On Fri, Nov 3, 2017 at 5:56 PM, Willem de Bruijn
<willemdebruijn.kernel@xxxxxxxxx> wrote:
On Tue, Oct 31, 2017 at 7:32 PM, Jason Wang <jasowang@xxxxxxxxxx> wrote:Unless the idea is for the hypervisor to prepared the BPF based on a
This patch introduces an eBPF based queue selection method based onIf the idea is to allow guests to pass BPF programs down to the host,
the flow steering policy ops. Userspace could load an eBPF program
through TUNSETSTEERINGEBPF. This gives much more flexibility compare
to simple but hard coded policy in kernel.
Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx>
---
+static int tun_set_steering_ebpf(struct tun_struct *tun, void __user *data)
+{
+ struct bpf_prog *prog;
+ u32 fd;
+
+ if (copy_from_user(&fd, data, sizeof(fd)))
+ return -EFAULT;
+
+ prog = bpf_prog_get_type(fd, BPF_PROG_TYPE_SOCKET_FILTER);
you may want to define a new program type that is more restrictive than
socket filter.
The external functions allowed for socket filters (sk_filter_func_proto)
are relatively few (compared to, say, clsact), but may still leak host
information to a guest. More importantly, guest security considerations
limits how we can extend socket filters later.
limited set of well defined modes that the guest can configure. Then
socket filters are fine, as the BPF is prepared by a regular host process.