[SRU][F:linux-bluefield][PATCH 21/21] UBUNTU: SAUCE: bpf: Add a helper to issue timestamp cookies in XDP
Bodong Wang
bodong at nvidia.com
Mon Jul 5 15:39:59 UTC 2021
From: Maxim Mikityanskiy <maximmi at nvidia.com>
BugLink: https://bugs.launchpad.net/bugs/1934499
The new helper bpf_tcp_raw_gen_tscookie allows an XDP program to
generate timestamp cookies (to be used together with SYN cookies) which
encode different options set by the client in the SYN packet: SACK
support, ECN support, window scale. These options are encoded in lower
bits of the timestamp, which will be returned by the client in a
subsequent ACK packet. The format is the same used by synproxy.
Signed-off-by: Maxim Mikityanskiy <maximmi at nvidia.com>
Reviewed-by: Tariq Toukan <tariqt at nvidia.com>
Signed-off-by: Bodong Wang <bodong at nvidia.com>
---
include/net/tcp.h | 1 +
include/uapi/linux/bpf.h | 25 +++++++++++++
net/core/filter.c | 38 ++++++++++++++++++++
net/ipv4/syncookies.c | 60 +++++++++++++++++++++++++++++++
tools/include/uapi/linux/bpf.h | 25 +++++++++++++
tools/testing/selftests/bpf/bpf_helpers.h | 3 ++
6 files changed, 152 insertions(+)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 2f2c7aa..009039f 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -550,6 +550,7 @@ u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
u16 *mssp);
__u32 cookie_v4_init_sequence(const struct sk_buff *skb, __u16 *mss);
u64 cookie_init_timestamp(struct request_sock *req);
+bool cookie_init_timestamp_raw(struct tcphdr *th, __be32 *tsval, __be32 *tsecr);
bool cookie_timestamp_decode(const struct net *net,
struct tcp_options_received *opt);
bool cookie_ecn_ok(const struct tcp_options_received *opt,
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index e3c55b7..dc9a575 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2818,6 +2818,30 @@ struct bpf_stack_build_id {
* **-EOPNOTSUPP** kernel configuration does not enable SYN cookies
*
* **-EPROTONOSUPPORT** IP packet version is not 4 or 6
+ *
+ * int bpf_tcp_raw_gen_tscookie(struct tcphdr *th, u32 th_len, __be32 *tsopt, u32 tsopt_len)
+ * Description
+ * Try to generate a timestamp cookie which encodes some of the
+ * flags sent by the client in the SYN packet: SACK support, ECN
+ * support, window scale. To be used with SYN cookies.
+ *
+ * *th* points to the start of the TCP header of the client's SYN
+ * packet, while *th_len* contains **sizeof**\ (**struct tcphdr**).
+ *
+ * *tsopt* points to the output location where to put the resulting
+ * timestamp values: tsval and tsecr, in the format of the TCP
+ * timestamp option.
+ *
+ * Return
+ * On success, 0.
+ *
+ * On failure, the returned value is one of the following:
+ *
+ * **-EINVAL** input arguments are invalid
+ *
+ * **-ENOENT** the TCP header doesn't have the timestamp option
+ *
+ * **-EOPNOTSUPP** kernel configuration does not enable SYN cookies
*/
#define __BPF_FUNC_MAPPER(FN) \
FN(unspec), \
@@ -2934,6 +2958,7 @@ struct bpf_stack_build_id {
FN(ct_lookup_tcp), \
FN(tcp_raw_gen_syncookie), \
FN(tcp_raw_check_syncookie), \
+ FN(tcp_raw_gen_tscookie), \
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
* function eBPF program intends to call
diff --git a/net/core/filter.c b/net/core/filter.c
index a08a7ff..e5d6a3a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6132,6 +6132,42 @@ u32 bpf_xdp_sock_convert_ctx_access(enum bpf_access_type type,
.arg4_type = ARG_CONST_SIZE,
};
+BPF_CALL_4(bpf_tcp_raw_gen_tscookie, struct tcphdr *, th, u32, th_len,
+ __be32 *, tsopt, u32, tsopt_len)
+{
+ int err;
+
+#ifdef CONFIG_SYN_COOKIES
+ if (tsopt_len != sizeof(u64)) {
+ err = -EINVAL;
+ goto err;
+ }
+
+ if (!cookie_init_timestamp_raw(th, &tsopt[0], &tsopt[1])) {
+ err = -ENOENT;
+ goto err;
+ }
+
+ return 0;
+#else
+ err = -EOPNOTSUPP;
+#endif
+err:
+ memset(tsopt, 0, tsopt_len);
+ return err;
+}
+
+static const struct bpf_func_proto bpf_tcp_raw_gen_tscookie_proto = {
+ .func = bpf_tcp_raw_gen_tscookie,
+ .gpl_only = false,
+ .pkt_access = true,
+ .ret_type = RET_INTEGER,
+ .arg1_type = ARG_PTR_TO_MEM,
+ .arg2_type = ARG_CONST_SIZE,
+ .arg3_type = ARG_PTR_TO_UNINIT_MEM,
