From: Daniel Mack <daniel@zonque•org>
To: htejun@fb•com, daniel@iogearbox•net, ast@fb•com
Cc: davem@davemloft•net, kafai@fb•com, fw@strlen•de,
pablo@netfilter•org, harald@redhat•com, netdev@vger•kernel.org,
Daniel Mack <daniel@zonque•org>
Subject: [RFC PATCH 0/5] Add eBPF hooks for cgroups
Date: Wed, 17 Aug 2016 16:00:43 +0200 [thread overview]
Message-ID: <1471442448-1248-1-git-send-email-daniel@zonque.org> (raw)
This patch set allows eBPF programs for network filtering and
accounting to be attached to cgroups, so that they apply to all sockets
of all tasks placed in that cgroup. The logic also allows to be
extendeded for other cgroup-based eBPF logic.
In short, the patch set adds the following:
* A new eBPF program type BPF_PROG_TYPE_CGROUP_SOCKET_FILTER,
which is identical to BPF_PROG_TYPE_SOCKET_FILTER for now
* CONFIG_CGROUP_BPF, which guards every new detail affected by this
patch set
* Two pointers to struct cgroup to store eBPF programs for socket
filtering
* Two new bpf(2) syscall commands, BPF_PROG_ATTACH and BPF_PROG_DETACH,
which are kept generic at the kernel API level in a sense that can
be reused to attach programs to other entities than cgroups. All that
is passed in to kernel is a file descriptor.
* A hook in the networking ingress path to run these programs
* A userspace program that demonstrates how to use that new feature
I'd appreciate some feedback on this. Pablo has some remaining concerns
about this approach, and I'd like to continue the discussion we had
off-list in the light of this patchset.
Also, I currently lack an idea for a good place to hook up the egress
filter. If anyone has a good idea, I'd be happy to hear about it.
Thanks,
Daniel
Daniel Mack (5):
bpf: add new prog type for cgroup socket filtering
cgroup: add bpf_{e,in}gress pointers
bpf: add BPF_PROG_ATTACH and BPF_PROG_DETACH commands
net: filter: run cgroup eBPF programs
samples: bpf: add userspace example for attaching eBPF programs to
cgroups
include/linux/cgroup-defs.h | 6 ++
include/uapi/linux/bpf.h | 15 +++++
init/Kconfig | 8 +++
kernel/bpf/syscall.c | 132 ++++++++++++++++++++++++++++++++++++++
kernel/bpf/verifier.c | 1 +
kernel/cgroup.c | 9 +++
net/core/filter.c | 50 +++++++++++++++
samples/bpf/Makefile | 2 +
samples/bpf/libbpf.c | 21 +++++++
samples/bpf/libbpf.h | 3 +
samples/bpf/test_cgrp2_attach.c | 136 ++++++++++++++++++++++++++++++++++++++++
11 files changed, 383 insertions(+)
create mode 100644 samples/bpf/test_cgrp2_attach.c
--
2.5.5
next reply other threads:[~2016-08-17 14:11 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-17 14:00 Daniel Mack [this message]
2016-08-17 14:00 ` [RFC PATCH 1/5] bpf: add new prog type for cgroup socket filtering Daniel Mack
2016-08-17 14:00 ` [RFC PATCH 2/5] cgroup: add bpf_{e,in}gress pointers Daniel Mack
2016-08-17 14:10 ` Tejun Heo
2016-08-17 17:50 ` Alexei Starovoitov
2016-08-17 17:56 ` Tejun Heo
2016-08-17 14:00 ` [RFC PATCH 3/5] bpf: add BPF_PROG_ATTACH and BPF_PROG_DETACH commands Daniel Mack
2016-08-17 14:20 ` Tejun Heo
2016-08-17 14:35 ` Daniel Mack
2016-08-17 15:06 ` Tejun Heo
2016-08-17 15:51 ` Daniel Mack
2016-08-17 17:48 ` Alexei Starovoitov
2016-08-17 15:08 ` Tejun Heo
2016-08-17 16:16 ` Eric Dumazet
2016-08-17 18:10 ` Alexei Starovoitov
2016-08-18 15:17 ` Daniel Mack
2016-08-17 14:00 ` [RFC PATCH 4/5] net: filter: run cgroup eBPF programs Daniel Mack
2016-08-17 14:23 ` Tejun Heo
2016-08-17 14:36 ` Daniel Mack
2016-08-17 14:58 ` Tejun Heo
2016-08-17 18:20 ` Alexei Starovoitov
2016-08-17 18:23 ` Alexei Starovoitov
2016-08-21 20:14 ` Sargun Dhillon
2016-08-25 19:37 ` Tejun Heo
2016-08-17 14:00 ` [RFC PATCH 5/5] samples: bpf: add userspace example for attaching eBPF programs to cgroups Daniel Mack
2016-08-19 9:19 ` [RFC PATCH 0/5] Add eBPF hooks for cgroups Pablo Neira Ayuso
2016-08-19 10:35 ` Daniel Mack
2016-08-19 11:20 ` Daniel Borkmann
2016-08-19 16:31 ` Pablo Neira Ayuso
2016-08-19 16:37 ` Thomas Graf
2016-08-19 16:21 ` Pablo Neira Ayuso
2016-08-19 17:07 ` Thomas Graf
2016-08-22 16:06 ` Pablo Neira Ayuso
2016-08-22 16:22 ` Daniel Mack
2016-08-22 17:20 ` Sargun Dhillon
2016-08-23 8:27 ` Daniel Mack
2016-08-23 9:54 ` Sargun Dhillon
2016-08-23 10:03 ` Daniel Mack
2016-08-19 16:01 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1471442448-1248-1-git-send-email-daniel@zonque.org \
--to=daniel@zonque$(echo .)org \
--cc=ast@fb$(echo .)com \
--cc=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=fw@strlen$(echo .)de \
--cc=harald@redhat$(echo .)com \
--cc=htejun@fb$(echo .)com \
--cc=kafai@fb$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pablo@netfilter$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox