netfilter: Add the capability to offload flowtable in XDP layer

Introduce bpf_xdp_flow_offload_lookup kfunc in order to perform the lookup of a given flowtable entry based on a fib tuple of incoming traffic.
bpf_xdp_flow_offload_lookup can be used as building block to offload in xdp the processing of sw flowtable when hw flowtable is not available.

Signed-off-by Lorenzo Bianconi <[email protected]>

---

Introduce bpf_xdp_flow_offload_lookup kfunc in order to perform the lookup of a given flowtable entry based on a fib tuple of incoming traffic.
bpf_xdp_flow_offload_lookup can be used as building block to offload in xdp the processing of sw flowtable when hw flowtable is not available.

Signed-off-by Lorenzo Bianconi <[email protected]>

---
 include/net/netfilter/nf_flow_table.h | 10 +++
 net/netfilter/Makefile                |  5 ++
 net/netfilter/nf_flow_table_bpf.c     | 94 +++++++++++++++++++++++++++
 net/netfilter/nf_flow_table_inet.c    |  2 +-
 4 files changed, 110 insertions(+), 1 deletion(-)
 create mode 100644 net/netfilter/nf_flow_table_bpf.c

include/net/netfilter/nf_flow_table.h +10 -0

index 0bbe6ea8e0651..085660cbcd3f2 100644
@@ -312,6 +312,16 @@ unsigned int nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
 unsigned int nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
                                       const struct nf_hook_state *state);
 
+#if (IS_BUILTIN(CONFIG_NF_FLOW_TABLE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \
+    (IS_MODULE(CONFIG_NF_FLOW_TABLE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES))
+extern int nf_flow_offload_register_bpf(void);
+#else
+static inline int nf_flow_offload_register_bpf(void)
+{
+       return 0;
+}
+#endif
+
 #define MODULE_ALIAS_NF_FLOWTABLE(family)      \
        MODULE_ALIAS("nf-flowtable-" __stringify(family))
 

net/netfilter/Makefile +5 -0

index 614815a3ed738..18b09cec92024 100644
@@ -144,6 +144,11 @@ obj-$(CONFIG_NF_FLOW_TABLE)        += nf_flow_table.o
 nf_flow_table-objs             := nf_flow_table_core.o nf_flow_table_ip.o \
                                   nf_flow_table_offload.o
 nf_flow_table-$(CONFIG_NF_FLOW_TABLE_PROCFS) += nf_flow_table_procfs.o
+ifeq ($(CONFIG_NF_FLOW_TABLE),m)
+nf_flow_table-$(CONFIG_DEBUG_INFO_BTF_MODULES) += nf_flow_table_bpf.o
+else ifeq ($(CONFIG_NF_FLOW_TABLE),y)
+nf_flow_table-$(CONFIG_DEBUG_INFO_BTF) += nf_flow_table_bpf.o
+endif
 
