Commit b426ce83 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Alexei Starovoitov

bpf: Add classid helper only based on skb->sk

Similarly to 5a52ae4e ("bpf: Allow to retrieve cgroup v1 classid
from v2 hooks"), add a helper to retrieve cgroup v1 classid solely
based on the skb->sk, so it can be used as key as part of BPF map
lookups out of tc from host ns, in particular given the skb->sk is
retained these days when crossing net ns thanks to 9c4c3252
("skbuff: preserve sock reference when scrubbing the skb."). This
is similar to bpf_skb_cgroup_id() which implements the same for v2.
Kubernetes ecosystem is still operating on v1 however, hence net_cls
needs to be used there until this can be dropped in with the v2
helper of bpf_skb_cgroup_id().
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/ed633cf27a1c620e901c5aa99ebdefb028dce600.1601477936.git.daniel@iogearbox.net
parent 963ec27a
...@@ -3643,6 +3643,15 @@ union bpf_attr { ...@@ -3643,6 +3643,15 @@ union bpf_attr {
* *flags* are identical to those used for bpf_snprintf_btf. * *flags* are identical to those used for bpf_snprintf_btf.
* Return * Return
* 0 on success or a negative error in case of failure. * 0 on success or a negative error in case of failure.
*
* u64 bpf_skb_cgroup_classid(struct sk_buff *skb)
* Description
* See **bpf_get_cgroup_classid**\ () for the main description.
* This helper differs from **bpf_get_cgroup_classid**\ () in that
* the cgroup v1 net_cls class is retrieved only from the *skb*'s
* associated socket instead of the current process.
* Return
* The id is returned or 0 in case the id could not be retrieved.
*/ */
#define __BPF_FUNC_MAPPER(FN) \ #define __BPF_FUNC_MAPPER(FN) \
FN(unspec), \ FN(unspec), \
...@@ -3796,6 +3805,7 @@ union bpf_attr { ...@@ -3796,6 +3805,7 @@ union bpf_attr {
FN(copy_from_user), \ FN(copy_from_user), \
FN(snprintf_btf), \ FN(snprintf_btf), \
FN(seq_printf_btf), \ FN(seq_printf_btf), \
FN(skb_cgroup_classid), \
/* */ /* */
/* integer value in 'imm' field of BPF_CALL instruction selects which helper /* integer value in 'imm' field of BPF_CALL instruction selects which helper
......
...@@ -2707,6 +2707,23 @@ static const struct bpf_func_proto bpf_get_cgroup_classid_curr_proto = { ...@@ -2707,6 +2707,23 @@ static const struct bpf_func_proto bpf_get_cgroup_classid_curr_proto = {
.gpl_only = false, .gpl_only = false,
.ret_type = RET_INTEGER, .ret_type = RET_INTEGER,
}; };
BPF_CALL_1(bpf_skb_cgroup_classid, const struct sk_buff *, skb)
{
struct sock *sk = skb_to_full_sk(skb);
if (!sk || !sk_fullsock(sk))
return 0;
return sock_cgroup_classid(&sk->sk_cgrp_data);
}
static const struct bpf_func_proto bpf_skb_cgroup_classid_proto = {
.func = bpf_skb_cgroup_classid,
.gpl_only = false,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_CTX,
};
#endif #endif
BPF_CALL_1(bpf_get_cgroup_classid, const struct sk_buff *, skb) BPF_CALL_1(bpf_get_cgroup_classid, const struct sk_buff *, skb)
...@@ -6772,6 +6789,10 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) ...@@ -6772,6 +6789,10 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
case BPF_FUNC_skb_get_xfrm_state: case BPF_FUNC_skb_get_xfrm_state:
return &bpf_skb_get_xfrm_state_proto; return &bpf_skb_get_xfrm_state_proto;
#endif #endif
#ifdef CONFIG_CGROUP_NET_CLASSID
case BPF_FUNC_skb_cgroup_classid:
return &bpf_skb_cgroup_classid_proto;
#endif
#ifdef CONFIG_SOCK_CGROUP_DATA #ifdef CONFIG_SOCK_CGROUP_DATA
case BPF_FUNC_skb_cgroup_id: case BPF_FUNC_skb_cgroup_id:
return &bpf_skb_cgroup_id_proto; return &bpf_skb_cgroup_id_proto;
......
...@@ -3643,6 +3643,15 @@ union bpf_attr { ...@@ -3643,6 +3643,15 @@ union bpf_attr {
* *flags* are identical to those used for bpf_snprintf_btf. * *flags* are identical to those used for bpf_snprintf_btf.
* Return * Return
* 0 on success or a negative error in case of failure. * 0 on success or a negative error in case of failure.
*
* u64 bpf_skb_cgroup_classid(struct sk_buff *skb)
* Description
* See **bpf_get_cgroup_classid**\ () for the main description.
* This helper differs from **bpf_get_cgroup_classid**\ () in that
* the cgroup v1 net_cls class is retrieved only from the *skb*'s
* associated socket instead of the current process.
* Return
* The id is returned or 0 in case the id could not be retrieved.
*/ */
#define __BPF_FUNC_MAPPER(FN) \ #define __BPF_FUNC_MAPPER(FN) \
FN(unspec), \ FN(unspec), \
...@@ -3796,6 +3805,7 @@ union bpf_attr { ...@@ -3796,6 +3805,7 @@ union bpf_attr {
FN(copy_from_user), \ FN(copy_from_user), \
FN(snprintf_btf), \ FN(snprintf_btf), \
FN(seq_printf_btf), \ FN(seq_printf_btf), \
FN(skb_cgroup_classid), \
/* */ /* */
/* integer value in 'imm' field of BPF_CALL instruction selects which helper /* integer value in 'imm' field of BPF_CALL instruction selects which helper
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment