Skip to content

Commit ffd7e89

Browse files
pravk03pravk03
committed
datapath: template network namespace cookie.
Since the bpf helper function bpf_get_netns_cookie() is not exposed to the TC BPF programs, we would need to use ELF substitutions to make the network namespace cookie of an endpoint available to the BPF program attached. In a subsequent patch, we would use this in TC BPF program to detect LRP loopback.
1 parent c0ad441 commit ffd7e89

9 files changed

Lines changed: 65 additions & 13 deletions

File tree

‎bpf/ep_config.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@ DEFINE_U32(POLICY_VERDICT_LOG_FILTER, 0xffff);
3737
DEFINE_U32(THIS_INTERFACE_IFINDEX, 0);
3838
#define THIS_INTERFACE_IFINDEX fetch_u32(THIS_INTERFACE_IFINDEX)
3939

40+
DEFINE_U64(ENDPOINT_NETNS_COOKIE, 0);
41+
#define ENDPOINT_NETNS_COOKIE fetch_u64(ENDPOINT_NETNS_COOKIE)
42+
4043
#define HOST_EP_ID 0x1092
4144

4245
#define POLICY_MAP test_cilium_policy_65535

‎bpf/lib/static_data.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@
7878
/* Deprecated, use CONFIG instead. */
7979
#define fetch_u16(x) CONFIG(x)
8080
#define fetch_u32(x) CONFIG(x)
81+
#define fetch_u64(x) CONFIG(x)
8182
#define fetch_ipv6(x) CONFIG(x ## _1), CONFIG(x ## _2)
8283
#define fetch_mac(x) { { CONFIG(x ## _1), (__u16)CONFIG(x ## _2) } }
8384

@@ -88,6 +89,9 @@
8889
#define DEFINE_U32(name, value) \
8990
DECLARE_CONFIG(__u32, name, "Constant " #name " declared using DEFINE_U32") \
9091
ASSIGN_CONFIG(__u32, name, value)
92+
#define DEFINE_U64(name, value) \
93+
DECLARE_CONFIG(__u64, name, "Constant " #name " declared using DEFINE_U64") \
94+
ASSIGN_CONFIG(__u64, name, value)
9195

9296
/* DEFINE_IPV6 and DEFINE_MAC are used to assign values to global constants from
9397
* C headers generated at runtime before the datapath is compiled. This data

‎pkg/datapath/linux/config/config.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1023,6 +1023,7 @@ func (h *HeaderfileWriter) writeStaticData(devices []string, fw io.Writer, e dat
10231023

10241024
fmt.Fprint(fw, defineMAC("THIS_INTERFACE_MAC", e.GetNodeMAC()))
10251025
fmt.Fprint(fw, defineUint32("THIS_INTERFACE_IFINDEX", uint32(e.GetIfIndex())))
1026+
fmt.Fprint(fw, defineUint64("ENDPOINT_NETNS_COOKIE", uint64(e.GetEndpointNetnsCookieLocked())))
10261027

10271028
secID := e.GetIdentityLocked().Uint32()
10281029
fmt.Fprint(fw, defineUint32("SECLABEL", secID))

‎pkg/datapath/linux/config/utils.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,12 @@ func defineUint32(name string, value uint32) string {
3030
name, value, value, name, name)
3131
}
3232

33+
// defineUint64 writes the C definition for an unsigned 64-bit value.
34+
func defineUint64(name string, value uint64) string {
35+
return fmt.Sprintf("DEFINE_U64(%s, %#016x);\t/* %d */\n#define %s fetch_u64(%s)\n",
36+
name, value, value, name, name)
37+
}
38+
3339
// defineIPv4 writes the C definition for the given IPv4 address.
3440
func defineIPv4(name string, addr []byte) string {
3541
if len(addr) != net.IPv4len {

‎pkg/datapath/loader/template.go‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ const (
2828
templateLxcID = uint16(65535)
2929
templatePolicyVerdictFilter = uint32(0xffff)
3030
templateIfIndex = math.MaxUint32
31+
templateEndpointNetNsCookie = uint64(0)
3132
)
3233

3334
var (
@@ -101,6 +102,18 @@ func (t *templateCfg) GetIdentityLocked() identity.NumericIdentity {
101102
return templateSecurityID
102103
}
103104

105+
// GetEndpointNetnsCookie returns a invalid (zero) network namespace cookie.
106+
func (t *templateCfg) GetEndpointNetnsCookie() uint64 {
107+
return templateEndpointNetNsCookie
108+
}
109+
110+
// GetEndpointNetnsCookieLocked is identical to GetEndpointNetnsCookie(). This is a temporary
111+
// function until WriteEndpointConfig() no longer assumes that the endpoint is
112+
// locked.
113+
func (t *templateCfg) GetEndpointNetnsCookieLocked() uint64 {
114+
return templateEndpointNetNsCookie
115+
}
116+
104117
// GetNodeMAC returns a well-known dummy MAC address which may be later
105118
// substituted in the ELF.
106119
func (t *templateCfg) GetNodeMAC() mac.MAC {
@@ -262,6 +275,8 @@ func ELFVariableSubstitutions(ep datapath.Endpoint) map[string]uint64 {
262275
result["IPV6_MASQUERADE_2"] = 0
263276
}
264277