 obj-$(CONFIG_NF_FLOW_TABLE_INET) += nf_flow_table_inet.o
 

net/netfilter/nf_flow_table_bpf.c new file +71 -0

new file mode 100644
index 0000000000000..f999ed9712796
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Unstable Flow Table Helpers for XDP hook
+ *
+ * These are called from the XDP programs.
+ * Note that it is allowed to break compatibility for these functions since
+ * the interface they are exposed through to BPF programs is explicitly
+ * unstable.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <net/netfilter/nf_flow_table.h>
+#include <linux/bpf.h>
+#include <linux/btf.h>
+#include <net/xdp.h>
+
+__diag_push();
+__diag_ignore_all("-Wmissing-prototypes",
+                 "Global functions as their definitions will be in nf_flow_table BTF");
+
+static struct flow_offload_tuple_rhash *
+bpf_xdp_flow_offload_tuple_lookup(struct net_device *dev,
+                                 struct flow_offload_tuple *tuple,
+                                 __be16 proto)
+{
+       struct flow_offload_tuple_rhash *tuplehash;
+       struct nf_flowtable *flow_table;
+       struct flow_offload *flow;
+
+       flow_table = nf_flowtable_by_dev(dev);
+       if (!flow_table)
+               return NULL;
+
+       tuplehash = flow_offload_lookup(flow_table, tuple);
+       if (!tuplehash)
+               return NULL;
+
+       flow = container_of(tuplehash, struct flow_offload,
+                           tuplehash[tuplehash->tuple.dir]);
+       flow_offload_refresh(flow_table, flow, false);
+
+       return tuplehash;
+}
+
+__bpf_kfunc struct flow_offload_tuple_rhash *
+bpf_xdp_flow_offload_lookup(struct xdp_md *ctx,
+                           struct bpf_fib_lookup *fib_tuple)
+{
+       struct xdp_buff *xdp = (struct xdp_buff *)ctx;
+       struct flow_offload_tuple tuple = {
+               .iifidx = fib_tuple->ifindex,
+               .l3proto = fib_tuple->family,
+               .l4proto = fib_tuple->l4_protocol,
+               .src_port = fib_tuple->sport,
+               .dst_port = fib_tuple->dport,
+       };
+       __be16 proto;
+
+       switch (fib_tuple->family) {
+       case AF_INET:
+               tuple.src_v4.s_addr = fib_tuple->ipv4_src;
+               tuple.dst_v4.s_addr = fib_tuple->ipv4_dst;
+               proto = htons(ETH_P_IP);
+               break;
+       case AF_INET6:
+               tuple.src_v6 = *(struct in6_addr *)&fib_tuple->ipv6_src;
+               tuple.dst_v6 = *(struct in6_addr *)&fib_tuple->ipv6_dst;
+               proto = htons(ETH_P_IPV6);
+               break;
+       default:

net/netfilter/nf_flow_table_bpf.c new file +13 -0

+BTF_KFUNCS_END(nf_ft_kfunc_set)
+
+static const struct btf_kfunc_id_set nf_flow_offload_kfunc_set = {
+       .owner = THIS_MODULE,
+       .set   = &nf_ft_kfunc_set,
+};
+
+int nf_flow_offload_register_bpf(void)
+{
+       return register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP,
+                                        &nf_flow_offload_kfunc_set);
+}
+EXPORT_SYMBOL_GPL(nf_flow_offload_register_bpf);

net/netfilter/nf_flow_table_inet.c +1 -2

index 6eef15648b7b0..6175f7556919d 100644
@@ -98,7 +98,7 @@ static int __init nf_flow_inet_module_init(void)
        nft_register_flowtable_type(&flowtable_ipv6);
        nft_register_flowtable_type(&flowtable_inet);
 
-       return 0;
+       return nf_flow_offload_register_bpf();
 }
 
 static void __exit nf_flow_inet_module_exit(void)
--

2.45.1

I think it needs to be KF_RET_NULL.
And most likely KF_TRUSTED_ARGS as well.

Also the "offload" doesn't fit in the name.
The existing code calls it "offload", because it's actually pushing the rules to HW (if I understand the code), but here it's just a lookup from xdp.
So call it
bpf_xdp_flow_lookup() ?

Though "flow" is a bit too generic here.
nf_flow maybe?

Quoted 30 lines

net/netfilter/nf_flow_table_bpf.c new file +13 -0

+BTF_KFUNCS_END(nf_ft_kfunc_set)
+
+static const struct btf_kfunc_id_set nf_flow_offload_kfunc_set = {
+       .owner = THIS_MODULE,
+       .set   = &nf_ft_kfunc_set,
+};
+
+int nf_flow_offload_register_bpf(void)
+{
+       return register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP,
+                                        &nf_flow_offload_kfunc_set);
+}
+EXPORT_SYMBOL_GPL(nf_flow_offload_register_bpf);

net/netfilter/nf_flow_table_inet.c +1 -2

index 6eef15648b7b0..6175f7556919d 100644
@@ -98,7 +98,7 @@ static int __init nf_flow_inet_module_init(void)
        nft_register_flowtable_type(&flowtable_ipv6);
        nft_register_flowtable_type(&flowtable_inet);
 
-       return 0;
+       return nf_flow_offload_register_bpf();
 }
 
 static void __exit nf_flow_inet_module_exit(void)
--

2.45.1

Introduce xdp_flowtable_offload bpf sample to offload sw flowtable logic in xdp layer if hw flowtable is not available or does not support a specific kind of traffic.

