Commit b426ce83 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Alexei Starovoitov
Browse files

bpf: Add classid helper only based on skb->sk 



Similarly to 5a52ae4e ("bpf: Allow to retrieve cgroup v1 classid
from v2 hooks"), add a helper to retrieve cgroup v1 classid solely
based on the skb->sk, so it can be used as key as part of BPF map
lookups out of tc from host ns, in particular given the skb->sk is
retained these days when crossing net ns thanks to 9c4c3252
("skbuff: preserve sock reference when scrubbing the skb."). This
is similar to bpf_skb_cgroup_id() which implements the same for v2.
Kubernetes ecosystem is still operating on v1 however, hence net_cls
needs to be used there until this can be dropped in with the v2
helper of bpf_skb_cgroup_id().

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/ed633cf27a1c620e901c5aa99ebdefb028dce600.1601477936.git.daniel@iogearbox.net
parent 963ec27a

include/uapi/linux/bpf.h

+10 −0
Original line number Diff line number Diff line
@@ -3643,6 +3643,15 @@ union bpf_attr { 
 *		*flags* are identical to those used for bpf_snprintf_btf.

 *	Return

 *		0 on success or a negative error in case of failure.

 *

 * u64 bpf_skb_cgroup_classid(struct sk_buff *skb)

 * 	Description

 * 		See **bpf_get_cgroup_classid**\ () for the main description.

 * 		This helper differs from **bpf_get_cgroup_classid**\ () in that

 * 		the cgroup v1 net_cls class is retrieved only from the *skb*'s

 * 		associated socket instead of the current process.

 * 	Return

 * 		The id is returned or 0 in case the id could not be retrieved.

 */

#define __BPF_FUNC_MAPPER(FN)		\

	FN(unspec),			\
@@ -3796,6 +3805,7 @@ union bpf_attr { 
	FN(copy_from_user),		\

	FN(snprintf_btf),		\

	FN(seq_printf_btf),		\

	FN(skb_cgroup_classid),		\

	/* */



/* integer value in 'imm' field of BPF_CALL instruction selects which helper

net/core/filter.c

+21 −0
Original line number Diff line number Diff line
@@ -2707,6 +2707,23 @@ static const struct bpf_func_proto bpf_get_cgroup_classid_curr_proto = { 
	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

};



BPF_CALL_1(bpf_skb_cgroup_classid, const struct sk_buff *, skb)

{

	struct sock *sk = skb_to_full_sk(skb);



	if (!sk || !sk_fullsock(sk))

		return 0;



	return sock_cgroup_classid(&sk->sk_cgrp_data);

}



static const struct bpf_func_proto bpf_skb_cgroup_classid_proto = {

	.func		= bpf_skb_cgroup_classid,

	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_PTR_TO_CTX,

};

#endif



BPF_CALL_1(bpf_get_cgroup_classid, const struct sk_buff *, skb)
@@ -6772,6 +6789,10 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 
	case BPF_FUNC_skb_get_xfrm_state:

		return &bpf_skb_get_xfrm_state_proto;

#endif

#ifdef CONFIG_CGROUP_NET_CLASSID

	case BPF_FUNC_skb_cgroup_classid:

		return &bpf_skb_cgroup_classid_proto;

#endif

#ifdef CONFIG_SOCK_CGROUP_DATA

	case BPF_FUNC_skb_cgroup_id:

		return &bpf_skb_cgroup_id_proto;

tools/include/uapi/linux/bpf.h

+10 −0
Original line number Diff line number Diff line
@@ -3643,6 +3643,15 @@ union bpf_attr { 
 *		*flags* are identical to those used for bpf_snprintf_btf.

 *	Return

 *		0 on success or a negative error in case of failure.

 *

 * u64 bpf_skb_cgroup_classid(struct sk_buff *skb)

 * 	Description

 * 		See **bpf_get_cgroup_classid**\ () for the main description.

 * 		This helper differs from **bpf_get_cgroup_classid**\ () in that

 * 		the cgroup v1 net_cls class is retrieved only from the *skb*'s

 * 		associated socket instead of the current process.

 * 	Return

 * 		The id is returned or 0 in case the id could not be retrieved.

 */

#define __BPF_FUNC_MAPPER(FN)		\

	FN(unspec),			\
@@ -3796,6 +3805,7 @@ union bpf_attr { 
	FN(copy_from_user),		\

	FN(snprintf_btf),		\

	FN(seq_printf_btf),		\

	FN(skb_cgroup_classid),		\

	/* */



/* integer value in 'imm' field of BPF_CALL instruction selects which helper

CRA Git | Maintained and supported by SUSTech CRA and CCSE