New BPF helpers to accelerate synproxy

PATCH Superseded Maxim Mikityanskiy 2 participants 9 messages Apr 13, 2022 – Apr 22, 2022

Subsystems (9)

Networking Network drivers Kselftest BPF +5 more subsystems

lore

Share & tools

lore

Maxim Mikityanskiy

author

2022-04-13 13:41 UTC #0 lore raw

v5 cover New BPF helpers to accelerate synproxy

The first patch of this series is an improvement to the existing syncookie BPF helper. The second patch is a documentation fix.

The third patch allows BPF helpers to accept memory regions of fixed size without doing runtime size checks.

The two last patches add new functionality that allows XDP to accelerate iptables synproxy.

v1 of this series [1] used to include a patch that exposed conntrack lookup to BPF using stable helpers. It was superseded by series [2] by Kumar Kartikeya Dwivedi, which implements this functionality using unstable helpers.

The fourth patch adds new helpers to issue and check SYN cookies without binding to a socket, which is useful in the synproxy scenario.

The fifth patch adds a selftest, which consists of a script, an XDP program and a userspace control application. The XDP program uses socketless SYN cookie helpers and queries conntrack status instead of socket status. The userspace control application allows to tune parameters of the XDP program. This program also serves as a minimal example of usage of the new functionality.

The draft of the new functionality was presented on Netdev 0x15 [3].

v2 changes:

Split into two series, submitted bugfixes to bpf, dropped the conntrack patches, implemented the timestamp cookie in BPF using bpf_loop, dropped the timestamp cookie patch.

v3 changes:

Moved some patches from bpf to bpf-next, dropped the patch that changed error codes, split the new helpers into IPv4/IPv6, added verifier functionality to accept memory regions of fixed size.

v4 changes:

Converted the selftest to the test_progs runner. Replaced some deprecated functions in xdp_synproxy userspace helper.

v5 changes:

Fixed a bug in the selftest. Added questionable functionality to support new helpers in TC BPF, added selftests for it.

[1]: https://lore.kernel.org/bpf/[email protected]/t/
[2]: https://lore.kernel.org/bpf/[email protected]/
[3]: https://netdevconf.info/0x15/session.html?Accelerating-synproxy-with-XDP

Maxim Mikityanskiy (6):
bpf: Use ipv6_only_sock in bpf_tcp_gen_syncookie
bpf: Fix documentation of th_len in bpf_tcp_{gen,check}_syncookie
bpf: Allow helpers to accept pointers with a fixed size
bpf: Add helpers to issue and check SYN cookies in XDP
bpf: Add selftests for raw syncookie helpers
bpf: Allow the new syncookie helpers to work with SKBs

 include/linux/bpf.h                           |  10 +
 include/net/tcp.h                             |   1 +
 include/uapi/linux/bpf.h                      | 100 ++-
 kernel/bpf/verifier.c                         |  26 +-
 net/core/filter.c                             | 136 ++-
 net/ipv4/tcp_input.c                          |   3 +-
 scripts/bpf_doc.py                            |   4 +
 tools/include/uapi/linux/bpf.h                | 100 ++-
 tools/testing/selftests/bpf/.gitignore        |   1 +
 tools/testing/selftests/bpf/Makefile          |   2 +-
 .../selftests/bpf/prog_tests/xdp_synproxy.c   | 144 +++
 .../selftests/bpf/progs/xdp_synproxy_kern.c   | 819 ++++++++++++++++++
 tools/testing/selftests/bpf/xdp_synproxy.c    | 466 ++++++++++
 13 files changed, 1790 insertions(+), 22 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c
 create mode 100644 tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c
 create mode 100644 tools/testing/selftests/bpf/xdp_synproxy.c

Signature · 1 line

2.30.2

Maxim Mikityanskiy

author

2022-04-13 13:41 UTC #1 lore raw

PATCH v5 1/6 bpf: Use ipv6_only_sock in bpf_tcp_gen_syncookie

Instead of querying the sk_ipv6only field directly, use the dedicated ipv6_only_sock helper.

