bpf: Add classid helper only based on skb->sk

Similarly to 5a52ae4e32a6 ("bpf: Allow to retrieve cgroup v1 classid
from v2 hooks"), add a helper to retrieve cgroup v1 classid solely
based on the skb->sk, so it can be used as key as part of BPF map
lookups out of tc from host ns, in particular given the skb->sk is
retained these days when crossing net ns thanks to 9c4c325252c5
("skbuff: preserve sock reference when scrubbing the skb."). This
is similar to bpf_skb_cgroup_id() which implements the same for v2.
Kubernetes ecosystem is still operating on v1 however, hence net_cls
needs to be used there until this can be dropped in with the v2
helper of bpf_skb_cgroup_id().

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/ed633cf27a1c620e901c5aa99ebdefb028dce600.1601477936.git.daniel@iogearbox.net

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 2b1d3f1..6116a7f 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -3643,6 +3643,15 @@ union bpf_attr {
  *             *flags* are identical to those used for bpf_snprintf_btf.
  *     Return
  *             0 on success or a negative error in case of failure.
+ *
+ * u64 bpf_skb_cgroup_classid(struct sk_buff *skb)
+ *     Description
+ *             See **bpf_get_cgroup_classid**\ () for the main description.
+ *             This helper differs from **bpf_get_cgroup_classid**\ () in that
+ *             the cgroup v1 net_cls class is retrieved only from the *skb*'s
+ *             associated socket instead of the current process.
+ *     Return
+ *             The id is returned or 0 in case the id could not be retrieved.
  */
 #define __BPF_FUNC_MAPPER(FN)          \
        FN(unspec),                     \
@@ -3796,6 +3805,7 @@ union bpf_attr {
        FN(copy_from_user),             \
        FN(snprintf_btf),               \
        FN(seq_printf_btf),             \
+       FN(skb_cgroup_classid),         \
        /* */
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper

diff --git a/net/core/filter.c b/net/core/filter.c
index af88935..fa01c69 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2707,6 +2707,23 @@ static const struct bpf_func_proto bpf_get_cgroup_classid_curr_proto = {
        .gpl_only       = false,
        .ret_type       = RET_INTEGER,
 };
+
+BPF_CALL_1(bpf_skb_cgroup_classid, const struct sk_buff *, skb)
+{
+       struct sock *sk = skb_to_full_sk(skb);
+
+       if (!sk || !sk_fullsock(sk))
+               return 0;
+
+       return sock_cgroup_classid(&sk->sk_cgrp_data);
+}
+
+static const struct bpf_func_proto bpf_skb_cgroup_classid_proto = {
+       .func           = bpf_skb_cgroup_classid,
+       .gpl_only       = false,
+       .ret_type       = RET_INTEGER,
+       .arg1_type      = ARG_PTR_TO_CTX,
+};
 #endif
 
 BPF_CALL_1(bpf_get_cgroup_classid, const struct sk_buff *, skb)
@@ -6772,6 +6789,10 @@ tc_cls_act_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_skb_get_xfrm_state:
                return &bpf_skb_get_xfrm_state_proto;
 #endif
+#ifdef CONFIG_CGROUP_NET_CLASSID
+       case BPF_FUNC_skb_cgroup_classid:
+               return &bpf_skb_cgroup_classid_proto;
+#endif
 #ifdef CONFIG_SOCK_CGROUP_DATA
        case BPF_FUNC_skb_cgroup_id:
                return &bpf_skb_cgroup_id_proto;

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 2b1d3f1..6116a7f 100644 (file)
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -3643,6 +3643,15 @@ union bpf_attr {
  *             *flags* are identical to those used for bpf_snprintf_btf.
  *     Return
  *             0 on success or a negative error in case of failure.
+ *
+ * u64 bpf_skb_cgroup_classid(struct sk_buff *skb)
+ *     Description
+ *             See **bpf_get_cgroup_classid**\ () for the main description.
+ *             This helper differs from **bpf_get_cgroup_classid**\ () in that
+ *             the cgroup v1 net_cls class is retrieved only from the *skb*'s
+ *             associated socket instead of the current process.
+ *     Return
+ *             The id is returned or 0 in case the id could not be retrieved.
  */
 #define __BPF_FUNC_MAPPER(FN)          \
        FN(unspec),                     \
@@ -3796,6 +3805,7 @@ union bpf_attr {
        FN(copy_from_user),             \
        FN(snprintf_btf),               \
        FN(seq_printf_btf),             \
+       FN(skb_cgroup_classid),         \
        /* */
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper