bpf: add bpf_skb_adjust_room flag BPF_F_ADJ_ROOM_FIXED_GSO

bpf_skb_adjust_room adjusts gso_size of gso packets to account for the
pushed or popped header room.

This is not allowed with UDP, where gso_size delineates datagrams. Add
an option to avoid these updates and allow this call for datagrams.

It can also be used with TCP, when MSS is known to allow headroom,
e.g., through MSS clamping or route MTU.

Changes v1->v2:
  - document flag BPF_F_ADJ_ROOM_FIXED_GSO
  - do not expose BPF_F_ADJ_ROOM_MASK through uapi, as it may change.

Link: https://patchwork.ozlabs.org/patch/1052497/
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 7c8fd0647070a25d1dadccf26eb5623875e675f7..4f157d0ec57140343db91ef808fe8e7c0c38cffb 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1486,8 +1486,10 @@ union bpf_attr {
  *             * **BPF_ADJ_ROOM_NET**: Adjust room at the network layer
  *               (room space is added or removed below the layer 3 header).
  *
- *             All values for *flags* are reserved for future usage, and must
- *             be left at zero.
+ *             There is one supported flag at this time:
+ *
+ *             * **BPF_F_ADJ_ROOM_FIXED_GSO**: Do not adjust gso_size.
+ *               Adjusting mss in this way is not allowed for datagrams.
  *
  *             A call to this helper is susceptible to change the underlaying
  *             packet buffer. Therefore, at load time, all checks on pointers
@@ -2627,6 +2629,9 @@ enum bpf_func_id {
 /* Current network namespace */
 #define BPF_F_CURRENT_NETNS            (-1L)
 
+/* BPF_FUNC_skb_adjust_room flags. */
+#define BPF_F_ADJ_ROOM_FIXED_GSO       (1ULL << 0)
+
 /* Mode for BPF_FUNC_skb_adjust_room helper. */
 enum bpf_adj_room_mode {
        BPF_ADJ_ROOM_NET,

diff --git a/net/core/filter.c b/net/core/filter.c
index e7b7720b18e94bf7d01ec32d2a78ee26da44292c..d3240a0a0eeb331e4ee4f93327e7636a4ba774be 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2963,12 +2963,19 @@ static u32 bpf_skb_net_base_len(const struct sk_buff *skb)
        }
 }
 
-static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff)
+#define BPF_F_ADJ_ROOM_MASK            (BPF_F_ADJ_ROOM_FIXED_GSO)
+
+static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
+                           u64 flags)
 {
        int ret;
 
-       if (skb_is_gso(skb) && !skb_is_gso_tcp(skb))
-               return -ENOTSUPP;
+       if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) {
+               /* udp gso_size delineates datagrams, only allow if fixed */
+               if (!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4) ||
+                   !(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
+                       return -ENOTSUPP;
+       }
 
        ret = skb_cow_head(skb, len_diff);
        if (unlikely(ret < 0))
@@ -2982,7 +2989,9 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff)
                struct skb_shared_info *shinfo = skb_shinfo(skb);
 
                /* Due to header grow, MSS needs to be downgraded. */
-               skb_decrease_gso_size(shinfo, len_diff);
+               if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
+                       skb_decrease_gso_size(shinfo, len_diff);
+
                /* Header must be checked, and gso_segs recomputed. */
                shinfo->gso_type |= SKB_GSO_DODGY;
                shinfo->gso_segs = 0;
@@ -2991,12 +3000,17 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff)
        return 0;
 }
 
-static int bpf_skb_net_shrink(struct sk_buff *skb, u32 off, u32 len_diff)
+static int bpf_skb_net_shrink(struct sk_buff *skb, u32 off, u32 len_diff,
+                             u64 flags)
 {
        int ret;
 
-       if (skb_is_gso(skb) && !skb_is_gso_tcp(skb))
-               return -ENOTSUPP;
+       if (skb_is_gso(skb) && !skb_is_gso_tcp(skb)) {
+               /* udp gso_size delineates datagrams, only allow if fixed */
+               if (!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4) ||
+                   !(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
+                       return -ENOTSUPP;
+       }
 
        ret = skb_unclone(skb, GFP_ATOMIC);
        if (unlikely(ret < 0))
@@ -3010,7 +3024,9 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 off, u32 len_diff)
                struct skb_shared_info *shinfo = skb_shinfo(skb);
 
                /* Due to header shrink, MSS can be upgraded. */
-               skb_increase_gso_size(shinfo, len_diff);
+               if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
+                       skb_increase_gso_size(shinfo, len_diff);
+
                /* Header must be checked, and gso_segs recomputed. */
                shinfo->gso_type |= SKB_GSO_DODGY;
                shinfo->gso_segs = 0;
@@ -3037,7 +3053,7 @@ BPF_CALL_4(bpf_skb_adjust_room, struct sk_buff *, skb, s32, len_diff,
        u32 off;
        int ret;
 
-       if (unlikely(flags))
+       if (unlikely(flags & ~BPF_F_ADJ_ROOM_MASK))
                return -EINVAL;
        if (unlikely(len_diff_abs > 0xfffU))
                return -EFAULT;
@@ -3065,8 +3081,8 @@ BPF_CALL_4(bpf_skb_adjust_room, struct sk_buff *, skb, s32, len_diff,
                         !skb_is_gso(skb))))
                return -ENOTSUPP;
 
-       ret = shrink ? bpf_skb_net_shrink(skb, off, len_diff_abs) :
-                      bpf_skb_net_grow(skb, off, len_diff_abs);
+       ret = shrink ? bpf_skb_net_shrink(skb, off, len_diff_abs, flags) :
+                      bpf_skb_net_grow(skb, off, len_diff_abs, flags);
 
        bpf_compute_data_pointers(skb);
        return ret;