Signed-off-by Maxim Mikityanskiy <[email protected]>

Reviewed-by Tariq Toukan <[email protected]>

Acked-by John Fastabend <[email protected]>

Acked-by Lorenz Bauer <[email protected]>

Acked-by Petar Penkov <[email protected]>

---
 net/core/filter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

net/core/filter.c +1 -1

index a7044e98765e..7446b0ba4e38 100644
@@ -7090,7 +7090,7 @@ BPF_CALL_5(bpf_tcp_gen_syncookie, struct sock *, sk, void *, iph, u32, iph_len,
 	 */
 	switch (((struct iphdr *)iph)->version) {
 	case 4:
-		if (sk->sk_family == AF_INET6 && sk->sk_ipv6only)
+		if (sk->sk_family == AF_INET6 && ipv6_only_sock(sk))
 			return -EINVAL;
 
 		mss = tcp_v4_get_syncookie(sk, iph, th, &cookie);

Signature · 1 line

2.30.2

Maxim Mikityanskiy

author

2022-04-13 13:42 UTC #2 lore raw

PATCH v5 2/6 bpf: Fix documentation of th_len in bpf_tcp_{gen,check}_syncookie

In reply to Maxim Mikityanskiy

bpf_tcp_gen_syncookie expects the full length of the TCP header (with all options), and bpf_tcp_check_syncookie accepts lengths bigger than sizeof(struct tcphdr). Fix the documentation that says these lengths should be exactly sizeof(struct tcphdr).

While at it, fix a typo in the name of struct ipv6hdr.

Signed-off-by Maxim Mikityanskiy <[email protected]>

Reviewed-by Tariq Toukan <[email protected]>

---
 include/uapi/linux/bpf.h       | 10 ++++++----
 tools/include/uapi/linux/bpf.h | 10 ++++++----
 2 files changed, 12 insertions(+), 8 deletions(-)

include/uapi/linux/bpf.h +6 -4

index d14b10b85e51..5e1679af8282 100644
@@ -3587,10 +3587,11 @@ union bpf_attr {
  *
  * 		*iph* points to the start of the IPv4 or IPv6 header, while
  * 		*iph_len* contains **sizeof**\ (**struct iphdr**) or
- * 		**sizeof**\ (**struct ip6hdr**).
+ * 		**sizeof**\ (**struct ipv6hdr**).
  *
  * 		*th* points to the start of the TCP header, while *th_len*
- * 		contains **sizeof**\ (**struct tcphdr**).
+ *		contains the length of the TCP header (at least
+ *		**sizeof**\ (**struct tcphdr**)).
  * 	Return
  * 		0 if *iph* and *th* are a valid SYN cookie ACK, or a negative
  * 		error otherwise.

@@ -3773,10 +3774,11 @@ union bpf_attr {
  *
  *		*iph* points to the start of the IPv4 or IPv6 header, while
  *		*iph_len* contains **sizeof**\ (**struct iphdr**) or
- *		**sizeof**\ (**struct ip6hdr**).
+ *		**sizeof**\ (**struct ipv6hdr**).
  *
  *		*th* points to the start of the TCP header, while *th_len*
- *		contains the length of the TCP header.
+ *		contains the length of the TCP header with options (at least
+ *		**sizeof**\ (**struct tcphdr**)).
  *	Return
  *		On success, lower 32 bits hold the generated SYN cookie in
  *		followed by 16 bits which hold the MSS value for that cookie,

tools/include/uapi/linux/bpf.h +6 -4

index 7604e7d5438f..6ca3c017a664 100644
@@ -3587,10 +3587,11 @@ union bpf_attr {
  *
  * 		*iph* points to the start of the IPv4 or IPv6 header, while
  * 		*iph_len* contains **sizeof**\ (**struct iphdr**) or
- * 		**sizeof**\ (**struct ip6hdr**).
+ * 		**sizeof**\ (**struct ipv6hdr**).
  *
  * 		*th* points to the start of the TCP header, while *th_len*
- * 		contains **sizeof**\ (**struct tcphdr**).
+ *		contains the length of the TCP header (at least
+ *		**sizeof**\ (**struct tcphdr**)).
  * 	Return
  * 		0 if *iph* and *th* are a valid SYN cookie ACK, or a negative
  * 		error otherwise.

