[bpf-next,v2,1/2] bpf: add get_netns_cookie helper to tc programs

Commit Message

Mahe Tardy Oct. 2, 2024, 5:57 p.m. UTC

This is needed in the context of Cilium and Tetragon to retrieve netns
cookie from hostns when traffic leaves Pod, so that we can correlate
skb->sk's netns cookie.

Signed-off-by: Mahe Tardy <[e-mail]>
---
 net/core/filter.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

--
2.34.1

Comments

Daniel Borkmann Oct. 4, 2024, noon UTC | #1

On 10/2/24 7:57 PM, Mahe Tardy wrote:
> This is needed in the context of Cilium and Tetragon to retrieve netns
> cookie from hostns when traffic leaves Pod, so that we can correlate
> skb->sk's netns cookie.
> 
> Signed-off-by: Mahe Tardy <[e-mail]>
> ---
>   net/core/filter.c | 13 +++++++++++++
>   1 file changed, 13 insertions(+)
> 
> diff --git a/net/core/filter.c b/net/core/filter.c
> index cd3524cb326b..6e80991125ba 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -5138,6 +5138,17 @@ static u64 __bpf_get_netns_cookie(struct sock *sk)
>   	return net->net_cookie;
>   }
> 
> +BPF_CALL_1(bpf_get_netns_cookie, struct sk_buff *, skb)
> +{
> +	return __bpf_get_netns_cookie(skb->sk ? skb->sk : NULL);
> +}
> +
> +static const struct bpf_func_proto bpf_get_netns_cookie_proto = {
> +	.func           = bpf_get_netns_cookie,
> +	.ret_type       = RET_INTEGER,
> +	.arg1_type      = ARG_PTR_TO_CTX_OR_NULL,

This basically tells the verifier that NULL or context can be passed to the
helper. As-is above, the `skb->sk ?` will trigger a NULL pointer dereference.

If you look into other implementations, the above should rather look like:

   return __bpf_get_netns_cookie(skb && skb->sk ? skb->sk : NULL);

> +};
> +
>   BPF_CALL_1(bpf_get_netns_cookie_sock, struct sock *, ctx)
>   {
>   	return __bpf_get_netns_cookie(ctx);
> @@ -8209,6 +8220,8 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>   		return &bpf_skb_under_cgroup_proto;
>   	case BPF_FUNC_get_socket_cookie:
>   		return &bpf_get_socket_cookie_proto;
> +	case BPF_FUNC_get_netns_cookie:
> +		return &bpf_get_netns_cookie_proto;
>   	case BPF_FUNC_get_socket_uid:
>   		return &bpf_get_socket_uid_proto;
>   	case BPF_FUNC_fib_lookup:
> --
> 2.34.1
>

Patch

diff --git a/net/core/filter.c b/net/core/filter.c
index cd3524cb326b..6e80991125ba 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5138,6 +5138,17 @@  static u64 __bpf_get_netns_cookie(struct sock *sk)
 	return net->net_cookie;
 }

+BPF_CALL_1(bpf_get_netns_cookie, struct sk_buff *, skb)
+{
+	return __bpf_get_netns_cookie(skb->sk ? skb->sk : NULL);
+}
+
+static const struct bpf_func_proto bpf_get_netns_cookie_proto = {
+	.func           = bpf_get_netns_cookie,
+	.ret_type       = RET_INTEGER,
+	.arg1_type      = ARG_PTR_TO_CTX_OR_NULL,
+};
+
 BPF_CALL_1(bpf_get_netns_cookie_sock, struct sock *, ctx)
 {
 	return __bpf_get_netns_cookie(ctx);
@@ -8209,6 +8220,8 @@  tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 		return &bpf_skb_under_cgroup_proto;
 	case BPF_FUNC_get_socket_cookie:
 		return &bpf_get_socket_cookie_proto;
+	case BPF_FUNC_get_netns_cookie:
+		return &bpf_get_netns_cookie_proto;
 	case BPF_FUNC_get_socket_uid:
 		return &bpf_get_socket_uid_proto;
 	case BPF_FUNC_fib_lookup: