, 0x0, 0x0, 0x0, 0x0, 0xac, 0x10, 0x1, 0xc8, + 0x49, 0x4e, 0x41, 0x4c, 0x20, 0x4d, 0x45, 0x53, 0x53, 0x41, + 0x47, 0x45, 0x2c, 0x20, 0x50, 0x4c, 0x45, 0x41, 0x53, 0x45, + 0x20, 0x52, 0x45, 0x41, +}; +static uint8_t frag_2[] = { + 0x45, 0x0, 0x0, 0x1e, 0x0, 0x1, 0x0, 0x6, 0x40, 0x11, + 0xcc, 0xf0, 0x0, 0x0, 0x0, 0x0, 0xac, 0x10, 0x1, 0xc8, + 0x53, 0x53, 0x45, 0x4d, 0x42, 0x4c, 0x45, 0x20, 0x4d, 0x45, +}; +static uint8_t frag6_0[] = { + 0x60, 0x0, 0x0, 0x0, 0x0, 0x20, 0x2c, 0x40, 0xfc, 0x0, + 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, + 0x0, 0x0, 0x1, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, + 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, + 0x11, 0x0, 0x0, 0x1, 0x0, 0x0, 0xbe, 0xef, 0xbe, 0xee, + 0xbe, 0xef, 0x0, 0x3a, 0xd0, 0xf8, 0x54, 0x48, 0x49, 0x53, + 0x20, 0x49, 0x53, 0x20, 0x54, 0x48, 0x45, 0x20, 0x4f, 0x52, + 0x49, 0x47, +}; +static uint8_t frag6_1[] = { + 0x60, 0x0, 0x0, 0x0, 0x0, 0x20, 0x2c, 0x40, 0xfc, 0x0, + 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, + 0x0, 0x0, 0x1, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, + 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, + 0x11, 0x0, 0x0, 0x19, 0x0, 0x0, 0xbe, 0xef, 0x49, 0x4e, + 0x41, 0x4c, 0x20, 0x4d, 0x45, 0x53, 0x53, 0x41, 0x47, 0x45, + 0x2c, 0x20, 0x50, 0x4c, 0x45, 0x41, 0x53, 0x45, 0x20, 0x52, + 0x45, 0x41, +}; +static uint8_t frag6_2[] = { + 0x60, 0x0, 0x0, 0x0, 0x0, 0x12, 0x2c, 0x40, 0xfc, 0x0, + 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, + 0x0, 0x0, 0x1, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, + 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, + 0x11, 0x0, 0x0, 0x30, 0x0, 0x0, 0xbe, 0xef, 0x53, 0x53, + 0x45, 0x4d, 0x42, 0x4c, 0x45, 0x20, 0x4d, 0x45, +}; + +#endif /* _IP_CHECK_DEFRAG_FRAGS_H */ diff --git a/tools/testing/selftests/bpf/prog_tests/ip_check_defrag.c b/tools/testing/selftests/bpf/prog_tests/ip_check_defrag.c new file mode 100644 index 000000000000..5cd08d6e0ebc --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/ip_check_defrag.c @@ -0,0 +1,282 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include +#include +#include +#include "ip_check_defrag.skel.h" +#include "ip_check_defrag_frags.h" + +/* + * This selftest spins up a client and an echo server, each in their own + * network namespace. The client will send a fragmented message to the server. + * The prog attached to the server will shoot down any fragments. Thus, if + * the server is able to correctly echo back the message to the client, we will + * have verified that netfilter is reassembling packets for us. + * + * Topology: + * ========= + * NS0 | NS1 + * | + * client | server + * ---------- | ---------- + * | veth0 | --------- | veth1 | + * ---------- peer ---------- + * | + * | with bpf + */ + +#define NS0 "defrag_ns0" +#define NS1 "defrag_ns1" +#define VETH0 "veth0" +#define VETH1 "veth1" +#define VETH0_ADDR "172.16.1.100" +#define VETH0_ADDR6 "fc00::100" +/* The following constants must stay in sync with `generate_udp_fragments.py` */ +#define VETH1_ADDR "172.16.1.200" +#define VETH1_ADDR6 "fc00::200" +#define