@@ -3773,10 +3774,11 @@ union bpf_attr {
  *
  *		*iph* points to the start of the IPv4 or IPv6 header, while
  *		*iph_len* contains **sizeof**\ (**struct iphdr**) or
- *		**sizeof**\ (**struct ip6hdr**).
+ *		**sizeof**\ (**struct ipv6hdr**).
  *
  *		*th* points to the start of the TCP header, while *th_len*
- *		contains the length of the TCP header.
+ *		contains the length of the TCP header with options (at least
+ *		**sizeof**\ (**struct tcphdr**)).
  *	Return
  *		On success, lower 32 bits hold the generated SYN cookie in
  *		followed by 16 bits which hold the MSS value for that cookie,

Signature · 1 line

2.30.2

Maxim Mikityanskiy

author

2022-04-13 13:42 UTC #3 lore raw

PATCH v5 3/6 bpf: Allow helpers to accept pointers with a fixed size

In reply to Maxim Mikityanskiy

Before this commit, the BPF verifier required ARG_PTR_TO_MEM arguments to be followed by ARG_CONST_SIZE holding the size of the memory region. The helpers had to check that size in runtime.

There are cases where the size expected by a helper is a compile-time constant. Checking it in runtime is an unnecessary overhead and waste of BPF registers.

This commit allows helpers to accept ARG_PTR_TO_MEM arguments without the corresponding ARG_CONST_SIZE, given that they define the memory region size in struct bpf_func_proto.

Signed-off-by Maxim Mikityanskiy <[email protected]>

Reviewed-by Tariq Toukan <[email protected]>

---
 include/linux/bpf.h   | 10 ++++++++++
 kernel/bpf/verifier.c | 26 +++++++++++++++-----------
 2 files changed, 25 insertions(+), 11 deletions(-)

include/linux/bpf.h +10 -0

index 88449fbbe063..988749057610 100644
@@ -465,6 +465,16 @@ struct bpf_func_proto {
 		};
 		u32 *arg_btf_id[5];
 	};
+	union {
+		struct {
+			size_t arg1_size;
+			size_t arg2_size;
+			size_t arg3_size;
+			size_t arg4_size;
+			size_t arg5_size;
+		};
+		size_t arg_size[5];
+	};
 	int *ret_btf_id; /* return value btf_id */
 	bool (*allowed)(const struct bpf_prog *prog);
 };

kernel/bpf/verifier.c +15 ~~-11~~

index 571ccd7f04eb..1b4c1e9ce8b2 100644
@@ -5573,6 +5573,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
 		 * next is_mem_size argument below.
 		 */
 		meta->raw_mode = (arg_type == ARG_PTR_TO_UNINIT_MEM);
+		if (fn->arg_size[arg]) {
+			err = check_helper_mem_access(env, regno,
+						      fn->arg_size[arg], false,
+						      meta);
+		}
 	} else if (arg_type_is_mem_size(arg_type)) {
 		bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO);

@@ -5912,13 +5917,12 @@ static bool check_raw_mode_ok(const struct bpf_func_proto *fn)
 	return count <= 1;
 }
 
-static bool check_args_pair_invalid(enum bpf_arg_type arg_curr,
-				    enum bpf_arg_type arg_next)
+static bool check_args_pair_invalid(const struct bpf_func_proto *fn, int arg)
 {
-	return (arg_type_is_mem_ptr(arg_curr) &&
-	        !arg_type_is_mem_size(arg_next)) ||
-	       (!arg_type_is_mem_ptr(arg_curr) &&
-		arg_type_is_mem_size(arg_next));
+	if (arg_type_is_mem_ptr(fn->arg_type[arg]))
+		return arg_type_is_mem_size(fn->arg_type[arg + 1]) ==
+			!!fn->arg_size[arg];
+	return arg_type_is_mem_size(fn->arg_type[arg + 1]) || fn->arg_size[arg];
 }
 
 static bool check_arg_pair_ok(const struct bpf_func_proto *fn)

