NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
TencentOS-kernel/kernel/bpf
History
Jakub Sitnicki f70c0fa70c inet: Run SK_LOOKUP BPF program on socket lookup 
[upstream commit 1559b4aa1db443096af493c7d621dc156054babe]

Run a BPF program before looking up a listening socket on the receive path.
Program selects a listening socket to yield as result of socket lookup by
calling bpf_sk_assign() helper and returning SK_PASS code. Program can
revert its decision by assigning a NULL socket with bpf_sk_assign().

Alternatively, BPF program can also fail the lookup by returning with
SK_DROP, or let the lookup continue as usual with SK_PASS on return, when
no socket has been selected with bpf_sk_assign().

This lets the user match packets with listening sockets freely at the last
possible point on the receive path, where we know that packets are destined
for local delivery after undergoing policing, filtering, and routing.

With BPF code selecting the socket, directing packets destined to an IP
range or to a port range to a single socket becomes possible.

In case multiple programs are attached, they are run in series in the order
in which they were attached. The end result is determined from return codes
of all the programs according to following rules:

 1. If any program returned SK_PASS and selected a valid socket, the socket
    is used as result of socket lookup.
 2. If more than one program returned SK_PASS and selected a socket,
    last selection takes effect.
 3. If any program returned SK_DROP, and no program returned SK_PASS and
    selected a socket, socket lookup fails with -ECONNREFUSED.
 4. If all programs returned SK_PASS and none of them selected a socket,
    socket lookup continues to htable-based lookup.

Suggested-by: Marek Majkowski <marek@cloudflare.com>
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200717103536.397595-5-jakub@cloudflare.com
 		2022-06-21 10:27:10 +08:00
..
Makefile flow_dissector: Move out netns_bpf prog callbacks 2022-06-21 10:27:09 +08:00
arraymap.c bpf: Simplify __bpf_arch_text_poke poke type handling 2022-06-21 10:27:06 +08:00
bpf_lru_list.c bpf_lru_list: Read double-checked variable once without lock 2021-04-12 12:52:15 +08:00
bpf_lru_list.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
bpf_lsm.c bpf: lsm: Implement attach, detach and execution 2022-06-21 10:27:08 +08:00
bpf_struct_ops.c bpf: Refactor trampoline update code 2022-06-21 10:27:07 +08:00
bpf_struct_ops_types.h bpf: tcp: Support tcp_congestion_ops in bpf 2022-06-21 10:27:05 +08:00
btf.c bpf: Add support for BPF_OBJ_GET_INFO_BY_FD for bpf_link 2022-06-21 10:27:09 +08:00
cgroup.c bpf, cgroup: Return ENOLINK for auto-detached links on update 2022-06-21 10:27:09 +08:00
core.c bpf, netns: Handle multiple link attachments 2022-06-21 10:27:10 +08:00
cpumap.c cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled 2021-03-16 16:27:10 +08:00
devmap.c devmap: Use bpf_map_area_alloc() for allocating hash buckets 2021-03-16 16:30:57 +08:00
disasm.c bpf: Introduce BPF nospec instruction for mitigating Spectre v4 2022-06-21 10:27:02 +08:00
disasm.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
dispatcher.c bpf: Introduce BPF dispatcher 2022-06-21 10:27:06 +08:00
hashtab.c bpf: Factor out hashtab bucket lock operations 2022-06-21 10:27:08 +08:00
helpers.c bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback 2021-03-16 16:44:00 +08:00
inode.c bpf: Introduce pinnable bpf_link abstraction 2022-06-21 10:27:08 +08:00
local_storage.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
lpm_trie.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
map_in_map.c bpf: Move owner type, jited info into array auxiliary data 2022-06-21 10:27:05 +08:00
map_in_map.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
net_namespace.c inet: Run SK_LOOKUP BPF program on socket lookup 2022-06-21 10:27:10 +08:00
offload.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
percpu_freelist.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
percpu_freelist.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
queue_stack_maps.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
reuseport_array.c net: Generate reuseport group ID on group creation 2022-06-21 10:27:07 +08:00
stackmap.c bpf: Check for integer overflow when using roundup_pow_of_two() 2021-04-12 12:52:03 +08:00
syscall.c bpf: Introduce SK_LOOKUP program type with a dedicated attach point 2022-06-21 10:27:10 +08:00
sysfs_btf.c bpf: Fix sysfs export of empty BTF section 2021-03-16 16:37:55 +08:00
tnum.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
trampoline.c bpf: lsm: Implement attach, detach and execution 2022-06-21 10:27:08 +08:00
verifier.c bpf: Introduce SK_LOOKUP program type with a dedicated attach point 2022-06-21 10:27:10 +08:00
xskmap.c bpf: Implement map_gen_lookup() callback for XSKMAP 2022-06-21 10:27:03 +08:00