CLIENT_PORT 48878 +#define SERVER_PORT 48879 +#define MAGIC_MESSAGE "THIS IS THE ORIGINAL MESSAGE, PLEASE REASSEMBLE ME" + +static int setup_topology(bool ipv6) +{ + bool up; + int i; + + SYS(fail, "ip netns add " NS0); + SYS(fail, "ip netns add " NS1); + SYS(fail, "ip link add " VETH0 " netns " NS0 " type veth peer name " VETH1 " netns " NS1); + if (ipv6) { + SYS(fail, "ip -6 -net " NS0 " addr add " VETH0_ADDR6 "/64 dev " VETH0 " nodad"); + SYS(fail, "ip -6 -net " NS1 " addr add " VETH1_ADDR6 "/64 dev " VETH1 " nodad"); + } else { + SYS(fail, "ip -net " NS0 " addr add " VETH0_ADDR "/24 dev " VETH0); + SYS(fail, "ip -net " NS1 " addr add " VETH1_ADDR "/24 dev " VETH1); + } + SYS(fail, "ip -net " NS0 " link set dev " VETH0 " up"); + SYS(fail, "ip -net " NS1 " link set dev " VETH1 " up"); + + /* Wait for up to 5s for links to come up */ + for (i = 0; i < 5; ++i) { + if (ipv6) + up = !system("ip netns exec " NS0 " ping -6 -c 1 -W 1 " VETH1_ADDR6 " &>/dev/null"); + else + up = !system("ip netns exec " NS0 " ping -c 1 -W 1 " VETH1_ADDR " &>/dev/null"); + + if (up) + break; + } + + return 0; +fail: + return -1; +} + +static void cleanup_topology(void) +{ + SYS_NOFAIL("test -f /var/run/netns/" NS0 " && ip netns delete " NS0); + SYS_NOFAIL("test -f /var/run/netns/" NS1 " && ip netns delete " NS1); +} + +static int attach(struct ip_check_defrag *skel, bool ipv6) +{ + LIBBPF_OPTS(bpf_netfilter_opts, opts, + .pf = ipv6 ? NFPROTO_IPV6 : NFPROTO_IPV4, + .priority = 42, + .flags = BPF_F_NETFILTER_IP_DEFRAG); + struct nstoken *nstoken; + int err = -1; + + nstoken = open_netns(NS1); + + skel->links.defrag = bpf_program__attach_netfilter(skel->progs.defrag, &opts); + if (!ASSERT_OK_PTR(skel->links.defrag, "program attach")) + goto out; + + err = 0; +out: + close_netns(nstoken); + return err; +} + +static int send_frags(int client) +{ + struct sockaddr_storage saddr; + struct sockaddr *saddr_p; + socklen_t saddr_len; + int err; + + saddr_p = (struct sockaddr *)&saddr; + err = make_sockaddr(AF_INET, VETH1_ADDR, SERVER_PORT, &saddr, &saddr_len); + if (!ASSERT_OK(err, "make_sockaddr")) + return -1; + + err = sendto(client, frag_0, sizeof(frag_0), 0, saddr_p, saddr_len); + if (!ASSERT_GE(err, 0, "sendto frag_0")) + return -1; + + err = sendto(client, frag_1, sizeof(frag_1), 0, saddr_p, saddr_len); + if (!ASSERT_GE(err, 0, "sendto frag_1")) + return -1; + + err = sendto(client, frag_2, sizeof(frag_2), 0, saddr_p, saddr_len); + if (!ASSERT_GE(err, 0, "sendto frag_2")) + return -1; + + return 0; +} + +static int send_frags6(int client) +{ + struct sockaddr_storage saddr; + struct sockaddr *saddr_p; + socklen_t saddr_len; + int err; + + saddr_p = (struct sockaddr *)&saddr; + /* Port needs to be set to 0 for raw ipv6 socket for some reason */ + err = make_sockaddr(AF_INET6, VETH1_ADDR6, 0, &saddr, &saddr_len); + if (!ASSERT_OK(err, "make_sockaddr")) + return -1; + + err = sendto(client, frag6_0, sizeof(frag6_0), 0, saddr_p, saddr_len); + if (!ASSERT_GE(err, 0, "sendto frag6_0")) + return -1; + + err = sendto(client, frag6_1, sizeof(frag6_1), 