bpf: Add helper to retrieve socket in BPF

This patch adds new BPF helper functions, bpf_sk_lookup_tcp() and
bpf_sk_lookup_udp() which allows BPF programs to find out if there is a
socket listening on this host, and returns a socket pointer which the
BPF program can then access to determine, for instance, whether to
forward or drop traffic. bpf_sk_lookup_xxx() may take a reference on the
socket, so when a BPF program makes use of this function, it must
subsequently pass the returned pointer into the newly added sk_release()
to return the reference.

By way of example, the following pseudocode would filter inbound
connections at XDP if there is no corresponding service listening for
the traffic:

  struct bpf_sock_tuple tuple;
  struct bpf_sock_ops *sk;

  populate_tuple(ctx, &tuple); // Extract the 5tuple from the packet
  sk = bpf_sk_lookup_tcp(ctx, &tuple, sizeof tuple, netns, 0);
  if (!sk) {
    // Couldn't find a socket listening for this traffic. Drop.
    return TC_ACT_SHOT;
  }
  bpf_sk_release(sk, 0);
  return TC_ACT_OK;

Signed-off-by: Joe Stringer <joe@wand.net.nz>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

1 files changed, 92 insertions, 1 deletions

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index e2070d819e04..f9187b41dff6 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2144,6 +2144,77 @@ union bpf_attr {
  *              request in the skb.
  *      Return
  *              0 on success, or a negative error in case of failure.
+ *
+ * struct bpf_sock *bpf_sk_lookup_tcp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u32 netns, u64 flags)
+ *      Description
+ *              Look for TCP socket matching *tuple*, optionally in a child
+ *              network namespace *netns*. The return value must be checked,
+ *              and if non-NULL, released via **bpf_sk_release**\ ().
+ *
+ *              The *ctx* should point to the context of the program, such as
+ *              the skb or socket (depending on the hook in use). This is used
+ *              to determine the base network namespace for the lookup.
+ *
+ *              *tuple_size* must be one of:
+ *
+ *              **sizeof**\ (*tuple*\ **->ipv4**)
+ *                      Look for an IPv4 socket.
+ *              **sizeof**\ (*tuple*\ **->ipv6**)
+ *                      Look for an IPv6 socket.
+ *
+ *              If the *netns* is zero, then the socket lookup table in the
+ *              netns associated with the *ctx* will be used. For the TC hooks,
+ *              this in the netns of the device in the skb. For socket hooks,
+ *              this in the netns of the socket. If *netns* is non-zero, then
+ *              it specifies the ID of the netns relative to the netns
+ *              associated with the *ctx*.
+ *
+ *              All values for *flags* are reserved for future usage, and must
+ *              be left at zero.
+ *
+ *              This helper is available only if the kernel was compiled with
+ *              **CONFIG_NET** configuration option.
+ *      Return
+ *              Pointer to *struct bpf_sock*, or NULL in case of failure.
+ *
+ * struct bpf_sock *bpf_sk_lookup_udp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u32 netns, u64 flags)
+ *      Description
+ *              Look for UDP socket matching *tuple*, optionally in a child
+ *              network namespace *netns*. The return value must be checked,
+ *              and if non-NULL, released via **bpf_sk_release**\ ().
+ *
+ *              The *ctx* should point to the context of the program, such as
+ *              the skb or socket (depending on the hook in use). This is used
+ *              to determine the base network namespace for the lookup.
+ *
+ *              *tuple_size* must be one of:
+ *
+ *              **sizeof**\ (*tuple*\ **->ipv4**)
+ *                      Look for an IPv4 socket.
+ *              **sizeof**\ (*tuple*\ **->ipv6**)
+ *                      Look for an IPv6 socket.
+ *
+ *              If the *netns* is zero, then the socket lookup table in the
+ *              netns associated with the *ctx* will be used. For the TC hooks,
+ *              this in the netns of the device in the skb. For socket hooks,
+ *              this in the netns of the socket. If *netns* is non-zero, then
+ *              it specifies the ID of the netns relative to the netns
+ *              associated with the *ctx*.
+ *
+ *              All values for *flags* are reserved for future usage, and must
+ *              be left at zero.
+ *
+ *              This helper is available only if the kernel was compiled with
+ *              **CONFIG_NET** configuration option.
+ *      Return
+ *              Pointer to *struct bpf_sock*, or NULL in case of failure.
+ *
+ * int bpf_sk_release(struct bpf_sock *sk)
+ *      Description
+ *              Release the reference held by *sock*. *sock* must be a non-NULL
+ *              pointer that was returned from bpf_sk_lookup_xxx\ ().
+ *      Return
+ *              0 on success, or a negative error in case of failure.
  */
 #define __BPF_FUNC_MAPPER(FN)           \
         FN(unspec),                     \
@@ -2229,7 +2300,10 @@ union bpf_attr {
         FN(get_current_cgroup_id),      \
         FN(get_local_storage),          \
         FN(sk_select_reuseport),        \
-        FN(skb_ancestor_cgroup_id),
+        FN(skb_ancestor_cgroup_id),     \
+        FN(sk_lookup_tcp),              \
+        FN(sk_lookup_udp),              \
+        FN(sk_release),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
@@ -2399,6 +2473,23 @@ struct bpf_sock {
                                  */
 };
 
+struct bpf_sock_tuple {
+        union {
+                struct {
+                        __be32 saddr;
+                        __be32 daddr;
+                        __be16 sport;
+                        __be16 dport;
+                } ipv4;
+                struct {
+                        __be32 saddr[4];
+                        __be32 daddr[4];
+                        __be16 sport;
+                        __be16 dport;
+                } ipv6;
+        };
+};
+
 #define XDP_PACKET_HEADROOM 256
 
 /* User return codes for XDP prog type.