Skip to content

Commit e3da08d

Browse files
Petar Penkovborkmann
Petar Penkov
authored and
borkmann
committed
bpf: allow BPF read access to qdisc pkt_len
The pkt_len field in qdisc_skb_cb stores the skb length as it will appear on the wire after segmentation. For byte accounting, this value is more accurate than skb->len. It is computed on entry to the TC layer, so only valid there. Allow read access to this field from BPF tc classifier and action programs. The implementation is analogous to tc_classid, aside from restricting to read access. To distinguish it from skb->len and self-describe export as wire_len. Changes v1->v2 - Rename pkt_len to wire_len Signed-off-by: Petar Penkov <ppenkov@google.com> Signed-off-by: Vlad Dumitrescu <vladum@google.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Acked-by: Song Liu <songliubraving@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
1 parent de94b65 commit e3da08d

File tree

4 files changed

+50
-0
lines changed

4 files changed

+50
-0
lines changed

‎include/uapi/linux/bpf.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2497,6 +2497,7 @@ struct __sk_buff {
24972497
__u32 data_meta;
24982498
struct bpf_flow_keys *flow_keys;
24992499
__u64 tstamp;
2500+
__u32 wire_len;
25002501
};
25012502

25022503
struct bpf_tunnel_key {

‎net/core/filter.c

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5773,6 +5773,7 @@ static bool sk_filter_is_valid_access(int off, int size,
57735773
case bpf_ctx_range(struct __sk_buff, flow_keys):
57745774
case bpf_ctx_range_till(struct __sk_buff, family, local_port):
57755775
case bpf_ctx_range(struct __sk_buff, tstamp):
5776+
case bpf_ctx_range(struct __sk_buff, wire_len):
57765777
return false;
57775778
}
57785779

@@ -5797,6 +5798,7 @@ static bool cg_skb_is_valid_access(int off, int size,
57975798
case bpf_ctx_range(struct __sk_buff, tc_classid):
57985799
case bpf_ctx_range(struct __sk_buff, data_meta):
57995800
case bpf_ctx_range(struct __sk_buff, flow_keys):
5801+
case bpf_ctx_range(struct __sk_buff, wire_len):
58005802
return false;
58015803
case bpf_ctx_range(struct __sk_buff, data):
58025804
case bpf_ctx_range(struct __sk_buff, data_end):
@@ -5843,6 +5845,7 @@ static bool lwt_is_valid_access(int off, int size,
58435845
case bpf_ctx_range(struct __sk_buff, data_meta):
58445846
case bpf_ctx_range(struct __sk_buff, flow_keys):
58455847
case bpf_ctx_range(struct __sk_buff, tstamp):
5848+
case bpf_ctx_range(struct __sk_buff, wire_len):
58465849
return false;
58475850
}
58485851

@@ -6273,6 +6276,7 @@ static bool sk_skb_is_valid_access(int off, int size,
62736276
case bpf_ctx_range(struct __sk_buff, data_meta):
62746277
case bpf_ctx_range(struct __sk_buff, flow_keys):
62756278
case bpf_ctx_range(struct __sk_buff, tstamp):
6279+
case bpf_ctx_range(struct __sk_buff, wire_len):
62766280
return false;
62776281
}
62786282

@@ -6360,6 +6364,7 @@ static bool flow_dissector_is_valid_access(int off, int size,
63606364
case bpf_ctx_range(struct __sk_buff, data_meta):
63616365
case bpf_ctx_range_till(struct __sk_buff, family, local_port):
63626366
case bpf_ctx_range(struct __sk_buff, tstamp):
6367+
case bpf_ctx_range(struct __sk_buff, wire_len):
63636368
return false;
63646369
}
63656370

@@ -6685,6 +6690,17 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
66856690
bpf_target_off(struct sk_buff,
66866691
tstamp, 8,
66876692
target_size));
6693+
break;
6694+
6695+
case offsetof(struct __sk_buff, wire_len):
6696+
BUILD_BUG_ON(FIELD_SIZEOF(struct qdisc_skb_cb, pkt_len) != 4);
6697+
6698+
off = si->off;
6699+
off -= offsetof(struct __sk_buff, wire_len);
6700+
off += offsetof(struct sk_buff, cb);
6701+
off += offsetof(struct qdisc_skb_cb, pkt_len);
6702+
*target_size = 4;
6703+
*insn++ = BPF_LDX_MEM(BPF_W, si->dst_reg, si->src_reg, off);
66886704
}
66896705

66906706
return insn - insn_buf;

‎tools/include/uapi/linux/bpf.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2497,6 +2497,7 @@ struct __sk_buff {
24972497
__u32 data_meta;
24982498
struct bpf_flow_keys *flow_keys;
24992499
__u64 tstamp;
2500+
__u32 wire_len;
25002501
};
25012502

25022503
struct bpf_tunnel_key {

‎tools/testing/selftests/bpf/test_verifier.c

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14033,6 +14033,38 @@ static struct bpf_test tests[] = {
1403314033
.result_unpriv = REJECT,
1403414034
.result = ACCEPT,
1403514035
},
14036+
{
14037+
"check wire_len is not readable by sockets",
14038+
.insns = {
14039+
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
14040+
offsetof(struct __sk_buff, wire_len)),
14041+
BPF_EXIT_INSN(),
14042+
},
14043+
.errstr = "invalid bpf_context access",
14044+
.result = REJECT,
14045+
},
14046+
{
14047+
"check wire_len is readable by tc classifier",
14048+
.insns = {
14049+
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
14050+
offsetof(struct __sk_buff, wire_len)),
14051+
BPF_EXIT_INSN(),
14052+
},
14053+
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
14054+
.result = ACCEPT,
14055+
},
14056+
{
14057+
"check wire_len is not writable by tc classifier",
14058+
.insns = {
14059+
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
14060+
offsetof(struct __sk_buff, wire_len)),
14061+
BPF_EXIT_INSN(),
14062+
},
14063+
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
14064+
.errstr = "invalid bpf_context access",
14065+
.errstr_unpriv = "R1 leaks addr",
14066+
.result = REJECT,
14067+
},
1403614068
};
1403714069

1403814070
static int probe_filter_length(const struct bpf_insn *fp)

0 commit comments

Comments
 (0)