0, saddr_p, saddr_len); + if (!ASSERT_GE(err, 0, "sendto frag6_1")) + return -1; + + err = sendto(client, frag6_2, sizeof(frag6_2), 0, saddr_p, saddr_len); + if (!ASSERT_GE(err, 0, "sendto frag6_2")) + return -1; + + return 0; +} + +void test_bpf_ip_check_defrag_ok(bool ipv6) +{ + struct network_helper_opts rx_opts = { + .timeout_ms = 1000, + .noconnect = true, + }; + struct network_helper_opts tx_ops = { + .timeout_ms = 1000, + .type = SOCK_RAW, + .proto = IPPROTO_RAW, + .noconnect = true, + }; + struct sockaddr_storage caddr; + struct ip_check_defrag *skel; + struct nstoken *nstoken; + int client_tx_fd = -1; + int client_rx_fd = -1; + socklen_t caddr_len; + int srv_fd = -1; + char buf[1024]; + int len, err; + + skel = ip_check_defrag__open_and_load(); + if (!ASSERT_OK_PTR(skel, "skel_open")) + return; + + if (!ASSERT_OK(setup_topology(ipv6), "setup_topology")) + goto out; + + if (!ASSERT_OK(attach(skel, ipv6), "attach")) + goto out; + + /* Start server in ns1 */ + nstoken = open_netns(NS1); + if (!ASSERT_OK_PTR(nstoken, "setns ns1")) + goto out; + srv_fd = start_server(ipv6 ? AF_INET6 : AF_INET, SOCK_DGRAM, NULL, SERVER_PORT, 0); + close_netns(nstoken); + if (!ASSERT_GE(srv_fd, 0, "start_server")) + goto out; + + /* Open tx raw socket in ns0 */ + nstoken = open_netns(NS0); + if (!ASSERT_OK_PTR(nstoken, "setns ns0")) + goto out; + client_tx_fd = connect_to_fd_opts(srv_fd, &tx_ops); + close_netns(nstoken); + if (!ASSERT_GE(client_tx_fd, 0, "connect_to_fd_opts")) + goto out; + + /* Open rx socket in ns0 */ + nstoken = open_netns(NS0); + if (!ASSERT_OK_PTR(nstoken, "setns ns0")) + goto out; + client_rx_fd = connect_to_fd_opts(srv_fd, &rx_opts); + close_netns(nstoken); + if (!ASSERT_GE(client_rx_fd, 0, "connect_to_fd_opts")) + goto out; + + /* Bind rx socket to a premeditated port */ + memset(&caddr, 0, sizeof(caddr)); + nstoken = open_netns(NS0); + if (!ASSERT_OK_PTR(nstoken, "setns ns0")) + goto out; + if (ipv6) { + struct sockaddr_in6 *c = (struct sockaddr_in6 *)&caddr; + + c->sin6_family = AF_INET6; + inet_pton(AF_INET6, VETH0_ADDR6, &c->sin6_addr); + c->sin6_port = htons(CLIENT_PORT); + err = bind(client_rx_fd, (struct sockaddr *)c, sizeof(*c)); + } else { + struct sockaddr_in *c = (struct sockaddr_in *)&caddr; + + c->sin_family = AF_INET; + inet_pton(AF_INET, VETH0_ADDR, &c->sin_addr); + c->sin_port = htons(CLIENT_PORT); + err = bind(client_rx_fd, (struct sockaddr *)c, sizeof(*c)); + } + close_netns(nstoken); + if (!ASSERT_OK(err, "bind")) + goto out; + + /* Send message in fragments */ + if (ipv6) { + if (!ASSERT_OK(send_frags6(client_tx_fd), "send_frags6")) + goto out; + } else { + if (!ASSERT_OK(send_frags(client_tx_fd), "send_frags")) + goto out; + } + + if (!ASSERT_EQ(skel->bss->shootdowns, 0, "shootdowns")) + goto out; + + /* Receive reassembled msg on server and echo back to client */ + len = recvfrom(srv_fd, buf, sizeof(buf), 0, (struct sockaddr *)&caddr, &caddr_len); + if (!ASSERT_GE(len, 0, "server recvfrom")) + goto out; + len = sendto(srv_fd, buf, len, 0, (struct sockaddr *)&caddr, caddr_len); + if (!ASSERT_GE(len, 0, "server