Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: use bpf_sk_assign at tproxy_wan_ingress #383

Merged
merged 8 commits into from
Jan 1, 2024
Merged

feat: use bpf_sk_assign at tproxy_wan_ingress #383

merged 8 commits into from
Jan 1, 2024

Commits on Jan 1, 2024

  1. bpf: Remove most occurance of "tproxy_response" 

    As we are going to implement tproxy hijack via bpf_sk_assign, tproxy
response won't reach wan iface at all, unless wan iface == lan iface.

The only remaining "tproxy_response" is the place returning TC_ACT_PIPE
to hand packets over from tproxy_wan_egress to tproxy_lan_egress.

This commit also deletes rev-NAT logic for tproxy response.

This commit tries to make a minimum change, otherwise file diff is
too confusing to reviewers. I'll clean it up in the next patch.
    @jschwinger233
    jschwinger233 committed Jan 1, 2024
    Configuration menu
    Copy the full SHA
    19a88c6 View commit details
    Browse the repository at this point in the history

  2. bpf: Clean up tproxy_response condition branch 

    This commit merely removes the `if (false)` branch at:

```
if (false) {
  // Comments
} else {
  ...
}
```

The file diff becomes completely messed up, so I split it into a
separate patch without any functional change.
    @jschwinger233
    jschwinger233 committed Jan 1, 2024
    Configuration menu
    Copy the full SHA
    751475d View commit details
    Browse the repository at this point in the history

  3. bpf: Replace NAT by bpf_sk_assign 

    Note the necessity of separation of `assign_socket_tcp` and
`assign_socket_udp`:

As `struct bpf_sock *` has different verifier types for tcp and udp, the
code below can't pass verifier:

```
static __always_inline int
assign_socket(struct __sk_buff *skb, struct bpf_sock_tuple *tuple, __u32 len,
	      __u8 nexthdr) {
	struct bpf_sock *sk;
	switch (nexthdr) {
	case IPPROTO_TCP:
		sk = bpf_sk_lookup_tcp(skb, tuple, len, BPF_F_CURRENT_NETNS, 0);
	case IPPROTO_UDP:
		sk = bpf_sk_lookup_udp(skb, tuple, len, BPF_F_CURRENT_NETNS, 0);
	}
	if (!sk) {
		return -1;
	}

	int res = bpf_sk_assign(skb, sk, 0);
	bpf_sk_release(sk);
	return res;
}
```
    @jschwinger233
    jschwinger233 committed Jan 1, 2024
    Configuration menu
    Copy the full SHA
    bb7afd6 View commit details
    Browse the repository at this point in the history

  4. bpf: Remove tcp_dst_map and references 

    We no longer need tcp_dst_map for NAT. Relevant Golang logic is also
removed.

One thing need to mention is "dst_routing_result" struct. Although
tcp_dst_map is gone, dst_routing_result struct is still in use under
userspace at https://github.com/daeuniverse/dae/blob/cab1e4290967340923d7d5ca52b80f781711c18e/control/udp.go#L69C17-L69C17.
Therefore, this commit remains this struct and make some efforts to
ensure bpf objects are compiled with it.
    @jschwinger233
    jschwinger233 committed Jan 1, 2024
    Configuration menu
    Copy the full SHA
    30c1424 View commit details
    Browse the repository at this point in the history

  5. bpf: Support IPv6 for bpf_sk_assign

    @jschwinger233
    jschwinger233 committed Jan 1, 2024
    Configuration menu
    Copy the full SHA
    6caa693 View commit details
    Browse the repository at this point in the history

  6. bpf: Don't encap UDP on wan_egress 

    Previously, wan_egress has to encap UDP packets with routing info, but
it's no more necessary as we are in favor of bpf_sk_assign without NAT.
    @jschwinger233
    jschwinger233 committed Jan 1, 2024
    Configuration menu
    Copy the full SHA
    efdb886 View commit details
    Browse the repository at this point in the history

  7. sysctl net.ipv4.conf.$wan.accept_local=1 

    This is a must-have, otherwise packets being bpf_sk_assigned and routed
to local on wan will be dropped by kernel during fib_lookup:

```
// https://github.com/torvalds/linux/blob/v6.5/net/ipv4/fib_frontend.c#L381
static int __fib_validate_source()
...
	if (res.type != RTN_UNICAST &&
	    (res.type != RTN_LOCAL || !IN_DEV_ACCEPT_LOCAL(idev)))
		goto e_inval;
...
```
    @jschwinger233
    jschwinger233 committed Jan 1, 2024
    Configuration menu
    Copy the full SHA
    0d13bca View commit details
    Browse the repository at this point in the history

  8. ci: enable auto_config_kernel_parameter for kernel test

    @jschwinger233
    jschwinger233 committed Jan 1, 2024
    Configuration menu
    Copy the full SHA
    8f96bbf View commit details
    Browse the repository at this point in the history