Skip to content

Commit f307fa2

Browse files
rdnaAlexei Starovoitov
rdna
authored and
Alexei Starovoitov
committed
bpf: Introduce bpf_sk_{, ancestor_}cgroup_id helpers
With having ability to lookup sockets in cgroup skb programs it becomes useful to access cgroup id of retrieved sockets so that policies can be implemented based on origin cgroup of such socket. For example, a container running in a cgroup can have cgroup skb ingress program that can lookup peer socket that is sending packets to a process inside the container and decide whether those packets should be allowed or denied based on cgroup id of the peer. More specifically such ingress program can implement intra-host policy "allow incoming packets only from this same container and not from any other container on same host" w/o relying on source IP addresses since quite often it can be the case that containers share same IP address on the host. Introduce two new helpers for this use-case: bpf_sk_cgroup_id() and bpf_sk_ancestor_cgroup_id(). These helpers are similar to existing bpf_skb_{,ancestor_}cgroup_id helpers with the only difference that sk is used to get cgroup id instead of skb, and share code with them. See documentation in UAPI for more details. Signed-off-by: Andrey Ignatov <rdna@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/f5884981249ce911f63e9b57ecd5d7d19154ff39.1589486450.git.rdna@fb.com
1 parent 06d3e4c commit f307fa2

3 files changed

Lines changed: 121 additions & 11 deletions

File tree

‎include/uapi/linux/bpf.h‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3121,6 +3121,38 @@ union bpf_attr {
31213121
* 0 on success, or a negative error in case of failure:
31223122
*
31233123
* **-EOVERFLOW** if an overflow happened: The same object will be tried again.
3124+
*
3125+
* u64 bpf_sk_cgroup_id(struct bpf_sock *sk)
3126+
* Description
3127+
* Return the cgroup v2 id of the socket *sk*.
3128+
*
3129+
* *sk* must be a non-**NULL** pointer to a full socket, e.g. one
3130+
* returned from **bpf_sk_lookup_xxx**\ (),
3131+
* **bpf_sk_fullsock**\ (), etc. The format of returned id is
3132+
* same as in **bpf_skb_cgroup_id**\ ().
3133+
*
3134+
* This helper is available only if the kernel was compiled with
3135+
* the **CONFIG_SOCK_CGROUP_DATA** configuration option.
3136+
* Return
3137+
* The id is returned or 0 in case the id could not be retrieved.
3138+
*
3139+
* u64 bpf_sk_ancestor_cgroup_id(struct bpf_sock *sk, int ancestor_level)
3140+
* Description
3141+
* Return id of cgroup v2 that is ancestor of cgroup associated
3142+
* with the *sk* at the *ancestor_level*. The root cgroup is at
3143+
* *ancestor_level* zero and each step down the hierarchy
3144+
* increments the level. If *ancestor_level* == level of cgroup
3145+
* associated with *sk*, then return value will be same as that
3146+
* of **bpf_sk_cgroup_id**\ ().
3147+
*
3148+
* The helper is useful to implement policies based on cgroups
3149+
* that are upper in hierarchy than immediate cgroup associated
3150+
* with *sk*.
3151+
*
3152+
* The format of returned id and helper limitations are same as in
3153+
* **bpf_sk_cgroup_id**\ ().
3154+
* Return
3155+
* The id is returned or 0 in case the id could not be retrieved.
31243156
*/
31253157
#define __BPF_FUNC_MAPPER(FN) \
31263158
FN(unspec), \
@@ -3250,7 +3282,9 @@ union bpf_attr {
32503282
FN(sk_assign), \
32513283
FN(ktime_get_boot_ns), \
32523284
FN(seq_printf), \
3253-
FN(seq_write),
3285+
FN(seq_write), \
3286+
FN(sk_cgroup_id), \
3287+
FN(sk_ancestor_cgroup_id),
32543288

32553289
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
32563290
* function eBPF program intends to call

‎net/core/filter.c‎

Lines changed: 51 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4003,16 +4003,22 @@ static const struct bpf_func_proto bpf_skb_under_cgroup_proto = {
40034003
};
40044004

40054005
#ifdef CONFIG_SOCK_CGROUP_DATA
4006+
static inline u64 __bpf_sk_cgroup_id(struct sock *sk)
4007+
{
4008+
struct cgroup *cgrp;
4009+
4010+
cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
4011+
return cgroup_id(cgrp);
4012+
}
4013+
40064014
BPF_CALL_1(bpf_skb_cgroup_id, const struct sk_buff *, skb)
40074015
{
40084016
struct sock *sk = skb_to_full_sk(skb);
4009-
struct cgroup *cgrp;
40104017

40114018
if (!sk || !sk_fullsock(sk))
40124019
return 0;
40134020

4014-
cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
4015-
return cgroup_id(cgrp);
4021+
return __bpf_sk_cgroup_id(sk);
40164022
}
40174023

40184024
static const struct bpf_func_proto bpf_skb_cgroup_id_proto = {
@@ -4022,16 +4028,12 @@ static const struct bpf_func_proto bpf_skb_cgroup_id_proto = {
40224028
.arg1_type = ARG_PTR_TO_CTX,
40234029
};
40244030

4025-
BPF_CALL_2(bpf_skb_ancestor_cgroup_id, const struct sk_buff *, skb, int,
4026-
ancestor_level)
4031+
static inline u64 __bpf_sk_ancestor_cgroup_id(struct sock *sk,
4032+
int ancestor_level)
40274033
{
4028-
struct sock *sk = skb_to_full_sk(skb);
40294034
struct cgroup *ancestor;
40304035
struct cgroup *cgrp;
40314036

