feat: use bpf_sk_assign at tproxy_wan_ingress #383
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mzz2017
reviewed
Dec 30, 2023
mzz2017
reviewed
Dec 30, 2023
|
Thanks for your high-quality PR. |
jschwinger233
force-pushed
the
gray/sk_assign
branch
from
0b16e50
to
7604753
Compare
|
由于 main 还没合并 #386 , 我在自己的 fork 上运行了全套测试，居然全部通过了！ https://github.com/jschwinger233/dae/actions/runs/7369675519/job/20055254128?pr=5 接下来我整理一下就可以正式 review 了，最迟明天，现在要去博德之门启动了！ |
This comment was marked as off-topic.
This comment was marked as off-topic.
jschwinger233
force-pushed
the
gray/sk_assign
branch
2 times, most recently
from
f016441
to
ac3642f
Compare
|
Label ready for review. Recommend rebasing main after merging #386 to double check. |
|
IPv6 UDP 现在状态是被内核在 __udp6_lib_rcv diff --git a/control/kern/tproxy.c b/control/kern/tproxy.c
index 688fd3c..9dc71e4 100644
--- a/control/kern/tproxy.c
+++ b/control/kern/tproxy.c
@@ -1810,8 +1810,6 @@ int tproxy_wan_egress(struct __sk_buff *skb) {
// }
// }
- disable_l4_checksum(skb, link_h_len, l4proto, ihl);
-
// Redirect from egress to ingress.
if ((ret = bpf_redirect(skb->ifindex, BPF_F_INGRESS)) == TC_ACT_SHOT) {
bpf_printk("Shot bpf_redirect: %d", ret);就能修好。 但是如 PR description 里所述，由于 ci 测试是 assert failure，所以等这个合并后单独提交一个 pr，避免破坏 ci。 建议顺序： #386 -> this pr -> fix IPv6 UDP |
mzz2017
reviewed
Jan 1, 2024
As we are going to implement tproxy hijack via bpf_sk_assign, tproxy response won't reach wan iface at all, unless wan iface == lan iface. The only remaining "tproxy_response" is the place returning TC_ACT_PIPE to hand packets over from tproxy_wan_egress to tproxy_lan_egress. This commit also deletes rev-NAT logic for tproxy response. This commit tries to make a minimum change, otherwise file diff is too confusing to reviewers. I'll clean it up in the next patch.
This commit merely removes the `if (false)` branch at:
```
if (false) {
// Comments
} else {
...
}
```
The file diff becomes completely messed up, so I split it into a
separate patch without any functional change.
Note the necessity of separation of `assign_socket_tcp` and
`assign_socket_udp`:
As `struct bpf_sock *` has different verifier types for tcp and udp, the
code below can't pass verifier:
```
static __always_inline int
assign_socket(struct __sk_buff *skb, struct bpf_sock_tuple *tuple, __u32 len,
__u8 nexthdr) {
struct bpf_sock *sk;
switch (nexthdr) {
case IPPROTO_TCP:
sk = bpf_sk_lookup_tcp(skb, tuple, len, BPF_F_CURRENT_NETNS, 0);
case IPPROTO_UDP:
sk = bpf_sk_lookup_udp(skb, tuple, len, BPF_F_CURRENT_NETNS, 0);
}
if (!sk) {
return -1;
}
int res = bpf_sk_assign(skb, sk, 0);
bpf_sk_release(sk);
return res;
}
```
We no longer need tcp_dst_map for NAT. Relevant Golang logic is also removed. One thing need to mention is "dst_routing_result" struct. Although tcp_dst_map is gone, dst_routing_result struct is still in use under userspace at https://github.com/daeuniverse/dae/blob/cab1e4290967340923d7d5ca52b80f781711c18e/control/udp.go#L69C17-L69C17. Therefore, this commit remains this struct and make some efforts to ensure bpf objects are compiled with it.
Previously, wan_egress has to encap UDP packets with routing info, but it's no more necessary as we are in favor of bpf_sk_assign without NAT.
This is a must-have, otherwise packets being bpf_sk_assigned and routed to local on wan will be dropped by kernel during fib_lookup: ``` // https://github.com/torvalds/linux/blob/v6.5/net/ipv4/fib_frontend.c#L381 static int __fib_validate_source() ... if (res.type != RTN_UNICAST && (res.type != RTN_LOCAL || !IN_DEV_ACCEPT_LOCAL(idev))) goto e_inval; ... ```
jschwinger233
force-pushed
the
gray/sk_assign
branch
from
ac3642f
to
9e34149
Compare
jschwinger233
force-pushed
the
gray/sk_assign
branch
from
9e34149
to
8f96bbf
Compare
mzz2017
approved these changes
Jan 1, 2024
sumire88
approved these changes
Jan 1, 2024
|
Please feel free to merge. @jschwinger233 |
3 tasks
3 tasks
sumire88
changed the title
3 tasks
jschwinger233
added a commit
to jschwinger233/dae
that referenced
this pull request
Jan 4, 2024
With daeuniverse#383, dae no longer encap UDP, leaving this decap UDP logic obsolete. Removal of lan_egress also ends up with several helper functions unused, this commit deletes them as well. As for scenario of LAN==WAN, after this commit only wan_egress will be attached on LAN. Wan_egress therefore will pass all traffic sent from dae because pid_is_control_plane() gives true, so it looks like no concerns.
3 tasks
jschwinger233
added a commit
to jschwinger233/dae
that referenced
this pull request
Jan 22, 2024
With daeuniverse#383, dae no longer encap UDP, leaving this decap UDP logic obsolete. Removal of lan_egress also ends up with several helper functions unused, this commit deletes them as well. As for scenario of LAN==WAN, after this commit only wan_egress will be attached on LAN. Wan_egress therefore will pass all traffic sent from dae because pid_is_control_plane() gives true, so it looks like no concerns.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes: #375
废弃 tcp_dst_map，废弃 NAT 模式，全面使用 routing_tuple_map，删除兼容代码。
废弃 udp_encap, 部分解决 IPv6 UDP 的问题.
当前状态: