Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ce3206b authored by Daniel Borkmann's avatar Daniel Borkmann
Browse files

Merge branch 'bpf-ancestor-cgroup-id' 



Andrey Ignatov says:

====================
This patch set adds new BPF helper bpf_skb_ancestor_cgroup_id that returns
id of cgroup v2 that is ancestor of cgroup associated with the skb at the
ancestor_level.

The helper is useful to implement policies in TC based on cgroups that are
upper in hierarchy than immediate cgroup associated with skb.

v1->v2:
- more reliable check for testing IPv6 to become ready in selftest.
====================

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parents e8d2bec0 5ecd8c22

include/linux/cgroup.h

+30 −0
Original line number Diff line number Diff line
@@ -553,6 +553,36 @@ static inline bool cgroup_is_descendant(struct cgroup *cgrp, 
	return cgrp->ancestor_ids[ancestor->level] == ancestor->id;

}



/**

 * cgroup_ancestor - find ancestor of cgroup

 * @cgrp: cgroup to find ancestor of

 * @ancestor_level: level of ancestor to find starting from root

 *

 * Find ancestor of cgroup at specified level starting from root if it exists

 * and return pointer to it. Return NULL if @cgrp doesn't have ancestor at

 * @ancestor_level.

 *

 * This function is safe to call as long as @cgrp is accessible.

 */

static inline struct cgroup *cgroup_ancestor(struct cgroup *cgrp,

					     int ancestor_level)

{

	struct cgroup *ptr;



	if (cgrp->level < ancestor_level)

		return NULL;



	for (ptr = cgrp;

	     ptr && ptr->level > ancestor_level;

	     ptr = cgroup_parent(ptr))

		;



	if (ptr && ptr->level == ancestor_level)

		return ptr;



	return NULL;

}



/**

 * task_under_cgroup_hierarchy - test task's membership of cgroup ancestry

 * @task: the task to be tested

include/uapi/linux/bpf.h

+20 −1
Original line number Diff line number Diff line
@@ -2093,6 +2093,24 @@ union bpf_attr { 
 * 	Return

 * 		The id is returned or 0 in case the id could not be retrieved.

 *

 * u64 bpf_skb_ancestor_cgroup_id(struct sk_buff *skb, int ancestor_level)

 *	Description

 *		Return id of cgroup v2 that is ancestor of cgroup associated

 *		with the *skb* at the *ancestor_level*.  The root cgroup is at

 *		*ancestor_level* zero and each step down the hierarchy

 *		increments the level. If *ancestor_level* == level of cgroup

 *		associated with *skb*, then return value will be same as that

 *		of **bpf_skb_cgroup_id**\ ().

 *

 *		The helper is useful to implement policies based on cgroups

 *		that are upper in hierarchy than immediate cgroup associated

 *		with *skb*.

 *

 *		The format of returned id and helper limitations are same as in

 *		**bpf_skb_cgroup_id**\ ().

 *	Return

 *		The id is returned or 0 in case the id could not be retrieved.

 *

 * u64 bpf_get_current_cgroup_id(void)

 * 	Return

 * 		A 64-bit integer containing the current cgroup id based
@@ -2207,7 +2225,8 @@ union bpf_attr { 
	FN(skb_cgroup_id),		\

	FN(get_current_cgroup_id),	\

	FN(get_local_storage),		\

	FN(sk_select_reuseport),

	FN(sk_select_reuseport),	\

	FN(skb_ancestor_cgroup_id),



/* integer value in 'imm' field of BPF_CALL instruction selects which helper

 * function eBPF program intends to call

net/core/filter.c

+28 −0
Original line number Diff line number Diff line
@@ -3778,6 +3778,32 @@ static const struct bpf_func_proto bpf_skb_cgroup_id_proto = { 
	.ret_type       = RET_INTEGER,

	.arg1_type      = ARG_PTR_TO_CTX,

};



BPF_CALL_2(bpf_skb_ancestor_cgroup_id, const struct sk_buff *, skb, int,

	   ancestor_level)

{

	struct sock *sk = skb_to_full_sk(skb);

	struct cgroup *ancestor;

	struct cgroup *cgrp;



	if (!sk || !sk_fullsock(sk))

		return 0;



	cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);

	ancestor = cgroup_ancestor(cgrp, ancestor_level);

	if (!ancestor)

		return 0;



	return ancestor->kn->id.id;

