x/net/{ipv4,ipv6}: support attaching BPF socket filters to sockets.

[danderson]

Linux supports attaching packet filters to sockets. This turns out to be very important for IPConns of popular protocols like TCP or UDP, otherwise the kernel will helpfully give you ~all traffic the machine is involved in through a small kernel-userspace straw.

The API is to call setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER) with a BPF program struct. The struct is already defined by x/sys/unix, but needs an appropriate Setsockopt wrapper that accepts that struct. Then, x/net/ipv4's PacketConn and RawConn should get methods plumbed through, so that you can use net and x/net/ipv4 types exclusively to set packet filters, without having to touch raw FDs and syscalls directly.

I have most of the code for this already in a different repository, which I'm going to put together into a code review - filing this for tracking, and of course to ask if this sounds like a reasonable addition.

[gopherbot]

CL https://golang.org/cl/21176 mentions this issue.

[mikioh]

I'm not keen on exposing SetsockBlahBlah API because it makes people who have no interest in networking stuff confuse and complain. At present, x/sys/unix package has no capability to work together with runtime-integrated network poller and it doesn't appear to come up soon. That's the reason why x/net/{icmp,ipv4,ipv6} packages never use x/sys/unix and I dropped BPF/netlink/routing socket APIs from x/sys/unix package.

A few random thoughts on your plan:

• Adding new APIs for injecting BPF/eBPF programs into x/net/{ipv4,ipv6} packages sounds fine
• Can we have a new package that provides eBPF/BPF program marshaler?
  • At first it simply provides platform-agnostic BPF/eBPF op. code/data marshaling
  • We will be able to add platform-independent link-layer snoop and filter APIs later
• It would be a help not only for x/net/{ipv4,ipv6} but for making ARP/LLDP/etc packages using AF_PACKET socket or BPF/eBPF file

What do you think?

[danderson]

Ack on not changing x/sys/unix, I'll revert the change I sent out for that. I originally thought that x/net used x/sys for syscalls, before going to plug my code into x/net and discovering that it imports its own godefs.

Adding x/net/bpf sounds like a good idea, although it'll take me a bit more time to build an API for that - my current code just uses slices of tcpdump -dd output, which is obviously not great :).

I also already have some code to set up an AF_PACKET socket with filtering, if that would be of interest, although it does not have any netpoller integration since (afaik) there's currently no way to get a netpoller-friendly AF_PACKET socket out of the net package.

[gopherbot]

CL https://golang.org/cl/23105 mentions this issue.

[gopherbot]

CL https://golang.org/cl/23107 mentions this issue.