Commit 1ef09e12 authored by Martin KaFai Lau's avatar Martin KaFai Lau
Browse files

Merge branch 'bpf: Fix src IP addr related limitation in bpf_*_fib_lookup()' 



Martynas Pumputis says:

====================
The patchset fixes the limitation of bpf_*_fib_lookup() helper, which
prevents it from being used in BPF dataplanes with network interfaces
which have more than one IP addr. See the first patch for more details.
Thanks!

* v2->v3: Address Martin KaFai Lau's feedback
* v1->v2: Use IPv6 stubs to fix compilation when CONFIG_IPV6=m.
====================

Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
parents 1be84ca5 b0f7a8ca

include/net/ipv6_stubs.h

+5 −0
Original line number Diff line number Diff line
@@ -85,6 +85,11 @@ struct ipv6_bpf_stub { 
			       sockptr_t optval, unsigned int optlen);

	int (*ipv6_getsockopt)(struct sock *sk, int level, int optname,

			       sockptr_t optval, sockptr_t optlen);

	int (*ipv6_dev_get_saddr)(struct net *net,

				  const struct net_device *dst_dev,

				  const struct in6_addr *daddr,

				  unsigned int prefs,

				  struct in6_addr *saddr);

};

extern const struct ipv6_bpf_stub *ipv6_bpf_stub __read_mostly;

include/uapi/linux/bpf.h

+10 −0
Original line number Diff line number Diff line
@@ -3264,6 +3264,11 @@ union bpf_attr { 
 *			and *params*->smac will not be set as output. A common

 *			use case is to call **bpf_redirect_neigh**\ () after

 *			doing **bpf_fib_lookup**\ ().

 *		**BPF_FIB_LOOKUP_SRC**

 *			Derive and set source IP addr in *params*->ipv{4,6}_src

 *			for the nexthop. If the src addr cannot be derived,

 *			**BPF_FIB_LKUP_RET_NO_SRC_ADDR** is returned. In this

 *			case, *params*->dmac and *params*->smac are not set either.

 *

 *		*ctx* is either **struct xdp_md** for XDP programs or

 *		**struct sk_buff** tc cls_act programs.
@@ -6964,6 +6969,7 @@ enum { 
	BPF_FIB_LOOKUP_OUTPUT  = (1U << 1),

	BPF_FIB_LOOKUP_SKIP_NEIGH = (1U << 2),

	BPF_FIB_LOOKUP_TBID    = (1U << 3),

	BPF_FIB_LOOKUP_SRC     = (1U << 4),

};



enum {
@@ -6976,6 +6982,7 @@ enum { 
	BPF_FIB_LKUP_RET_UNSUPP_LWT,   /* fwd requires encapsulation */

	BPF_FIB_LKUP_RET_NO_NEIGH,     /* no neighbor entry for nh */

	BPF_FIB_LKUP_RET_FRAG_NEEDED,  /* fragmentation required to fwd */

	BPF_FIB_LKUP_RET_NO_SRC_ADDR,  /* failed to derive IP src addr */

};



struct bpf_fib_lookup {
@@ -7010,6 +7017,9 @@ struct bpf_fib_lookup { 
		__u32	rt_metric;

	};



	/* input: source address to consider for lookup

	 * output: source address result from lookup

	 */

	union {

		__be32		ipv4_src;

		__u32		ipv6_src[4];  /* in6_addr; network order */

net/core/filter.c

+17 −1
Original line number Diff line number Diff line
@@ -5850,6 +5850,9 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params, 
	params->rt_metric = res.fi->fib_priority;

	params->ifindex = dev->ifindex;



	if (flags & BPF_FIB_LOOKUP_SRC)

		params->ipv4_src = fib_result_prefsrc(net, &res);