Signed-off-by Lorenzo Bianconi <[email protected]>

---
 samples/bpf/Makefile                     |   7 +-
 samples/bpf/xdp_flowtable_offload.bpf.c  | 591 +++++++++++++++++++++++
 samples/bpf/xdp_flowtable_offload_user.c | 128 +++++
 3 files changed, 725 insertions(+), 1 deletion(-)
 create mode 100644 samples/bpf/xdp_flowtable_offload.bpf.c
 create mode 100644 samples/bpf/xdp_flowtable_offload_user.c

Quoted 5 lines · Lorenzo Bianconi

Introduce xdp_flowtable_offload bpf sample to offload sw flowtable logic in xdp layer if hw flowtable is not available or does not support a specific kind of traffic.

Quoted 8 lines

Signed-off-by Lorenzo Bianconi <[email protected]>

---
 samples/bpf/Makefile                     |   7 +-
 samples/bpf/xdp_flowtable_offload.bpf.c  | 591 +++++++++++++++++++++++
 samples/bpf/xdp_flowtable_offload_user.c | 128 +++++
 3 files changed, 725 insertions(+), 1 deletion(-)
 create mode 100644 samples/bpf/xdp_flowtable_offload.bpf.c
 create mode 100644 samples/bpf/xdp_flowtable_offload_user.c

I feel this sample code is dead on arrival.
Make selftest more real if you want people to use it as an example, but samples dir is just a dumping ground.
We shouldn't be adding anything to it.

Quoted 15 lines · Alexei Starovoitov

Quoted 13 lines · Lorenzo Bianconi

Introduce xdp_flowtable_offload bpf sample to offload sw flowtable logic in xdp layer if hw flowtable is not available or does not support a specific kind of traffic.

Signed-off-by Lorenzo Bianconi <[email protected]>

---
 samples/bpf/Makefile                     |   7 +-
 samples/bpf/xdp_flowtable_offload.bpf.c  | 591 +++++++++++++++++++++++
 samples/bpf/xdp_flowtable_offload_user.c | 128 +++++
 3 files changed, 725 insertions(+), 1 deletion(-)
 create mode 100644 samples/bpf/xdp_flowtable_offload.bpf.c
 create mode 100644 samples/bpf/xdp_flowtable_offload_user.c

Quoted 4 lines

I feel this sample code is dead on arrival.
Make selftest more real if you want people to use it as an example, but samples dir is just a dumping ground.
We shouldn't be adding anything to it.

Agreed. We can integrate a working sample into xdp-tools instead :)

-Toke

Introduce e2e selftest for bpf_xdp_flow_offload_lookup kfunc through xdp_flowtable utility.

Signed-off-by Lorenzo Bianconi <[email protected]>

---
 tools/testing/selftests/bpf/Makefile          |  10 +-
 tools/testing/selftests/bpf/config            |   4 +
 .../selftests/bpf/progs/xdp_flowtable.c       | 141 +++++++++++++++++
 .../selftests/bpf/test_xdp_flowtable.sh       | 112 ++++++++++++++
 tools/testing/selftests/bpf/xdp_flowtable.c   | 142 ++++++++++++++++++
 5 files changed, 407 insertions(+), 2 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/xdp_flowtable.c
 create mode 100755 tools/testing/selftests/bpf/test_xdp_flowtable.sh
 create mode 100644 tools/testing/selftests/bpf/xdp_flowtable.c

tools/testing/selftests/bpf/Makefile +8 -2

index e0b3887b3d2df..7361c429bed62 100644
@@ -133,7 +133,8 @@ TEST_PROGS := test_kmod.sh \
        test_bpftool_metadata.sh \
        test_doc_build.sh \
        test_xsk.sh \
-       test_xdp_features.sh
+       test_xdp_features.sh \
+       test_xdp_flowtable.sh
 