sendto")) + goto out; + + /* Expect reassembed message to be echoed back */ + len = recvfrom(client_rx_fd, buf, sizeof(buf), 0, NULL, NULL); + if (!ASSERT_EQ(len, sizeof(MAGIC_MESSAGE) - 1, "client short read")) + goto out; + +out: + if (client_rx_fd != -1) + close(client_rx_fd); + if (client_tx_fd != -1) + close(client_tx_fd); + if (srv_fd != -1) + close(srv_fd); + cleanup_topology(); + ip_check_defrag__destroy(skel); +} + +void test_bpf_ip_check_defrag(void) +{ + if (test__start_subtest("v4")) + test_bpf_ip_check_defrag_ok(false); + if (test__start_subtest("v6")) + test_bpf_ip_check_defrag_ok(true); +} diff --git a/tools/testing/selftests/bpf/progs/ip_check_defrag.c b/tools/testing/selftests/bpf/progs/ip_check_defrag.c new file mode 100644 index 000000000000..4259c6d59968 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/ip_check_defrag.c @@ -0,0 +1,104 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include "vmlinux.h" +#include +#include +#include "bpf_tracing_net.h" + +#define NF_DROP 0 +#define NF_ACCEPT 1 +#define ETH_P_IP 0x0800 +#define ETH_P_IPV6 0x86DD +#define IP_MF 0x2000 +#define IP_OFFSET 0x1FFF +#define NEXTHDR_FRAGMENT 44 + +extern int bpf_dynptr_from_skb(struct sk_buff *skb, __u64 flags, + struct bpf_dynptr *ptr__uninit) __ksym; +extern void *bpf_dynptr_slice(const struct bpf_dynptr *ptr, uint32_t offset, + void *buffer, uint32_t buffer__sz) __ksym; + +volatile int shootdowns = 0; + +static bool is_frag_v4(struct iphdr *iph) +{ + int offset; + int flags; + + offset = bpf_ntohs(iph->frag_off); + flags = offset & ~IP_OFFSET; + offset &= IP_OFFSET; + offset <<= 3; + + return (flags & IP_MF) || offset; +} + +static bool is_frag_v6(struct ipv6hdr *ip6h) +{ + /* Simplifying assumption that there are no extension headers + * between fixed header and fragmentation header. This assumption + * is only valid in this test case. It saves us the hassle of + * searching all potential extension headers. + */ + return ip6h->nexthdr == NEXTHDR_FRAGMENT; +} + +static int handle_v4(struct sk_buff *skb) +{ + struct bpf_dynptr ptr; + u8 iph_buf[20] = {}; + struct iphdr *iph; + + if (bpf_dynptr_from_skb(skb, 0, &ptr)) + return NF_DROP; + + iph = bpf_dynptr_slice(&ptr, 0, iph_buf, sizeof(iph_buf)); + if (!iph) + return NF_DROP; + + /* Shootdown any frags */ + if (is_frag_v4(iph)) { + shootdowns++; + return NF_DROP; + } + + return NF_ACCEPT; +} + +static int handle_v6(struct sk_buff *skb) +{ + struct bpf_dynptr ptr; + struct ipv6hdr *ip6h; + u8 ip6h_buf[40] = {}; + + if (bpf_dynptr_from_skb(skb, 0, &ptr)) + return NF_DROP; + + ip6h = bpf_dynptr_slice(&ptr, 0, ip6h_buf, sizeof(ip6h_buf)); + if (!ip6h) + return NF_DROP; + + /* Shootdown any frags */ + if (is_frag_v6(ip6h)) { + shootdowns++; + return NF_DROP; + } + + return NF_ACCEPT; +} + +SEC("netfilter") +int defrag(struct bpf_nf_ctx *ctx) +{ + struct sk_buff *skb = ctx->skb; + + switch (bpf_ntohs(skb->protocol)) { + case ETH_P_IP: + return handle_v4(skb); + case ETH_P_IPV6: + return handle_v6(skb); + default: + return NF_ACCEPT; + } +} + +char _license[] SEC("license") = "GPL";