+ .arg4_type = ARG_CONST_SIZE,
+};
+
#endif /* CONFIG_INET */
bool bpf_helper_changes_pkt_data(void *func)
@@ -6474,6 +6510,8 @@ bool bpf_helper_changes_pkt_data(void *func)
return &bpf_tcp_raw_gen_syncookie_proto;
case BPF_FUNC_tcp_raw_check_syncookie:
return &bpf_tcp_raw_check_syncookie_proto;
+ case BPF_FUNC_tcp_raw_gen_tscookie:
+ return &bpf_tcp_raw_gen_tscookie_proto;
#endif
default:
return bpf_base_func_proto(func_id);
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 2b45d14..ee820b8 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -87,6 +87,66 @@ u64 cookie_init_timestamp(struct request_sock *req)
return (u64)ts * (NSEC_PER_SEC / TCP_TS_HZ);
}
+bool cookie_init_timestamp_raw(struct tcphdr *th, __be32 *tsval, __be32 *tsecr)
+{
+ int length = (th->doff * 4) - sizeof(*th);
+ bool option_timestamp = false;
+ bool option_sack = false;
+ u8 wscale = 0xf;
+ u32 cookie;
+ u8 *ptr;
+
+ ptr = (u8 *)(th + 1);
+
+ while (length > 0) {
+ u8 opcode = *ptr++;
+ u8 opsize;
+
+ if (opcode == TCPOPT_EOL)
+ break;
+ if (opcode == TCPOPT_NOP) {
+ length--;
+ continue;
+ }
+
+ if (length < 2)
+ break;
+ opsize = *ptr++;
+ if (opsize < 2)
+ break;
+ if (opsize > length)
+ break;
+
+ switch (opcode) {
+ case TCPOPT_WINDOW:
+ wscale = min_t(u8, *ptr, TCP_MAX_WSCALE);
+ break;
+ case TCPOPT_TIMESTAMP:
+ option_timestamp = true;
+ /* Client's tsval becomes our tsecr. */
+ *tsecr = cpu_to_be32(get_unaligned_be32(ptr));
+ break;
+ case TCPOPT_SACK_PERM:
+ option_sack = true;
+ break;
+ }
+
+ ptr += opsize - 2;
+ length -= opsize;
+ }
+
+ if (!option_timestamp)
+ return false;
+
+ cookie = tcp_time_stamp_raw() & ~0x3f;
+ cookie |= wscale & 0xf;
+ if (option_sack)
+ cookie |= BIT(4);
+ if (th->ece && th->cwr)
+ cookie |= BIT(5);
+ *tsval = cpu_to_be32(cookie);
+ return true;
+}
static __u32 secure_tcp_syn_cookie(__be32 saddr, __be32 daddr, __be16 sport,
__be16 dport, __u32 sseq, __u32 data)
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 6fb29c34..2c21f16 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2816,6 +2816,30 @@ struct bpf_stack_build_id {
* **-ENOENT** the packet is not a valid ACK packet
*
* **-EOPNOTSUPP** kernel configuration does not enable SYN cookies
+ *
+ * int bpf_tcp_raw_gen_tscookie(struct tcphdr *th, u32 th_len, __be32 *tsopt, u32 tsopt_len)
+ * Description
+ * Try to generate a timestamp cookie which encodes some of the
+ * flags sent by the client in the SYN packet: SACK support, ECN
+ * support, window scale. To be used with SYN cookies.
+ *
+ * *th* points to the start of the TCP header of the client's SYN
+ * packet, while *th_len* contains **sizeof**\ (**struct tcphdr**).
+ *
+ * *tsopt* points to the output location where to put the resulting
+ * timestamp values: tsval and tsecr, in the format of the TCP
+ * timestamp option.
+ *
+ * Return
+ * On success, 0.
+ *
+ * On failure, the returned value is one of the following:
+ *
+ * **-EINVAL** input arguments are invalid
+ *
+ * **-ENOENT** the TCP header doesn't have the timestamp option
+ *
+ * **-EOPNOTSUPP** kernel configuration does not enable SYN cookies
*/
#define __BPF_FUNC_MAPPER(FN) \
FN(unspec), \
@@ -2932,6 +2956,7 @@ struct bpf_stack_build_id {
FN(ct_lookup_tcp), \
FN(tcp_raw_gen_syncookie), \
FN(tcp_raw_check_syncookie), \
+ FN(tcp_raw_gen_tscookie), \
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
* function eBPF program intends to call
diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h
index 78ab538..89ee410 100644
--- a/tools/testing/selftests/bpf/bpf_helpers.h
+++ b/tools/testing/selftests/bpf/bpf_helpers.h
@@ -242,6 +242,9 @@ static __s64 (*bpf_tcp_raw_gen_syncookie)(void *iph, __u32 iph_len,
static int (*bpf_tcp_raw_check_syncookie)(void *iph, __u32 iph_len,
struct tcphdr *th, __u32 th_len) =
(void *) BPF_FUNC_tcp_raw_check_syncookie;
+static int (*bpf_tcp_raw_gen_tscookie)(struct tcphdr *th, __u32 th_len,
+ __be32 *tsopt, __u32 tsopt_len) =
+ (void *) BPF_FUNC_tcp_raw_gen_tscookie;
/* llvm builtin functions that eBPF C program may use to
* emit BPF_LD_ABS and BPF_LD_IND instructions
--
1.8.3.1
More information about the kernel-team
mailing list