Attaching XDP program into wireguard interface

Attaching XDP program into wireguard interface

[Adhipati Blambangan]

Hello everyone,

I have tried to search for the same question in this mailing-list archive, but got no result.

I have wireguard connection in all of my machines running in production, and it works pretty well. Currently, we are thinking of doing some packet-classification using XDP as an early hook in the RX path.

A simple XDP program has been successfully attached to our "standard" interface. But, when I tried to attach the same XDP program to my wg0 interface, the logic in the XDP program did not kicked in. Is this something expected? if yes, is there any plan to support this use-case? I would like to help. But if not, could you guys shed me some light on what went wrong?

Thanks!

Adhipati B.

Re: Attaching XDP program into wireguard interface

[Jason A. Donenfeld]

Could you send some sample code for us to debug this with?

Re: Attaching XDP program into wireguard interface

[Jason A. Donenfeld]

Oh. Set XDP_FLAGS_SKB_MODE.

Re: Attaching XDP program into wireguard interface

[Jason A. Donenfeld]

Actually, try clearing XDP_FLAGS_DRV_MODE and XDP_FLAGS_HW_MODE.

Re: Attaching XDP program into wireguard interface

[Toke Høiland-Jørgensen]

"Jason A. Donenfeld" <Jason@zx2c4.com> writes:

> Oh. Set XDP_FLAGS_SKB_MODE.

Yeah, you'd definitely need to run this in skb/generic XDP mode.

-Toke

Re: Attaching XDP program into wireguard interface

[Jason A. Donenfeld]

On Fri, Apr 24, 2020 at 3:59 PM Toke Høiland-Jørgensen <toke@toke.dk> wrote:
>
> "Jason A. Donenfeld" <Jason@zx2c4.com> writes:
>
> > Oh. Set XDP_FLAGS_SKB_MODE.
>
> Yeah, you'd definitely need to run this in skb/generic XDP mode.
>
> -Toke

It looks like the code in question is likely:

        bpf_op = bpf_chk = ops->ndo_bpf;
       if (!bpf_op && (flags & (XDP_FLAGS_DRV_MODE | XDP_FLAGS_HW_MODE))) {
               NL_SET_ERR_MSG(extack, "underlying driver does not
support XDP in native mode");
               return -EOPNOTSUPP;
       }
       if (!bpf_op || (flags & XDP_FLAGS_SKB_MODE))
               bpf_op = generic_xdp_install;
       if (bpf_op == bpf_chk)
               bpf_chk = generic_xdp_install;

It looks like bpf_op == generic_xdp_install is the case when neither
XDP_FLAGS_DRV_MODE or XDP_FLAGS_HW_MODE is set. Setting
XDP_FLAGS_SKB_MODE explicitly will force it on all drivers, but not
specifying it will fallback to it if the driver doesn't have hardware
support, which is WireGuard's case, unless either XDP_FLAGS_DRV_MODE
or XDP_FLAGS_HW_MODE are set.

Re: Attaching XDP program into wireguard interface

[Toke Høiland-Jørgensen]

"Jason A. Donenfeld" <Jason@zx2c4.com> writes:

> On Fri, Apr 24, 2020 at 3:59 PM Toke Høiland-Jørgensen <toke@toke.dk> wrote:
>>
>> "Jason A. Donenfeld" <Jason@zx2c4.com> writes:
>>
>> > Oh. Set XDP_FLAGS_SKB_MODE.
>>
>> Yeah, you'd definitely need to run this in skb/generic XDP mode.
>>
>> -Toke
>
> It looks like the code in question is likely:
>
>         bpf_op = bpf_chk = ops->ndo_bpf;
>        if (!bpf_op && (flags & (XDP_FLAGS_DRV_MODE | XDP_FLAGS_HW_MODE))) {
>                NL_SET_ERR_MSG(extack, "underlying driver does not
> support XDP in native mode");
>                return -EOPNOTSUPP;
>        }
>        if (!bpf_op || (flags & XDP_FLAGS_SKB_MODE))
>                bpf_op = generic_xdp_install;
>        if (bpf_op == bpf_chk)
>                bpf_chk = generic_xdp_install;
>
> It looks like bpf_op == generic_xdp_install is the case when neither
> XDP_FLAGS_DRV_MODE or XDP_FLAGS_HW_MODE is set. Setting
> XDP_FLAGS_SKB_MODE explicitly will force it on all drivers, but not
> specifying it will fallback to it if the driver doesn't have hardware
> support, which is WireGuard's case, unless either XDP_FLAGS_DRV_MODE
> or XDP_FLAGS_HW_MODE are set.

Yup, that sounds right :)

-Toke