packet capture is especially valuable in tracing contexts, so extend bpf_pcap helper to take a tracing-derived skb pointer as an argument.
In the case of tracing programs, the starting protocol (corresponding to libpcap DLT_* values; 1 for Ethernet, 12 for IP, etc) needs to be specified and should reflect the protocol type which is pointed to by the skb->data pointer; i.e. the start of the packet. This can derived in a limited set of cases, but should be specified where possible. For skb and xdp programs this protocol will nearly always be 1 (BPF_PCAP_TYPE_ETH).
Example usage for a tracing program, where we use a struct bpf_pcap_hdr array map to pass in preferences for protocol and max len:
struct bpf_map_def SEC("maps") pcap_conf_map = { .type = BPF_MAP_TYPE_ARRAY, .key_size = sizeof(int), .value_size = sizeof(struct bpf_pcap_hdr), .max_entries = 1, };
struct bpf_map_def SEC("maps") pcap_map = { .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY, .key_size = sizeof(int), .value_size = sizeof(int), .max_entries = 1024, };
SEC("kprobe/kfree_skb") int probe_kfree_skb(struct pt_regs *ctx) { struct bpf_pcap_hdr *conf; int key = 0;
conf = bpf_map_lookup_elem(&pcap_conf_map, &key); if (!conf) return 0;
bpf_pcap((void *)PT_REGS_PARM1(ctx), conf->cap_len, &pcap_map, conf->protocol, BPF_F_CURRENT_CPU); return 0; }
Signed-off-by: Alan Maguire alan.maguire@oracle.com --- include/uapi/linux/bpf.h | 21 ++++- kernel/trace/bpf_trace.c | 214 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 233 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index a27e58e..13f86d3 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -2758,7 +2758,9 @@ struct bpf_stack_build_id { * held by *map* of type **BPF_MAP_TYPE_PERF_EVENT_ARRAY**. This * perf event has the same attributes as perf events generated * by bpf_perf_event_output. For skb and xdp programs, *data* - * is the relevant context. + * is the relevant context, while for tracing programs, + * *data* must be a pointer to a **struct sk_buff** derived + * from kprobe or tracepoint arguments. * * Metadata for this event is a **struct bpf_pcap_hdr**; this * contains the capture length, actual packet length and @@ -2771,6 +2773,14 @@ struct bpf_stack_build_id { * to 48 bits; the id can be used to correlate captured packets * with other trace data, since the passed-in flags value is stored * stored in the **struct bpf_pcap_hdr** in the **flags** field. + * Specifying **BPF_F_PCAP_ID_IIFINDEX** and a non-zero value in + * the id portion of the flags limits capture events to skbs + * with the specified incoming ifindex, allowing limiting of + * tracing to the the associated interface. Specifying + * **BPF_F_PCAP_STRICT_TYPE** will cause *bpf_pcap* to return + * -EPROTO and skip capture if a specific protocol is specified + * and it does not match the current skb. These additional flags + * are only valid (and useful) for tracing programs. * * The *protocol* value specifies the protocol type of the start * of the packet so that packet capture can carry out @@ -2780,7 +2790,12 @@ struct bpf_stack_build_id { * Return * 0 on success, or a negative error in case of failure. * -ENOENT will be returned if the associated perf event - * map entry is empty, or the skb is zero-length. + * map entry is empty, the skb is zero-length, or the incoming + * ifindex was specified and we failed to match. + * -EPROTO will be returned if **BPF_PCAP_TYPE_UNSET** is specified + * and no protocol can be determined, or if we specify a protocol + * along with **BPF_F_PCAP_STRICT_TYPE** and the skb protocol does + * not match. * -EINVAL will be returned if the flags value is invalid. * */ @@ -2977,6 +2992,8 @@ enum bpf_func_id {
/* BPF_FUNC_pcap flags */ #define BPF_F_PCAP_ID_MASK 0xffffffffffff +#define BPF_F_PCAP_ID_IIFINDEX (1ULL << 48) +#define BPF_F_PCAP_STRICT_TYPE (1ULL << 56)
/* Mode for BPF_FUNC_skb_adjust_room helper. */ enum bpf_adj_room_mode { diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index ca1255d..311883b 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -13,6 +13,8 @@ #include <linux/kprobes.h> #include <linux/syscalls.h> #include <linux/error-injection.h> +#include <linux/skbuff.h> +#include <linux/ip.h>
#include <asm/tlb.h>
@@ -530,6 +532,216 @@ u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size, return __bpf_perf_event_output(regs, map, flags, sd); }