	/* xdp and cls_bpf programs are run in RCU-bh so

	 * rcu_read_lock_bh is not needed here

	 */
@@ -5992,6 +5995,18 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params, 
	params->rt_metric = res.f6i->fib6_metric;

	params->ifindex = dev->ifindex;



	if (flags & BPF_FIB_LOOKUP_SRC) {

		if (res.f6i->fib6_prefsrc.plen) {

			*src = res.f6i->fib6_prefsrc.addr;

		} else {

			err = ipv6_bpf_stub->ipv6_dev_get_saddr(net, dev,

								&fl6.daddr, 0,

								src);

			if (err)

				return BPF_FIB_LKUP_RET_NO_SRC_ADDR;

		}

	}



	if (flags & BPF_FIB_LOOKUP_SKIP_NEIGH)

		goto set_fwd_params;
@@ -6010,7 +6025,8 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params, 
#endif



#define BPF_FIB_LOOKUP_MASK (BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_OUTPUT | \

			     BPF_FIB_LOOKUP_SKIP_NEIGH | BPF_FIB_LOOKUP_TBID)

			     BPF_FIB_LOOKUP_SKIP_NEIGH | BPF_FIB_LOOKUP_TBID | \

			     BPF_FIB_LOOKUP_SRC)



BPF_CALL_4(bpf_xdp_fib_lookup, struct xdp_buff *, ctx,

	   struct bpf_fib_lookup *, params, int, plen, u32, flags)

net/ipv6/af_inet6.c

+1 −0
Original line number Diff line number Diff line
@@ -1061,6 +1061,7 @@ static const struct ipv6_bpf_stub ipv6_bpf_stub_impl = { 
	.udp6_lib_lookup = __udp6_lib_lookup,

	.ipv6_setsockopt = do_ipv6_setsockopt,

	.ipv6_getsockopt = do_ipv6_getsockopt,

	.ipv6_dev_get_saddr = ipv6_dev_get_saddr,

};



static int __init inet6_init(void)

tools/include/uapi/linux/bpf.h

+10 −0
Original line number Diff line number Diff line
@@ -3264,6 +3264,11 @@ union bpf_attr { 
 *			and *params*->smac will not be set as output. A common

 *			use case is to call **bpf_redirect_neigh**\ () after

 *			doing **bpf_fib_lookup**\ ().

 *		**BPF_FIB_LOOKUP_SRC**

 *			Derive and set source IP addr in *params*->ipv{4,6}_src

 *			for the nexthop. If the src addr cannot be derived,

 *			**BPF_FIB_LKUP_RET_NO_SRC_ADDR** is returned. In this

 *			case, *params*->dmac and *params*->smac are not set either.

 *

 *		*ctx* is either **struct xdp_md** for XDP programs or

 *		**struct sk_buff** tc cls_act programs.
@@ -6964,6 +6969,7 @@ enum { 
	BPF_FIB_LOOKUP_OUTPUT  = (1U << 1),

	BPF_FIB_LOOKUP_SKIP_NEIGH = (1U << 2),

	BPF_FIB_LOOKUP_TBID    = (1U << 3),

	BPF_FIB_LOOKUP_SRC     = (1U << 4),

};



enum {
@@ -6976,6 +6982,7 @@ enum { 
	BPF_FIB_LKUP_RET_UNSUPP_LWT,   /* fwd requires encapsulation */

	BPF_FIB_LKUP_RET_NO_NEIGH,     /* no neighbor entry for nh */

	BPF_FIB_LKUP_RET_FRAG_NEEDED,  /* fragmentation required to fwd */

	BPF_FIB_LKUP_RET_NO_SRC_ADDR,  /* failed to derive IP src addr */

};



struct bpf_fib_lookup {
@@ -7010,6 +7017,9 @@ struct bpf_fib_lookup { 
		__u32	rt_metric;

	};



	/* input: source address to consider for lookup

	 * output: source address result from lookup

	 */

	union {

		__be32		ipv4_src;

		__u32		ipv6_src[4];  /* in6_addr; network order */