}



static const struct bpf_func_proto bpf_skb_ancestor_cgroup_id_proto = {

	.func           = bpf_skb_ancestor_cgroup_id,

	.gpl_only       = false,

	.ret_type       = RET_INTEGER,

	.arg1_type      = ARG_PTR_TO_CTX,

	.arg2_type      = ARG_ANYTHING,

};

#endif



static unsigned long bpf_xdp_copy(void *dst_buff, const void *src_buff,
@@ -4966,6 +4992,8 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 
#ifdef CONFIG_SOCK_CGROUP_DATA

	case BPF_FUNC_skb_cgroup_id:

		return &bpf_skb_cgroup_id_proto;

	case BPF_FUNC_skb_ancestor_cgroup_id:

		return &bpf_skb_ancestor_cgroup_id_proto;

#endif

	default:

		return bpf_base_func_proto(func_id);

tools/include/uapi/linux/bpf.h

+20 −1
Original line number Diff line number Diff line
@@ -2093,6 +2093,24 @@ union bpf_attr { 
 * 	Return

 * 		The id is returned or 0 in case the id could not be retrieved.

 *

 * u64 bpf_skb_ancestor_cgroup_id(struct sk_buff *skb, int ancestor_level)

 *	Description

 *		Return id of cgroup v2 that is ancestor of cgroup associated

 *		with the *skb* at the *ancestor_level*.  The root cgroup is at

 *		*ancestor_level* zero and each step down the hierarchy

 *		increments the level. If *ancestor_level* == level of cgroup

 *		associated with *skb*, then return value will be same as that

 *		of **bpf_skb_cgroup_id**\ ().

 *

 *		The helper is useful to implement policies based on cgroups

 *		that are upper in hierarchy than immediate cgroup associated

 *		with *skb*.

 *

 *		The format of returned id and helper limitations are same as in

 *		**bpf_skb_cgroup_id**\ ().

 *	Return

 *		The id is returned or 0 in case the id could not be retrieved.

 *

 * u64 bpf_get_current_cgroup_id(void)

 * 	Return

 * 		A 64-bit integer containing the current cgroup id based
@@ -2207,7 +2225,8 @@ union bpf_attr { 
	FN(skb_cgroup_id),		\

	FN(get_current_cgroup_id),	\

	FN(get_local_storage),		\

	FN(sk_select_reuseport),

	FN(sk_select_reuseport),	\

	FN(skb_ancestor_cgroup_id),



/* integer value in 'imm' field of BPF_CALL instruction selects which helper

 * function eBPF program intends to call

tools/testing/selftests/bpf/Makefile

+6 −3
Original line number Diff line number Diff line
@@ -34,7 +34,8 @@ TEST_GEN_FILES = test_pkt_access.o test_xdp.o test_l4lb.o test_tcp_estats.o test 
	test_btf_haskv.o test_btf_nokv.o test_sockmap_kern.o test_tunnel_kern.o \

	test_get_stack_rawtp.o test_sockmap_kern.o test_sockhash_kern.o \

	test_lwt_seg6local.o sendmsg4_prog.o sendmsg6_prog.o test_lirc_mode2_kern.o \

	get_cgroup_id_kern.o socket_cookie_prog.o test_select_reuseport_kern.o

	get_cgroup_id_kern.o socket_cookie_prog.o test_select_reuseport_kern.o \

	test_skb_cgroup_id_kern.o



# Order correspond to 'make run_tests' order

TEST_PROGS := test_kmod.sh \
@@ -45,10 +46,11 @@ TEST_PROGS := test_kmod.sh \ 
	test_sock_addr.sh \

	test_tunnel.sh \

	test_lwt_seg6local.sh \

	test_lirc_mode2.sh

	test_lirc_mode2.sh \

	test_skb_cgroup_id.sh



# Compile but not part of 'make run_tests'

TEST_GEN_PROGS_EXTENDED = test_libbpf_open test_sock_addr

TEST_GEN_PROGS_EXTENDED = test_libbpf_open test_sock_addr test_skb_cgroup_id_user



include ../lib.mk
@@ -59,6 +61,7 @@ $(TEST_GEN_PROGS): $(BPFOBJ) 
$(TEST_GEN_PROGS_EXTENDED): $(OUTPUT)/libbpf.a



$(OUTPUT)/test_dev_cgroup: cgroup_helpers.c

$(OUTPUT)/test_skb_cgroup_id_user: cgroup_helpers.c

$(OUTPUT)/test_sock: cgroup_helpers.c

$(OUTPUT)/test_sock_addr: cgroup_helpers.c

$(OUTPUT)/test_socket_cookie: cgroup_helpers.c