4032-
if (!sk || !sk_fullsock(sk))
4033-
return 0;
4034-
40354037
cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
40364038
ancestor = cgroup_ancestor(cgrp, ancestor_level);
40374039
if (!ancestor)
@@ -4040,13 +4042,49 @@ BPF_CALL_2(bpf_skb_ancestor_cgroup_id, const struct sk_buff *, skb, int,
40404042
return cgroup_id(ancestor);
40414043
}
40424044

4045+
BPF_CALL_2(bpf_skb_ancestor_cgroup_id, const struct sk_buff *, skb, int,
4046+
ancestor_level)
4047+
{
4048+
struct sock *sk = skb_to_full_sk(skb);
4049+
4050+
if (!sk || !sk_fullsock(sk))
4051+
return 0;
4052+
4053+
return __bpf_sk_ancestor_cgroup_id(sk, ancestor_level);
4054+
}
4055+
40434056
static const struct bpf_func_proto bpf_skb_ancestor_cgroup_id_proto = {
40444057
.func = bpf_skb_ancestor_cgroup_id,
40454058
.gpl_only = false,
40464059
.ret_type = RET_INTEGER,
40474060
.arg1_type = ARG_PTR_TO_CTX,
40484061
.arg2_type = ARG_ANYTHING,
40494062
};
4063+
4064+
BPF_CALL_1(bpf_sk_cgroup_id, struct sock *, sk)
4065+
{
4066+
return __bpf_sk_cgroup_id(sk);
4067+
}
4068+
4069+
static const struct bpf_func_proto bpf_sk_cgroup_id_proto = {
4070+
.func = bpf_sk_cgroup_id,
4071+
.gpl_only = false,
4072+
.ret_type = RET_INTEGER,
4073+
.arg1_type = ARG_PTR_TO_SOCKET,
4074+
};
4075+
4076+
BPF_CALL_2(bpf_sk_ancestor_cgroup_id, struct sock *, sk, int, ancestor_level)
4077+
{
4078+
return __bpf_sk_ancestor_cgroup_id(sk, ancestor_level);
4079+
}
4080+
4081+
static const struct bpf_func_proto bpf_sk_ancestor_cgroup_id_proto = {
4082+
.func = bpf_sk_ancestor_cgroup_id,
4083+
.gpl_only = false,
4084+
.ret_type = RET_INTEGER,
4085+
.arg1_type = ARG_PTR_TO_SOCKET,
4086+
.arg2_type = ARG_ANYTHING,
4087+
};
40504088
#endif
40514089

40524090
static unsigned long bpf_xdp_copy(void *dst_buff, const void *src_buff,
@@ -6159,6 +6197,10 @@ cg_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
61596197
return &bpf_skb_cgroup_id_proto;
61606198
case BPF_FUNC_skb_ancestor_cgroup_id:
61616199
return &bpf_skb_ancestor_cgroup_id_proto;
6200+
case BPF_FUNC_sk_cgroup_id:
6201+
return &bpf_sk_cgroup_id_proto;
6202+
case BPF_FUNC_sk_ancestor_cgroup_id:
6203+
return &bpf_sk_ancestor_cgroup_id_proto;
61626204
#endif
61636205
#ifdef CONFIG_INET
61646206
case BPF_FUNC_sk_lookup_tcp:

‎tools/include/uapi/linux/bpf.h‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3121,6 +3121,38 @@ union bpf_attr {
31213121
* 0 on success, or a negative error in case of failure:
31223122
*
31233123
* **-EOVERFLOW** if an overflow happened: The same object will be tried again.
3124+
*
3125+
* u64 bpf_sk_cgroup_id(struct bpf_sock *sk)
3126+
* Description
3127+
* Return the cgroup v2 id of the socket *sk*.
3128+
*
3129+
* *sk* must be a non-**NULL** pointer to a full socket, e.g. one
3130+
* returned from **bpf_sk_lookup_xxx**\ (),
3131+
* **bpf_sk_fullsock**\ (), etc. The format of returned id is
3132+
* same as in **bpf_skb_cgroup_id**\ ().
3133+
*
3134+
* This helper is available only if the kernel was compiled with
3135+
* the **CONFIG_SOCK_CGROUP_DATA** configuration option.
3136+
* Return
3137+
* The id is returned or 0 in case the id could not be retrieved.
3138+
*
3139+
* u64 bpf_sk_ancestor_cgroup_id(struct bpf_sock *sk, int ancestor_level)
3140+
* Description
3141+
* Return id of cgroup v2 that is ancestor of cgroup associated
3142+
* with the *sk* at the *ancestor_level*. The root cgroup is at
3143+
* *ancestor_level* zero and each step down the hierarchy
3144+
* increments the level. If *ancestor_level* == level of cgroup
3145+
* associated with *sk*, then return value will be same as that
3146+
* of **bpf_sk_cgroup_id**\ ().
3147+
*
3148+
* The helper is useful to implement policies based on cgroups
3149+
* that are upper in hierarchy than immediate cgroup associated
3150+
* with *sk*.
3151+
*
3152+
* The format of returned id and helper limitations are same as in
3153+
* **bpf_sk_cgroup_id**\ ().
3154+
* Return
3155+
* The id is returned or 0 in case the id could not be retrieved.
31243156
*/
31253157
#define __BPF_FUNC_MAPPER(FN) \
31263158
FN(unspec), \
@@ -3250,7 +3282,9 @@ union bpf_attr {
32503282
FN(sk_assign), \
32513283
FN(ktime_get_boot_ns), \
32523284
FN(seq_printf), \
3253-
FN(seq_write),
3285+
FN(seq_write), \
3286+
FN(sk_cgroup_id), \
3287+
FN(sk_ancestor_cgroup_id),
32543288

32553289
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
32563290
* function eBPF program intends to call

0 commit comments

Comments
 (0)