@@ -5929,11 +5933,11 @@ static bool check_arg_pair_ok(const struct bpf_func_proto *fn)
 	 * helper function specification.
 	 */
 	if (arg_type_is_mem_size(fn->arg1_type) ||
-	    arg_type_is_mem_ptr(fn->arg5_type)  ||
-	    check_args_pair_invalid(fn->arg1_type, fn->arg2_type) ||
-	    check_args_pair_invalid(fn->arg2_type, fn->arg3_type) ||
-	    check_args_pair_invalid(fn->arg3_type, fn->arg4_type) ||
-	    check_args_pair_invalid(fn->arg4_type, fn->arg5_type))
+	    (arg_type_is_mem_ptr(fn->arg5_type) && !fn->arg5_size) ||
+	    check_args_pair_invalid(fn, 1) ||
+	    check_args_pair_invalid(fn, 2) ||
+	    check_args_pair_invalid(fn, 3) ||
+	    check_args_pair_invalid(fn, 4))
 		return false;
 
 	return true;

Signature · 1 line

2.30.2

Maxim Mikityanskiy

author

2022-04-13 13:42 UTC #4 lore raw

PATCH v5 4/6 bpf: Add helpers to issue and check SYN cookies in XDP

In reply to Maxim Mikityanskiy

The new helpers bpf_tcp_raw_{gen,check}_syncookie_ipv{4,6} allow an XDP program to generate SYN cookies in response to TCP SYN packets and to check those cookies upon receiving the first ACK packet (the final packet of the TCP handshake).

Unlike bpf_tcp_{gen,check}_syncookie these new helpers don't need a listening socket on the local machine, which allows to use them together with synproxy to accelerate SYN cookie generation.

Signed-off-by Maxim Mikityanskiy <[email protected]>

Reviewed-by Tariq Toukan <[email protected]>

---
 include/net/tcp.h              |   1 +
 include/uapi/linux/bpf.h       |  90 +++++++++++++++++++++++
 net/core/filter.c              | 126 +++++++++++++++++++++++++++++++++
 net/ipv4/tcp_input.c           |   3 +-
 scripts/bpf_doc.py             |   4 ++
 tools/include/uapi/linux/bpf.h |  90 +++++++++++++++++++++++
 6 files changed, 313 insertions(+), 1 deletion(-)

include/net/tcp.h +1 -0

index d486d7b6112d..1e34eb776888 100644
@@ -432,6 +432,7 @@ u16 tcp_v4_get_syncookie(struct sock *sk, struct iphdr *iph,
 			 struct tcphdr *th, u32 *cookie);
 u16 tcp_v6_get_syncookie(struct sock *sk, struct ipv6hdr *iph,
 			 struct tcphdr *th, u32 *cookie);
+u16 tcp_parse_mss_option(const struct tcphdr *th, u16 user_mss);
 u16 tcp_get_syncookie_mss(struct request_sock_ops *rsk_ops,
 			  const struct tcp_request_sock_ops *af_ops,
 			  struct sock *sk, struct tcphdr *th);

include/uapi/linux/bpf.h +90 -0

102 lines not on this page · raw message

net/core/filter.c +126 -0

138 lines not on this page · raw message

net/ipv4/tcp_input.c +2 -1

index 2088f93fa37b..3682ee405eb7 100644
@@ -3963,7 +3963,7 @@ static bool smc_parse_options(const struct tcphdr *th,
 /* Try to parse the MSS option from the TCP header. Return 0 on failure, clamped
  * value on success.
  */
-static u16 tcp_parse_mss_option(const struct tcphdr *th, u16 user_mss)
+u16 tcp_parse_mss_option(const struct tcphdr *th, u16 user_mss)
 {
 	const unsigned char *ptr = (const unsigned char *)(th + 1);
 	int length = (th->doff * 4) - sizeof(struct tcphdr);

@@ -4002,6 +4002,7 @@ static u16 tcp_parse_mss_option(const struct tcphdr *th, u16 user_mss)
 	}
 	return mss;
 }
+EXPORT_SYMBOL_GPL(tcp_parse_mss_option);
 