 TEST_PROGS_EXTENDED := with_addr.sh \
        with_tunnels.sh ima_setup.sh verify_sig_setup.sh \

@@ -144,7 +145,7 @@ TEST_GEN_PROGS_EXTENDED = test_skb_cgroup_id_user \
        flow_dissector_load test_flow_dissector test_tcp_check_syncookie_user \
        test_lirc_mode2_user xdping test_cpp runqslower bench bpf_testmod.ko \
        xskxceiver xdp_redirect_multi xdp_synproxy veristat xdp_hw_metadata \
-       xdp_features bpf_test_no_cfi.ko
+       xdp_features bpf_test_no_cfi.ko xdp_flowtable
 
 TEST_GEN_FILES += liburandom_read.so urandom_read sign-file uprobe_multi
 

@@ -476,6 +477,7 @@ test_usdt.skel.h-deps := test_usdt.bpf.o test_usdt_multispec.bpf.o
 xsk_xdp_progs.skel.h-deps := xsk_xdp_progs.bpf.o
 xdp_hw_metadata.skel.h-deps := xdp_hw_metadata.bpf.o
 xdp_features.skel.h-deps := xdp_features.bpf.o
+xdp_flowtable.skel.h-deps := xdp_flowtable.bpf.o
 
 LINKED_BPF_SRCS := $(patsubst %.bpf.o,%.c,$(foreach skel,$(LINKED_SKELS),$($(skel)-deps)))
 

@@ -710,6 +712,10 @@ $(OUTPUT)/xdp_features: xdp_features.c $(OUTPUT)/network_helpers.o $(OUTPUT)/xdp
        $(call msg,BINARY,,$@)
        $(Q)$(CC) $(CFLAGS) $(filter %.a %.o %.c,$^) $(LDLIBS) -o $@
 
+$(OUTPUT)/xdp_flowtable: xdp_flowtable.c $(OUTPUT)/xdp_flowtable.skel.h | $(OUTPUT)
+       $(call msg,BINARY,,$@)
+       $(Q)$(CC) $(CFLAGS) $(filter %.a %.o %.c,$^) $(LDLIBS) -o $@
+
 # Make sure we are able to include and link libbpf against c++.
 $(OUTPUT)/test_cpp: test_cpp.cpp $(OUTPUT)/test_core_extern.skel.h $(BPFOBJ)
        $(call msg,CXX,,$@)

tools/testing/selftests/bpf/config +4 -0

index eeabd798bc3ae..1a9aea01145f7 100644
@@ -82,6 +82,10 @@ CONFIG_NF_CONNTRACK=y
 CONFIG_NF_CONNTRACK_MARK=y
 CONFIG_NF_DEFRAG_IPV4=y
 CONFIG_NF_DEFRAG_IPV6=y
+CONFIG_NF_TABLES=y
+CONFIG_NETFILTER_INGRESS=y
+CONFIG_NF_FLOW_TABLE=y
+CONFIG_NF_FLOW_TABLE_INET=y
 CONFIG_NF_NAT=y
 CONFIG_RC_CORE=y
 CONFIG_SECURITY=y

tools/testing/selftests/bpf/progs/xdp_flowtable.c new file +17 -0

new file mode 100644
index 0000000000000..888ac87790f90
@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <vmlinux.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_endian.h>
+
+#define MAX_ERRNO      4095
+
+#define ETH_P_IP       0x0800
+#define ETH_P_IPV6     0x86dd
+#define IP_MF          0x2000  /* "More Fragments" */
+#define IP_OFFSET      0x1fff  /* "Fragment Offset" */
+#define AF_INET                2
+#define AF_INET6       10
+
+struct flow_offload_tuple_rhash *
+bpf_xdp_flow_offload_lookup(struct xdp_md *,
+                           struct bpf_fib_lookup *) __ksym;