278+
result["ENDPOINT_NETNS_COOKIE"] = ep.GetEndpointNetnsCookie()
279+
265280
identity := ep.GetIdentity().Uint32()
266281
result["SECLABEL"] = uint64(identity)
267282
result["SECLABEL_IPV4"] = uint64(identity)

‎pkg/datapath/types/config.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ type LoadTimeConfiguration interface {
4949
IPv6Address() netip.Addr
5050
GetNodeMAC() mac.MAC
5151
GetIfIndex() int
52+
GetEndpointNetnsCookie() uint64
53+
GetEndpointNetnsCookieLocked() uint64
5254
}
5355

5456
// CompileTimeConfiguration provides datapath implementations a clean interface

‎pkg/endpoint/cache.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ type epInfoCache struct {
4242
options *option.IntOptions
4343
lxcMAC mac.MAC
4444
ifIndex int
45+
netNsCookie uint64
4546

4647
// endpoint is used to get the endpoint's logger.
4748
//
@@ -73,6 +74,7 @@ func (e *Endpoint) createEpInfoCache(epdir string) *epInfoCache {
7374
options: e.Options.DeepCopy(),
7475
lxcMAC: e.mac,
7576
ifIndex: e.ifIndex,
77+
netNsCookie: e.NetNsCookie,
7678

7779
endpoint: e,
7880
}
@@ -113,6 +115,16 @@ func (ep *epInfoCache) GetIdentityLocked() identity.NumericIdentity {
113115
return ep.identity
114116
}
115117

118+
// GetEndpointNetnsCookie returns the network namespace cookie for the endpoint
119+
func (ep *epInfoCache) GetEndpointNetnsCookie() uint64 {
120+
return ep.netNsCookie
121+
}
122+
123+
// GetEndpointNetnsCookieLocked returns the network namespace cookie for the endpoint
124+
func (ep *epInfoCache) GetEndpointNetnsCookieLocked() uint64 {
125+
return ep.netNsCookie
126+
}
127+
116128
// Logger returns the logger for the endpoint that is being cached.
117129
func (ep *epInfoCache) Logger(subsystem string) *logrus.Entry {
118130
return ep.endpoint.Logger(subsystem)

‎pkg/endpoint/identifiers.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,3 +168,8 @@ func (e *Endpoint) GetEndpointNetnsCookie() uint64 {
168168
defer e.runlock()
169169
return e.NetNsCookie
170170
}
171+
172+
// GetEndpointNetnsCookieLocked is identical to GetEndpointNetnsCookie(). This is needed because WriteEndpointConfig() assumes that the endpoint is locked.
173+
func (e *Endpoint) GetEndpointNetnsCookieLocked() uint64 {
174+
return e.NetNsCookie
175+
}

‎pkg/testutils/endpoint.go‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -20,25 +20,27 @@ var (
2020
)
2121

2222
type TestEndpoint struct {
23-
Id uint64
24-
Identity *identity.Identity
25-
Opts *option.IntOptions
26-
MAC mac.MAC
27-
IfIndex int
28-
IPv6 netip.Addr
29-
isHost bool
30-
State string
23+
Id uint64
24+
Identity *identity.Identity
25+
Opts *option.IntOptions
26+
MAC mac.MAC
27+
IfIndex int
28+
IPv6 netip.Addr
29+
isHost bool
30+
State string
31+
NetNsCookie uint64
3132
}
3233

3334
func NewTestEndpoint() TestEndpoint {
3435
opts := option.NewIntOptions(&option.OptionLibrary{})
3536
opts.SetBool("TEST_OPTION", true)
3637
return TestEndpoint{
37-
Id: 42,
38-
Identity: defaultIdentity,
39-
MAC: mac.MAC([]byte{0x02, 0x00, 0x60, 0x0D, 0xF0, 0x0D}),
40-
IfIndex: 0,
41-
Opts: opts,
38+
Id: 42,
39+
Identity: defaultIdentity,
40+
MAC: mac.MAC([]byte{0x02, 0x00, 0x60, 0x0D, 0xF0, 0x0D}),
41+
IfIndex: 0,
42+
Opts: opts,
43+
NetNsCookie: 0,
4244
}
4345
}
4446

@@ -66,6 +68,8 @@ func (e *TestEndpoint) GetID() uint64 { return e.I
6668
func (e *TestEndpoint) StringID() string { return "42" }
6769
func (e *TestEndpoint) GetIdentity() identity.NumericIdentity { return e.Identity.ID }
6870
func (e *TestEndpoint) GetIdentityLocked() identity.NumericIdentity { return e.Identity.ID }
71+
func (e *TestEndpoint) GetEndpointNetnsCookie() uint64 { return e.NetNsCookie }
72+
func (e *TestEndpoint) GetEndpointNetnsCookieLocked() uint64 { return e.NetNsCookie }
6973
func (e *TestEndpoint) GetSecurityIdentity() *identity.Identity { return e.Identity }
7074
func (e *TestEndpoint) GetNodeMAC() mac.MAC { return e.MAC }
7175
func (e *TestEndpoint) GetIfIndex() int { return e.IfIndex }

0 commit comments

Comments
 (0)