 /* Look for tcp options. Normally only called on SYN and SYNACK packets.
  * But, this can also be called on packets in the established flow when

scripts/bpf_doc.py +4 -0

index 096625242475..3d0b65e6dea7 100755
@@ -633,6 +633,8 @@ class PrinterHelpers(Printer):
             'struct socket',
             'struct file',
             'struct bpf_timer',
+            'struct iphdr',
+            'struct ipv6hdr',
     ]
     known_types = {
             '...',

@@ -682,6 +684,8 @@ class PrinterHelpers(Printer):
             'struct socket',
             'struct file',
             'struct bpf_timer',
+            'struct iphdr',
+            'struct ipv6hdr',
     }
     mapped_types = {
             'u8': '__u8',

tools/include/uapi/linux/bpf.h +90 -0

102 lines not on this page · raw message

Signature · 1 line

2.30.2

Daniel Borkmann

maintainer

2022-04-13 23:08 UTC #5 lore raw

Re: [PATCH bpf-next v5 4/6] bpf: Add helpers to issue and check SYN cookies in XDP

On 4/13/22 3:41 PM, Maxim Mikityanskiy wrote:
[...]

Quoted 16 lines

/* integer value in 'imm' field of BPF_CALL instruction selects which helper

net/core/filter.c +7 -0

index 7446b0ba4e38..428cc63ecdf7 100644
@@ -7425,6 +7425,124 @@ static const struct bpf_func_proto bpf_skb_set_tstamp_proto = {
  	.arg3_type      = ARG_ANYTHING,
  };
 
+BPF_CALL_3(bpf_tcp_raw_gen_syncookie_ipv4, struct iphdr *, iph,
+	   struct tcphdr *, th, u32, th_len)
+{
+#ifdef CONFIG_SYN_COOKIES
+	u32 cookie;
+	u16 mss;
+

net/core/filter.c static const struct bpf_func_proto bpf_skb_set_tstamp_proto = { · line 7444

Quoted 10 lines

net/core/filter.c +10 -0

+	if (unlikely(th_len < sizeof(*th) || th_len != th->doff * 4))
+		return -EINVAL;
+
+	mss = tcp_parse_mss_option(th, 0) ?: TCP_MSS_DEFAULT;
+	cookie = __cookie_v4_init_sequence(iph, th, &mss);
+
+	return cookie | ((u64)mss << 32);
+#else
+	return -EOPNOTSUPP;
+#endif /* CONFIG_SYN_COOKIES */

This (and for other added helpers below) will be rather tricky to probe for availability e.g. via bpftool feature probe [...]. Much better if you wrap the ifdef CONFIG_SYN_COOKIES around the {xdp,tc_cls_act}_func_proto() instead as we do elsewhere.

Quoted 46 lines

net/core/filter.c +46 -0

+}
+
+static const struct bpf_func_proto bpf_tcp_raw_gen_syncookie_ipv4_proto = {
+	.func		= bpf_tcp_raw_gen_syncookie_ipv4,
+	.gpl_only	= true, /* __cookie_v4_init_sequence() is GPL */
+	.pkt_access	= true,
+	.ret_type	= RET_INTEGER,
+	.arg1_type	= ARG_PTR_TO_MEM,
+	.arg1_size	= sizeof(struct iphdr),
+	.arg2_type	= ARG_PTR_TO_MEM,
+	.arg3_type	= ARG_CONST_SIZE,
+};
+
+BPF_CALL_3(bpf_tcp_raw_gen_syncookie_ipv6, struct ipv6hdr *, iph,
+	   struct tcphdr *, th, u32, th_len)
+{
+#ifndef CONFIG_SYN_COOKIES
+	return -EOPNOTSUPP;
+#elif !IS_BUILTIN(CONFIG_IPV6)
+	return -EPROTONOSUPPORT;
+#else
+	const u16 mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) -
+		sizeof(struct ipv6hdr);
+	u32 cookie;
+	u16 mss;
+
+	if (unlikely(th_len < sizeof(*th) || th_len != th->doff * 4))
+		return -EINVAL;
+
+	mss = tcp_parse_mss_option(th, 0) ?: mss_clamp;
+	cookie = __cookie_v6_init_sequence(iph, th, &mss);
+
+	return cookie | ((u64)mss << 32);
+#endif
+}
+
+static const struct bpf_func_proto bpf_tcp_raw_gen_syncookie_ipv6_proto = {
+	.func		= bpf_tcp_raw_gen_syncookie_ipv6,
+	.gpl_only	= true, /* __cookie_v6_init_sequence() is GPL */
+	.pkt_access	= true,
+	.ret_type	= RET_INTEGER,
+	.arg1_type	= ARG_PTR_TO_MEM,
+	.arg1_size	= sizeof(struct ipv6hdr),
+	.arg2_type	= ARG_PTR_TO_MEM,
+	.arg3_type	= ARG_CONST_SIZE,
+};

