a74712241b
This commit adds a sample selftest to demonstrate how we can use
bpf_sk_assign_tcp_reqsk() as the backend of SYN Proxy.
The test creates IPv4/IPv6 x TCP connections and transfer messages
over them on lo with BPF tc prog attached.
The tc prog will process SYN and returns SYN+ACK with the following
ISN and TS. In a real use case, this part will be done by other
hosts.
MSB LSB
ISN: | 31 ... 8 | 7 6 | 5 | 4 | 3 2 1 0 |
| Hash_1 | MSS | ECN | SACK | WScale |
TS: | 31 ... 8 | 7 ... 0 |
| Random | Hash_2 |
WScale in SYN is reused in SYN+ACK.
The client returns ACK, and tc prog will recalculate ISN and TS
from ACK and validate SYN Cookie.
If it's valid, the prog calls kfunc to allocate a reqsk for skb and
configure the reqsk based on the argument created from SYN Cookie.
Later, the reqsk will be processed in cookie_v[46]_check() to create
a connection.
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20240115205514.68364-7-kuniyu@amazon.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
91 lines
1.9 KiB
Plaintext
91 lines
1.9 KiB
Plaintext
CONFIG_BLK_DEV_LOOP=y
|
|
CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
|
|
CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
|
|
CONFIG_BPF=y
|
|
CONFIG_BPF_EVENTS=y
|
|
CONFIG_BPF_JIT=y
|
|
CONFIG_BPF_KPROBE_OVERRIDE=y
|
|
CONFIG_BPF_LIRC_MODE2=y
|
|
CONFIG_BPF_LSM=y
|
|
CONFIG_BPF_STREAM_PARSER=y
|
|
CONFIG_BPF_SYSCALL=y
|
|
# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set
|
|
CONFIG_CGROUP_BPF=y
|
|
CONFIG_CRYPTO_HMAC=y
|
|
CONFIG_CRYPTO_SHA256=y
|
|
CONFIG_CRYPTO_USER_API_HASH=y
|
|
CONFIG_DEBUG_INFO=y
|
|
CONFIG_DEBUG_INFO_BTF=y
|
|
CONFIG_DEBUG_INFO_DWARF4=y
|
|
CONFIG_DUMMY=y
|
|
CONFIG_DYNAMIC_FTRACE=y
|
|
CONFIG_FPROBE=y
|
|
CONFIG_FTRACE_SYSCALLS=y
|
|
CONFIG_FUNCTION_ERROR_INJECTION=y
|
|
CONFIG_FUNCTION_TRACER=y
|
|
CONFIG_FS_VERITY=y
|
|
CONFIG_GENEVE=y
|
|
CONFIG_IKCONFIG=y
|
|
CONFIG_IKCONFIG_PROC=y
|
|
CONFIG_IMA=y
|
|
CONFIG_IMA_READ_POLICY=y
|
|
CONFIG_IMA_WRITE_POLICY=y
|
|
CONFIG_INET_ESP=y
|
|
CONFIG_IP_NF_FILTER=y
|
|
CONFIG_IP_NF_RAW=y
|
|
CONFIG_IP_NF_TARGET_SYNPROXY=y
|
|
CONFIG_IPV6=y
|
|
CONFIG_IPV6_FOU=y
|
|
CONFIG_IPV6_FOU_TUNNEL=y
|
|
CONFIG_IPV6_GRE=y
|
|
CONFIG_IPV6_SEG6_BPF=y
|
|
CONFIG_IPV6_SIT=y
|
|
CONFIG_IPV6_TUNNEL=y
|
|
CONFIG_KEYS=y
|
|
CONFIG_LIRC=y
|
|
CONFIG_LWTUNNEL=y
|
|
CONFIG_MODULE_SIG=y
|
|
CONFIG_MODULE_SRCVERSION_ALL=y
|
|
CONFIG_MODULE_UNLOAD=y
|
|
CONFIG_MODULES=y
|
|
CONFIG_MODVERSIONS=y
|
|
CONFIG_MPLS=y
|
|
CONFIG_MPLS_IPTUNNEL=y
|
|
CONFIG_MPLS_ROUTING=y
|
|
CONFIG_MPTCP=y
|
|
CONFIG_NET_CLS_ACT=y
|
|
CONFIG_NET_CLS_BPF=y
|
|
CONFIG_NET_CLS_FLOWER=y
|
|
CONFIG_NET_FOU=y
|
|
CONFIG_NET_FOU_IP_TUNNELS=y
|
|
CONFIG_NET_IPGRE=y
|
|
CONFIG_NET_IPGRE_DEMUX=y
|
|
CONFIG_NET_IPIP=y
|
|
CONFIG_NET_MPLS_GSO=y
|
|
CONFIG_NET_SCH_FQ=y
|
|
CONFIG_NET_SCH_INGRESS=y
|
|
CONFIG_NET_SCHED=y
|
|
CONFIG_NETDEVSIM=y
|
|
CONFIG_NETFILTER=y
|
|
CONFIG_NETFILTER_ADVANCED=y
|
|
CONFIG_NETFILTER_SYNPROXY=y
|
|
CONFIG_NETFILTER_XT_CONNMARK=y
|
|
CONFIG_NETFILTER_XT_MATCH_STATE=y
|
|
CONFIG_NETFILTER_XT_TARGET_CT=y
|
|
CONFIG_NETKIT=y
|
|
CONFIG_NF_CONNTRACK=y
|
|
CONFIG_NF_CONNTRACK_MARK=y
|
|
CONFIG_NF_DEFRAG_IPV4=y
|
|
CONFIG_NF_DEFRAG_IPV6=y
|
|
CONFIG_NF_NAT=y
|
|
CONFIG_RC_CORE=y
|
|
CONFIG_SECURITY=y
|
|
CONFIG_SECURITYFS=y
|
|
CONFIG_SYN_COOKIES=y
|
|
CONFIG_TEST_BPF=m
|
|
CONFIG_USERFAULTFD=y
|
|
CONFIG_VSOCKETS=y
|
|
CONFIG_VXLAN=y
|
|
CONFIG_XDP_SOCKETS=y
|
|
CONFIG_XFRM_INTERFACE=y
|