Add support for TPROXY via a new bpf helper, bpf_sk_assign(). This helper requires the BPF program to discover the socket via a call to bpf_sk*_lookup_*(), then pass this socket to the new helper. The helper takes its own reference to the socket in addition to any existing reference that may or may not currently be obtained for the duration of BPF processing. For the destination socket to receive the traffic, the traffic must be routed towards that socket via local route. The simplest example route is below, but in practice you may want to route traffic more narrowly (eg by CIDR): $ ip route add local default dev lo This patch avoids trying to introduce an extra bit into the skb->sk, as that would require more invasive changes to all code interacting with the socket to ensure that the bit is handled correctly, such as all error-handling cases along the path from the helper in BPF through to the orphan path in the input. Instead, we opt to use the destructor variable to switch on the prefetch of the socket.
Showing the changes to include/uapi/linux (1 of 8 files). Show all
Unified · Split
| @@ -2983,6 +2983,28 @@ union bpf_attr { · 2982 unmodified lines | |||
| 2983 | * **bpf_get_current_cgroup_id**\ (). | 2983 | * **bpf_get_current_cgroup_id**\ (). |
| 2984 | * Return | 2984 | * Return |
| 2985 | * The id is returned or 0 in case the id could not be retrieved. | 2985 | * The id is returned or 0 in case the id could not be retrieved. |
| 2986 | * | ||
| 2987 | * int bpf_sk_assign(struct sk_buff *skb, struct bpf_sock *sk, u64 flags) | ||
| 2988 | * Description | ||
| 2989 | * Assign the *sk* to the *skb*. When combined with appropriate | ||
| 2990 | * routing configuration to receive the packet towards the socket, | ||
| 2991 | * will cause *skb* to be delivered to the specified socket. | ||
| 2992 | * Subsequent redirection of *skb* via **bpf_redirect**\ (), | ||
| 2993 | * **bpf_clone_redirect**\ () or other methods outside of BPF may | ||
| 2994 | * interfere with successful delivery to the socket. | ||
| 2995 | * | ||
| 2996 | * This operation is only valid from TC ingress path. | ||
| 2997 | * | ||
| 2998 | * The *flags* argument must be zero. | ||
| 2999 | * Return | ||
| 3000 | * 0 on success, or a negative errno in case of failure. | ||
| 3001 | * | ||
| 3002 | * * **-EINVAL** Unsupported flags specified. | ||
| 3003 | * * **-ENOENT** Socket is unavailable for assignment. | ||
| 3004 | * * **-ENETUNREACH** Socket is unreachable (wrong netns). | ||
| 3005 | * * **-EOPNOTSUPP** Unsupported operation, for example a | ||
| 3006 | * call from outside of TC ingress. | ||
| 3007 | * * **-ESOCKTNOSUPPORT** Socket type not supported (reuseport). | ||
| 2986 | */ | 3008 | */ |
| 2987 | #define __BPF_FUNC_MAPPER(FN) \ | 3009 | #define __BPF_FUNC_MAPPER(FN) \ |
| 2988 | FN(unspec), \ | 3010 | FN(unspec), \ |
| @@ -3108,7 +3130,8 @@ union bpf_attr { · 119 unmodified lines | |||
| 3108 | FN(get_ns_current_pid_tgid), \ | 3130 | FN(get_ns_current_pid_tgid), \ |
| 3109 | FN(xdp_output), \ | 3131 | FN(xdp_output), \ |
| 3110 | FN(get_netns_cookie), \ | 3132 | FN(get_netns_cookie), \ |
| 3111 | FN(get_current_ancestor_cgroup_id), | 3133 | FN(get_current_ancestor_cgroup_id), \ |
| 3134 | FN(sk_assign), | ||
| 3112 | 3135 | ||
| 3113 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper | 3136 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper |
| 3114 | * function eBPF program intends to call | 3137 | * function eBPF program intends to call |