[...]

Quoted 17 lines

bool bpf_helper_changes_pkt_data(void *func)

net/core/filter.c +8 -0

@@ -7837,6 +7955,14 @@ xdp_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
  		return &bpf_tcp_check_syncookie_proto;
  	case BPF_FUNC_tcp_gen_syncookie:
  		return &bpf_tcp_gen_syncookie_proto;
+	case BPF_FUNC_tcp_raw_gen_syncookie_ipv4:
+		return &bpf_tcp_raw_gen_syncookie_ipv4_proto;
+	case BPF_FUNC_tcp_raw_gen_syncookie_ipv6:
+		return &bpf_tcp_raw_gen_syncookie_ipv6_proto;
+	case BPF_FUNC_tcp_raw_check_syncookie_ipv4:
+		return &bpf_tcp_raw_check_syncookie_ipv4_proto;
+	case BPF_FUNC_tcp_raw_check_syncookie_ipv6:
+		return &bpf_tcp_raw_check_syncookie_ipv6_proto;
  #endif
  	default:
  		return bpf_sk_base_func_proto(func_id);

Maxim Mikityanskiy

author

2022-04-22 17:28 UTC #6 lore raw

Re: [PATCH bpf-next v5 4/6] bpf: Add helpers to issue and check SYN cookies in XDP

Quoted 24 lines · Daniel Borkmann

On 4/13/22 3:41 PM, Maxim Mikityanskiy wrote:
[...]

Quoted 22 lines

/* integer value in 'imm' field of BPF_CALL instruction selects which helper

net/core/filter.c +13 -0

index 7446b0ba4e38..428cc63ecdf7 100644
@@ -7425,6 +7425,124 @@ static const struct bpf_func_proto 
 bpf_skb_set_tstamp_proto = {
       .arg3_type      = ARG_ANYTHING,
   };
+BPF_CALL_3(bpf_tcp_raw_gen_syncookie_ipv4, struct iphdr *, iph,
+       struct tcphdr *, th, u32, th_len)
+{
+#ifdef CONFIG_SYN_COOKIES
+    u32 cookie;
+    u16 mss;
+
+    if (unlikely(th_len < sizeof(*th) || th_len != th->doff * 4))
+        return -EINVAL;
+
+    mss = tcp_parse_mss_option(th, 0) ?: TCP_MSS_DEFAULT;
+    cookie = __cookie_v4_init_sequence(iph, th, &mss);
+

Quoted 8 lines

net/core/filter.c static const struct bpf_func_proto bpf_skb_set_tstamp_proto = { · line 7444
Quoted 4 lines
net/core/filter.c +4 -0
+    return cookie | ((u64)mss << 32);
+#else
+    return -EOPNOTSUPP;
+#endif /* CONFIG_SYN_COOKIES */
This (and for other added helpers below) will be rather tricky to probe for availability e.g. via bpftool feature probe [...]. Much better if you wrap the ifdef CONFIG_SYN_COOKIES around the {xdp,tc_cls_act}_func_proto() instead as we do elsewhere.

Just for the record, I copied this pattern from the existing SYN cookie helpers, but what you suggest makes sense, so I'll fix it for my helpers and resubmit.

