{"push_id":1302170932,"size":6,"distinct_size":6,"ref":"refs/heads/cg-bpf-syscall-6","head":"570be59cd9a0881a2faa295d01887e76633d5827","before":"fdd7aba943e48063e70d6f08735cb815805afd78","commits":[{"sha":"17f2bab02eb1a9206f907c36513022d7df29c343","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"bpf: add new prog type for cgroup socket filtering\n\nThis program type is similar to BPF_PROG_TYPE_SOCKET_FILTER, except that\nit does not allow BPF_LD_[ABS|IND] instructions and hooks up the\nbpf_skb_load_bytes() helper.\n\nPrograms of this type will be attached to cgroups for network filtering\nand accounting.\n\nSigned-off-by: Daniel Mack <daniel@zonque.org>","distinct":true,"url":"https://api.github.com/repos/zonque/linux/commits/17f2bab02eb1a9206f907c36513022d7df29c343"},{"sha":"ec09e0cd1cc6b739b09b66528bf69c20583b0f3f","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"cgroup: add support for eBPF programs\n\nThis patch adds two sets of eBPF program pointers to struct cgroup.\nOne for such that are directly pinned to a cgroup, and one for such\nthat are effective for it.\n\nTo illustrate the logic behind that, assume the following example\ncgroup hierarchy.\n\n  A - B - C\n        \\ D - E\n\nIf only B has a program attached, it will be effective for B, C, D\nand E. If D then attaches a program itself, that will be effective for\nboth D and E, and the program in B will only affect B and C. Only one\nprogram of a given type is effective for a cgroup.\n\nAttaching and detaching programs will be done through the bpf(2)\nsyscall. For now, ingress and egress inet socket filtering are the\nonly supported use-cases.\n\nSigned-off-by: Daniel Mack <daniel@zonque.org>","distinct":true,"url":"https://api.github.com/repos/zonque/linux/commits/ec09e0cd1cc6b739b09b66528bf69c20583b0f3f"},{"sha":"4bd56448cd8e16a81c12143781ccb583f4662677","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"bpf: add BPF_PROG_ATTACH and BPF_PROG_DETACH commands\n\nExtend the bpf(2) syscall by two new commands, BPF_PROG_ATTACH and\nBPF_PROG_DETACH which allow attaching and detaching eBPF programs\nto a target.\n\nOn the API level, the target could be anything that has an fd in\nuserspace, hence the name of the field in union bpf_attr is called\n'target_fd'.\n\nWhen called with BPF_ATTACH_TYPE_CGROUP_INET_{E,IN}GRESS, the target is\nexpected to be a valid file descriptor of a cgroup v2 directory which\nhas the bpf controller enabled. These are the only use-cases\nimplemented by this patch at this point, but more can be added.\n\nIf a program of the given type already exists in the given cgroup,\nthe program is swapped automically, so userspace does not have to drop\nan existing program first before installing a new one, which would\notherwise leave a gap in which no program is attached.\n\nFor more information on the propagation logic to subcgroups, please\nrefer to the bpf cgroup controller implementation.\n\nThe API is guarded by CAP_NET_ADMIN.\n\nSigned-off-by: Daniel Mack <daniel@zonque.org>","distinct":true,"url":"https://api.github.com/repos/zonque/linux/commits/4bd56448cd8e16a81c12143781ccb583f4662677"},{"sha":"fe3d924f4c49a6e0c84bd8e524b332a51417c820","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"net: filter: run cgroup eBPF ingress programs\n\nIf the cgroup associated with the receiving socket has an eBPF\nprograms installed, run them from sk_filter_trim_cap().\n\neBPF programs used in this context are expected to either return 1 to\nlet the packet pass, or != 1 to drop them. The programs have access to\nthe skb through bpf_skb_load_bytes(), and the payload starts at the\nnetwork headers (L3).\n\nNote that cgroup_bpf_run_filter() is stubbed out as static inline nop\nfor !CONFIG_CGROUP_BPF, and is otherwise guarded by a static key if\nthe feature is unused.\n\nSigned-off-by: Daniel Mack <daniel@zonque.org>","distinct":true,"url":"https://api.github.com/repos/zonque/linux/commits/fe3d924f4c49a6e0c84bd8e524b332a51417c820"},{"sha":"c189909b10f62743cc8e95a69f1e363691b0e615","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"net: ipv4, ipv6: run cgroup eBPF egress programs\n\nIf the cgroup associated with the receiving socket has an eBPF\nprograms installed, run them from ip_output(), ip6_output() and\nip_mc_output().\n\neBPF programs used in this context are expected to either return 1 to\nlet the packet pass, or != 1 to drop them. The programs have access to\nthe skb through bpf_skb_load_bytes(), and the payload starts at the\nnetwork headers (L3).\n\nNote that cgroup_bpf_run_filter() is stubbed out as static inline nop\nfor !CONFIG_CGROUP_BPF, and is otherwise guarded by a static key if\nthe feature is unused.\n\nSigned-off-by: Daniel Mack <daniel@zonque.org>","distinct":true,"url":"https://api.github.com/repos/zonque/linux/commits/c189909b10f62743cc8e95a69f1e363691b0e615"},{"sha":"570be59cd9a0881a2faa295d01887e76633d5827","author":{"name":"Daniel Mack","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@zonque.org"},"message":"samples: bpf: add userspace example for attaching eBPF programs to cgroups\n\nAdd a simple userpace program to demonstrate the new API to attach eBPF\nprograms to cgroups. This is what it does:\n\n * Create arraymap in kernel with 4 byte keys and 8 byte values\n\n * Load eBPF program\n\n   The eBPF program accesses the map passed in to store two pieces of\n   information. The number of invocations of the program, which maps\n   to the number of packets received, is stored to key 0. Key 1 is\n   incremented on each iteration by the number of bytes stored in\n   the skb.\n\n * Detach any eBPF program previously attached to the cgroup\n\n * Attach the new program to the cgroup using BPF_PROG_ATTACH\n\n * Once a second, read map[0] and map[1] to see how many bytes and\n   packets were seen on any socket of tasks in the given cgroup.\n\nThe program takes a cgroup path as 1st argument, and either \"ingress\"\nor \"egress\" as 2nd. Optionally, \"drop\" can be passed as 3rd argument,\nwhich will make the generated eBPF program return 0 instead of 1, so\nthe kernel will drop the packet.\n\nlibbpf gained two new wrappers for the new syscall commands.\n\nSigned-off-by: Daniel Mack <daniel@zonque.org>","distinct":true,"url":"https://api.github.com/repos/zonque/linux/commits/570be59cd9a0881a2faa295d01887e76633d5827"}]}
{"actor":{"display_login":"zonque"}}