On 06/19/2018 11:00 AM, Tushar Dave wrote:
This follows up on https://patchwork.ozlabs.org/cover/927050/ where the review feedback was to use bpf_skb_load_bytes() to deal with linear and non-linear skbs. While that feedback is valid and correct, the motivation for this work is to allow eBPF based firewalling for kernel modules that do not always get their packet as an sk_buff from their downlink drivers. One such instance of this use-case is RDS, which can be run both over IB (driver RDMA's a scatterlist to the RDS module) or over TCP (TCP passes an sk_buff to the RDS module) This RFC (call it v2) uses exiting socket filter infrastructure and extend it with new eBPF program type that deals with struct scatterlist. For RDS, the integrated approach treats the scatterlist as the common denominator, and allows the application to write a filter for processing a scatterlist. Details: Patch 1 adds new eBPF prog type BPF_PROG_TYPE_SOCKET_SG_FILTER which uses the existing socket filter infrastructure for bpf program attach and load. eBPF program of type BPF_PROG_TYPE_SOCKET_SG_FILTER receives struct scatterlist as bpf context contrast to BPF_PROG_TYPE_SOCKET_FILTER which deals with struct skb. This new eBPF program type allow socket filter to run on packet data that is in form form of struct scatterlist. Patch 2 adds functionality to run BPF_PROG_TYPE_SOCKET_SG_FILTER socket filter program. A bpf helpers bpf_sg_next() is also added so users can retrieve sg elements from scatterlist. Patch 3 adds socket filter eBPF sample program that uses patch 1 and patch 2. The sample program opens an rds socket, attach ebpf program (socksg i.e. BPF_PROG_TYPE_SOCKET_SG_FILTER) to rds socket and uses bpf_sg_next helper to look into sg. For a test, current ebpf program only prints first few bytes from each elements of sg list. Finally, patch 4 allows rds_recv_incoming to invoke socket filter program which deals with scatterlist.
It would be really helpful to have your thoughts/comments on my direction. I am planning to put together some complex example for filtering RDS traffic using eBPF, and so it would be good to have feedback before I go too far ahead. Thanks. -Tushar
Thanks. -Tushar Tushar Dave (4): eBPF: Add new eBPF prog type BPF_PROG_TYPE_SOCKET_SG_FILTER ebpf: Add sg_filter_run and sg helper ebpf: Add sample ebpf program for SOCKET_SG_FILTER rds: invoke socket sg filter attached to rds socket include/linux/bpf_types.h | 1 + include/linux/filter.h | 10 + include/uapi/linux/bpf.h | 17 +- kernel/bpf/syscall.c | 1 + kernel/bpf/verifier.c | 1 + net/core/filter.c | 149 ++++++++++++- net/rds/ib.c | 1 + net/rds/ib.h | 1 + net/rds/ib_recv.c | 12 ++ net/rds/rds.h | 2 + net/rds/recv.c | 16 ++ net/rds/tcp.c | 2 + net/rds/tcp.h | 2 + net/rds/tcp_recv.c | 38 ++++ samples/bpf/Makefile | 3 + samples/bpf/bpf_load.c | 11 +- samples/bpf/rds_filter_kern.c | 78 +++++++ samples/bpf/rds_filter_user.c | 339 ++++++++++++++++++++++++++++++ tools/bpf/bpftool/prog.c | 1 + tools/include/uapi/linux/bpf.h | 17 +- tools/lib/bpf/libbpf.c | 3 + tools/lib/bpf/libbpf.h | 2 + tools/testing/selftests/bpf/bpf_helpers.h | 3 + 23 files changed, 703 insertions(+), 7 deletions(-) create mode 100644 samples/bpf/rds_filter_kern.c create mode 100644 samples/bpf/rds_filter_user.c