+/* Essentially just skb_copy_bits() using probe_kernel_read() where needed. */ +static unsigned long bpf_trace_skb_copy(void *tobuf, const void *from, + unsigned long offset, + unsigned long len) +{ + const struct sk_buff *frag_iterp, *skb = from; + struct skb_shared_info *shinfop, shinfo; + struct sk_buff frag_iter; + unsigned long copy, start; + void *to = tobuf; + int i, ret; + + start = skb_headlen(skb); + + copy = start - offset; + if (copy > 0) { + if (copy > len) + copy = len; + ret = probe_kernel_read(to, skb->data, copy); + if (unlikely(ret < 0)) + goto out; + len -= copy; + if (len == 0) + return 0; + offset += copy; + to += copy; + } + + if (skb->data_len == 0) + goto out; + + shinfop = skb_shinfo(skb); + + ret = probe_kernel_read(&shinfo, shinfop, sizeof(shinfo)); + if (unlikely(ret < 0)) + goto out; + + if (shinfo.nr_frags > MAX_SKB_FRAGS) { + ret = -EINVAL; + goto out; + } + for (i = 0; i < shinfo.nr_frags; i++) { + skb_frag_t *f = &shinfo.frags[i]; + int end; + + if (start > offset + len) { + ret = -E2BIG; + goto out; + } + + end = start + skb_frag_size(f); + copy = end - offset; + if (copy > 0) { + u32 poff, p_len, copied; + struct page *p; + u8 *vaddr; + + if (copy > len) + copy = len; + + skb_frag_foreach_page(f, + skb_frag_off(f) + offset - start, + copy, p, poff, p_len, copied) { + + vaddr = kmap_atomic(p); + ret = probe_kernel_read(to + copied, + vaddr + poff, p_len); + kunmap_atomic(vaddr); + + if (unlikely(ret < 0)) + goto out; + } + len -= copy; + if (len == 0) + return 0; + offset += copy; + to += copy; + } + start = end; + } + + for (frag_iterp = shinfo.frag_list; frag_iterp; + frag_iterp = frag_iter.next) { + int end; + + if (start > offset + len) { + ret = -E2BIG; + goto out; + } + ret = probe_kernel_read(&frag_iter, frag_iterp, + sizeof(frag_iter)); + if (ret) + goto out; + + end = start + frag_iter.len; + copy = end - offset; + if (copy > 0) { + if (copy > len) + copy = len; + ret = bpf_trace_skb_copy(to, &frag_iter, + offset - start, + copy); + if (ret) + goto out; + + len -= copy; + if (len == 0) + return 0; + offset += copy; + to += copy; + } + start = end; + } +out: + if (ret) + memset(tobuf, 0, len); + + return ret; +} + +/* Derive protocol for some of the easier cases. For tracing, a probe point + * may be dealing with packets in various states. Common cases are IP + * packets prior to adding MAC header (_PCAP_TYPE_IP) and a full packet + * (_PCAP_TYPE_ETH). For other cases the caller must specify the + * protocol they expect. Other heuristics for packet identification + * should be added here as needed, since determining the packet type + * ensures we do not capture packets that fail to match the desired + * pcap type in BPF_F_PCAP_STRICT_TYPE mode. + */ +static inline int bpf_skb_protocol_get(struct sk_buff *skb) +{ + switch (htons(skb->protocol)) { + case ETH_P_IP: + case ETH_P_IPV6: + if (skb_network_header(skb) == skb->data) + return BPF_PCAP_TYPE_IP; + else + return BPF_PCAP_TYPE_ETH; + default: + return BPF_PCAP_TYPE_UNSET; + } +} + +BPF_CALL_5(bpf_trace_pcap, void *, data, u32, size, struct bpf_map *, map, + int, protocol_wanted, u64, flags) +{ + struct bpf_pcap_hdr pcap; + struct sk_buff skb; + int protocol; + int ret; + + if (unlikely(flags & ~(BPF_F_PCAP_ID_IIFINDEX | BPF_F_PCAP_ID_MASK | + BPF_F_PCAP_STRICT_TYPE))) + return -EINVAL; + + ret = probe_kernel_read(&skb, data, sizeof(skb)); + if (unlikely(ret < 0)) + return ret; + + /* Sanity check skb len in case we get bogus data. */ + if (unlikely(!skb.len)) + return -ENOENT; + if (unlikely(skb.len > GSO_MAX_SIZE || skb.data_len > skb.len)) + return -E2BIG; + + protocol = bpf_skb_protocol_get(&skb); + + if (protocol_wanted == BPF_PCAP_TYPE_UNSET) { + /* If we cannot determine protocol type, bail. */ + if (protocol == BPF_PCAP_TYPE_UNSET) + return -EPROTO; + } else { + /* if we determine protocol type, and it's not what we asked + * for _and_ we are in strict mode, bail. Otherwise we assume + * the packet is the requested protocol type and drive on. + */ + if (flags & BPF_F_PCAP_STRICT_TYPE && + protocol != BPF_PCAP_TYPE_UNSET && + protocol != protocol_wanted) + return -EPROTO; + protocol = protocol_wanted; + } + + /* If we specified a matching incoming ifindex, bail if not a match. */ + if (flags & BPF_F_PCAP_ID_IIFINDEX) { + int iif = flags & BPF_F_PCAP_ID_MASK; + + if (iif && skb.skb_iif != iif) + return -ENOENT; + } + + ret = bpf_pcap_prepare(protocol, size, skb.len, flags, &pcap); + if (ret) + return ret; + + return bpf_event_output(map, BPF_F_CURRENT_CPU, &pcap, sizeof(pcap), + &skb, pcap.cap_len, bpf_trace_skb_copy); +} + +static const struct bpf_func_proto bpf_trace_pcap_proto = { + .func = bpf_trace_pcap, + .gpl_only = true, + .ret_type = RET_INTEGER, + .arg1_type = ARG_ANYTHING, + .arg2_type = ARG_ANYTHING, + .arg3_type = ARG_CONST_MAP_PTR, + .arg4_type = ARG_ANYTHING, + .arg5_type = ARG_ANYTHING, +}; + BPF_CALL_0(bpf_get_current_task) { return (long) current; @@ -709,6 +921,8 @@ static void do_bpf_send_signal(struct irq_work *entry) #endif case BPF_FUNC_send_signal: return &bpf_send_signal_proto; + case BPF_FUNC_pcap: + return &bpf_trace_pcap_proto; default: return NULL; }