Quoted 66 lines

Quoted 48 lines

net/core/filter.c +46 -0

+}
+
+static const struct bpf_func_proto 
 bpf_tcp_raw_gen_syncookie_ipv4_proto = {
+    .func        = bpf_tcp_raw_gen_syncookie_ipv4,
+    .gpl_only    = true, /* __cookie_v4_init_sequence() is GPL */
+    .pkt_access    = true,
+    .ret_type    = RET_INTEGER,
+    .arg1_type    = ARG_PTR_TO_MEM,
+    .arg1_size    = sizeof(struct iphdr),
+    .arg2_type    = ARG_PTR_TO_MEM,
+    .arg3_type    = ARG_CONST_SIZE,
+};
+
+BPF_CALL_3(bpf_tcp_raw_gen_syncookie_ipv6, struct ipv6hdr *, iph,
+       struct tcphdr *, th, u32, th_len)
+{
+#ifndef CONFIG_SYN_COOKIES
+    return -EOPNOTSUPP;
+#elif !IS_BUILTIN(CONFIG_IPV6)
+    return -EPROTONOSUPPORT;
+#else
+    const u16 mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) -
+        sizeof(struct ipv6hdr);
+    u32 cookie;
+    u16 mss;
+
+    if (unlikely(th_len < sizeof(*th) || th_len != th->doff * 4))
+        return -EINVAL;
+
+    mss = tcp_parse_mss_option(th, 0) ?: mss_clamp;
+    cookie = __cookie_v6_init_sequence(iph, th, &mss);
+
+    return cookie | ((u64)mss << 32);
+#endif
+}
+
+static const struct bpf_func_proto 
 bpf_tcp_raw_gen_syncookie_ipv6_proto = {
+    .func        = bpf_tcp_raw_gen_syncookie_ipv6,
+    .gpl_only    = true, /* __cookie_v6_init_sequence() is GPL */
+    .pkt_access    = true,
+    .ret_type    = RET_INTEGER,
+    .arg1_type    = ARG_PTR_TO_MEM,
+    .arg1_size    = sizeof(struct ipv6hdr),
+    .arg2_type    = ARG_PTR_TO_MEM,
+    .arg3_type    = ARG_CONST_SIZE,
+};

[...]

Quoted 17 lines

bool bpf_helper_changes_pkt_data(void *func)
net/core/filter.c +0 -0
@@ -7837,6 +7955,14 @@ xdp_func_proto(enum bpf_func_id func_id, const 
 struct bpf_prog *prog)
           return &bpf_tcp_check_syncookie_proto;
      case BPF_FUNC_tcp_gen_syncookie:
          return &bpf_tcp_gen_syncookie_proto; +    case BPF_FUNC_tcp_raw_gen_syncookie_ipv4:
+        return &bpf_tcp_raw_gen_syncookie_ipv4_proto; +    case BPF_FUNC_tcp_raw_gen_syncookie_ipv6:
+        return &bpf_tcp_raw_gen_syncookie_ipv6_proto; +    case BPF_FUNC_tcp_raw_check_syncookie_ipv4:
+        return &bpf_tcp_raw_check_syncookie_ipv4_proto; +    case BPF_FUNC_tcp_raw_check_syncookie_ipv6:
+        return &bpf_tcp_raw_check_syncookie_ipv6_proto; #endif
      default:
          return bpf_sk_base_func_proto(func_id);

Maxim Mikityanskiy

author

2022-04-13 13:42 UTC #7 lore raw

PATCH v5 5/6 bpf: Add selftests for raw syncookie helpers

In reply to Maxim Mikityanskiy

This commit adds selftests for the new BPF helpers:
bpf_tcp_raw_{gen,check}_syncookie_ipv{4,6}.

xdp_synproxy_kern.c is a BPF program that generates SYN cookies on allowed TCP ports and sends SYNACKs to clients, accelerating synproxy iptables module.

xdp_synproxy.c is a userspace control application that allows to configure the following options in runtime: list of allowed ports, MSS, window scale, TTL.

A selftest is added to prog_tests that leverages the above programs to test the functionality of the new helpers.

Signed-off-by Maxim Mikityanskiy <[email protected]>

Reviewed-by Tariq Toukan <[email protected]>

---
 tools/testing/selftests/bpf/.gitignore        |   1 +
 tools/testing/selftests/bpf/Makefile          |   2 +-
 .../selftests/bpf/prog_tests/xdp_synproxy.c   | 109 +++
 .../selftests/bpf/progs/xdp_synproxy_kern.c   | 750 ++++++++++++++++++
 tools/testing/selftests/bpf/xdp_synproxy.c    | 418 ++++++++++
 5 files changed, 1279 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c
 create mode 100644 tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c
 create mode 100644 tools/testing/selftests/bpf/xdp_synproxy.c

tools/testing/selftests/bpf/.gitignore +1 -0

index 595565eb68c0..ca2f47f45670 100644
@@ -43,3 +43,4 @@ test_cpp
 *.tmp
 xdpxceiver
 xdp_redirect_multi
+xdp_synproxy

tools/testing/selftests/bpf/Makefile +1 -1

index 3820608faf57..4a391073aa3e 100644
@@ -82,7 +82,7 @@ TEST_PROGS_EXTENDED := with_addr.sh \
 TEST_GEN_PROGS_EXTENDED = test_sock_addr test_skb_cgroup_id_user \
 	flow_dissector_load test_flow_dissector test_tcp_check_syncookie_user \
 	test_lirc_mode2_user xdping test_cpp runqslower bench bpf_testmod.ko \
-	xdpxceiver xdp_redirect_multi
+	xdpxceiver xdp_redirect_multi xdp_synproxy
 
 TEST_CUSTOM_PROGS = $(OUTPUT)/urandom_read

tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c new file +109 -0

109 lines not on this page · raw message

tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c new file +750 -0

750 lines not on this page · raw message

tools/testing/selftests/bpf/xdp_synproxy.c new file +418 -0

418 lines not on this page · raw message

Signature · 1 line

2.30.2

Maxim Mikityanskiy

author

2022-04-13 13:42 UTC #8 lore raw

PATCH v5 6/6 bpf: Allow the new syncookie helpers to work with SKBs

In reply to Maxim Mikityanskiy

This commits allows the new BPF helpers to work in SKB context (in TC BPF programs): bpf_tcp_raw_{gen,check}_syncookie_ipv{4,6}.

The sample application and selftest are updated to support the TC mode. It's not the recommended mode of operation, because the SKB is already created at this point, and it's unlikely that the BPF program will provide any substantional speedup compared to regular SYN cookies or synproxy.

Signed-off-by Maxim Mikityanskiy <[email protected]>

Reviewed-by Tariq Toukan <[email protected]>

---
 net/core/filter.c                             |   8 +
 .../selftests/bpf/prog_tests/xdp_synproxy.c   |  53 +++++--
 .../selftests/bpf/progs/xdp_synproxy_kern.c   | 141 +++++++++++++-----
 tools/testing/selftests/bpf/xdp_synproxy.c    |  94 +++++++++---
 4 files changed, 228 insertions(+), 68 deletions(-)

net/core/filter.c +8 -0

index 428cc63ecdf7..76d89fa64a31 100644
@@ -7906,6 +7906,14 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 		return &bpf_sk_assign_proto;
 	case BPF_FUNC_skb_set_tstamp:
 		return &bpf_skb_set_tstamp_proto;
+	case BPF_FUNC_tcp_raw_gen_syncookie_ipv4:
+		return &bpf_tcp_raw_gen_syncookie_ipv4_proto;
+	case BPF_FUNC_tcp_raw_gen_syncookie_ipv6:
+		return &bpf_tcp_raw_gen_syncookie_ipv6_proto;
+	case BPF_FUNC_tcp_raw_check_syncookie_ipv4:
+		return &bpf_tcp_raw_check_syncookie_ipv4_proto;
+	case BPF_FUNC_tcp_raw_check_syncookie_ipv6:
+		return &bpf_tcp_raw_check_syncookie_ipv6_proto;
 #endif
 	default:
 		return bpf_sk_base_func_proto(func_id);

tools/testing/selftests/bpf/prog_tests/xdp_synproxy.c +44 -9

98 lines not on this page · raw message

tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c +105 ~~-36~~

215 lines not on this page · raw message

tools/testing/selftests/bpf/xdp_synproxy.c +71 ~~-23~~

174 lines not on this page · raw message

Signature · 1 line

2.30.2