| Message ID | 20230624014600.576756-1-kuifeng@meta.com |
|---|---|
| Headers | show |
| Series | Fix missing synack in BPF cgroup_skb filters | expand |
Hello: This series was applied to bpf/bpf-next.git (master) by Daniel Borkmann <daniel@iogearbox.net>: On Fri, 23 Jun 2023 18:45:58 -0700 you wrote: > TCP SYN/ACK packets of connections from processes/sockets outside a > cgroup on the same host are not received by the cgroup's installed > cgroup_skb filters. > > There were two BPF cgroup_skb programs attached to a cgroup named > "my_cgroup". > > [...] Here is the summary with links: - [bpf-next,v4,1/2] net: bpf: Check SKB ownership against full socket. https://git.kernel.org/bpf/bpf-next/c/223f5f79f2ce - [bpf-next,v4,2/2] selftests/bpf: Verify that the cgroup_skb filters receive expected packets. https://git.kernel.org/bpf/bpf-next/c/539c7e67aa4a You are awesome, thank you!
TCP SYN/ACK packets of connections from processes/sockets outside a cgroup on the same host are not received by the cgroup's installed cgroup_skb filters. There were two BPF cgroup_skb programs attached to a cgroup named "my_cgroup". SEC("cgroup_skb/ingress") int ingress(struct __sk_buff *skb) { /* .... process skb ... */ return 1; } SEC("cgroup_skb/egress") int egress(struct __sk_buff *skb) { /* .... process skb ... */ return 1; } We discovered that when running the command "nc -6 -l 8000" in "my_group" and connecting to it from outside of "my_cgroup" with the command "nc -6 localhost 8000", the egress filter did not detect the SYN/ACK packet. However, we did observe the SYN/ACK packet at the ingress when connecting from a socket in "my_cgroup" to a socket outside of it. We came across BPF_CGROUP_RUN_PROG_INET_EGRESS(). This macro is responsible for calling BPF programs that are attached to the egress hook of a cgroup and it skips programs if the sending socket is not the owner of the skb. Specifically, in our situation, the SYN/ACK skb is owned by a struct request_sock instance, but the sending socket is the listener socket we use to receive incoming connections. The request_sock is created to manage an incoming connection. It has been determined that checking the owner of a skb against the sending socket is not required. Removing this check will allow the filters to receive SYN/ACK packets. To ensure that cgroup_skb filters can receive all signaling packets, including SYN, SYN/ACK, ACK, FIN, and FIN/ACK. A new self-test has been added as well. Changes from v3: - Check SKB ownership against full socket instead of just remove the check. - Address the issue raised by Yonghong. - Put more details down in the commit message. Changes from v2: - Remove redundant blank lines. Changes from v1: - Check the number of observed packets instead of just sleeping. - Use ASSERT_XXX() instead of CHECK()/ [v1] https://lore.kernel.org/all/20230612191641.441774-1-kuifeng@meta.com/ [v2] https://lore.kernel.org/all/20230617052756.640916-2-kuifeng@meta.com/ [v3] https://lore.kernel.org/all/20230620171409.166001-1-kuifeng@meta.com/ Kui-Feng Lee (2): net: bpf: Check SKB ownership against full socket. selftests/bpf: Verify that the cgroup_skb filters receive expected packets. include/linux/bpf-cgroup.h | 4 +- tools/testing/selftests/bpf/cgroup_helpers.c | 12 + tools/testing/selftests/bpf/cgroup_helpers.h | 1 + tools/testing/selftests/bpf/cgroup_tcp_skb.h | 35 ++ .../selftests/bpf/prog_tests/cgroup_tcp_skb.c | 402 ++++++++++++++++++ .../selftests/bpf/progs/cgroup_tcp_skb.c | 382 +++++++++++++++++ 6 files changed, 834 insertions(+), 2 deletions(-) create mode 100644 tools/testing/selftests/bpf/cgroup_tcp_skb.h create mode 100644 tools/testing/selftests/bpf/prog_tests/cgroup_tcp_skb.c create mode 100644 tools/testing/selftests/bpf/progs/cgroup_tcp_skb.c