Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fd9c663

Browse files
Florian WestphalAlexei Starovoitov
Florian Westphal
authored and
Alexei Starovoitov
committed
bpf: minimal support for programs hooked into netfilter framework
This adds minimal support for BPF_PROG_TYPE_NETFILTER bpf programs that will be invoked via the NF_HOOK() points in the ip stack. Invocation incurs an indirect call. This is not a necessity: Its possible to add 'DEFINE_BPF_DISPATCHER(nf_progs)' and handle the program invocation with the same method already done for xdp progs. This isn't done here to keep the size of this chunk down. Verifier restricts verdicts to either DROP or ACCEPT. Signed-off-by: Florian Westphal <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Alexei Starovoitov <[email protected]>
1 parent 84601d6 commit fd9c663

File tree

6 files changed

+88
-1
lines changed

6 files changed

+88
-1
lines changed

‎include/linux/bpf_types.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,10 @@ BPF_PROG_TYPE(BPF_PROG_TYPE_LSM, lsm,
7979
#endif
8080
BPF_PROG_TYPE(BPF_PROG_TYPE_SYSCALL, bpf_syscall,
8181
void *, void *)
82+
#ifdef CONFIG_NETFILTER
83+
BPF_PROG_TYPE(BPF_PROG_TYPE_NETFILTER, netfilter,
84+
struct bpf_nf_ctx, struct bpf_nf_ctx)
85+
#endif
8286

8387
BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY, array_map_ops)
8488
BPF_MAP_TYPE(BPF_MAP_TYPE_PERCPU_ARRAY, percpu_array_map_ops)

‎include/net/netfilter/nf_bpf_link.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
/* SPDX-License-Identifier: GPL-2.0 */
22

3+
struct bpf_nf_ctx {
4+
const struct nf_hook_state *state;
5+
struct sk_buff *skb;
6+
};
7+
38
#if IS_ENABLED(CONFIG_NETFILTER_BPF_LINK)
49
int bpf_nf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog);
510
#else

‎kernel/bpf/btf.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@
2525
#include <linux/bsearch.h>
2626
#include <linux/kobject.h>
2727
#include <linux/sysfs.h>
28+
29+
#include <net/netfilter/nf_bpf_link.h>
30+
2831
#include <net/sock.h>
2932
#include "../tools/lib/bpf/relo_core.h"
3033

@@ -212,6 +215,7 @@ enum btf_kfunc_hook {
212215
BTF_KFUNC_HOOK_SK_SKB,
213216
BTF_KFUNC_HOOK_SOCKET_FILTER,
214217
BTF_KFUNC_HOOK_LWT,
218+
BTF_KFUNC_HOOK_NETFILTER,
215219
BTF_KFUNC_HOOK_MAX,
216220
};
217221

@@ -7802,6 +7806,8 @@ static int bpf_prog_type_to_kfunc_hook(enum bpf_prog_type prog_type)
78027806
case BPF_PROG_TYPE_LWT_XMIT:
78037807
case BPF_PROG_TYPE_LWT_SEG6LOCAL:
78047808
return BTF_KFUNC_HOOK_LWT;
7809+
case BPF_PROG_TYPE_NETFILTER:
7810+
return BTF_KFUNC_HOOK_NETFILTER;
78057811
default:
78067812
return BTF_KFUNC_HOOK_MAX;
78077813
}

‎kernel/bpf/verifier.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13816,6 +13816,9 @@ static int check_return_code(struct bpf_verifier_env *env)
1381613816
}
1381713817
break;
1381813818

13819+
case BPF_PROG_TYPE_NETFILTER:
13820+
range = tnum_range(NF_DROP, NF_ACCEPT);
13821+
break;
1381913822
case BPF_PROG_TYPE_EXT:
1382013823
/* freplace program can return anything as its return value
1382113824
* depends on the to-be-replaced kernel func or bpf program.

‎net/core/filter.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11717,6 +11717,7 @@ static int __init bpf_kfunc_init(void)
1171711717
ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_IN, &bpf_kfunc_set_skb);
1171811718
ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_XMIT, &bpf_kfunc_set_skb);
1171911719
ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_SEG6LOCAL, &bpf_kfunc_set_skb);
11720+
ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_NETFILTER, &bpf_kfunc_set_skb);
1172011721
return ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &bpf_kfunc_set_xdp);
1172111722
}
1172211723
late_initcall(bpf_kfunc_init);

‎net/netfilter/nf_bpf_link.c‎

Lines changed: 69 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
// SPDX-License-Identifier: GPL-2.0
22
#include <linux/bpf.h>
3+
#include <linux/filter.h>
34
#include <linux/netfilter.h>
45

56
#include <net/netfilter/nf_bpf_link.h>
@@ -8,7 +9,13 @@
89
static unsigned int nf_hook_run_bpf(void *bpf_prog, struct sk_buff *skb,
910
const struct nf_hook_state *s)
1011
{
11-
return NF_ACCEPT;
12+
const struct bpf_prog *prog = bpf_prog;
13+
struct bpf_nf_ctx ctx = {
14+
.state = s,
15+
.skb = skb,
16+
};
17+
18+
return bpf_prog_run(prog, &ctx);
1219
}
1320

1421
struct bpf_nf_link {
@@ -157,3 +164,64 @@ int bpf_nf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
157164

158165
return bpf_link_settle(&link_primer);
159166
}
167+
168+
const struct bpf_prog_ops netfilter_prog_ops = {
169+
};
170+
171+
static bool nf_ptr_to_btf_id(struct bpf_insn_access_aux *info, const char *name)
172+
{
173+
struct btf *btf;
174+
s32 type_id;
175+
176+
btf = bpf_get_btf_vmlinux();
177+
if (IS_ERR_OR_NULL(btf))
178+
return false;
179+
180+
type_id = btf_find_by_name_kind(btf, name, BTF_KIND_STRUCT);
181+
if (WARN_ON_ONCE(type_id < 0))
182+
return false;
183+
184+
info->btf = btf;
185+
info->btf_id = type_id;
186+
info->reg_type = PTR_TO_BTF_ID | PTR_TRUSTED;
187+
return true;
188+
}
189+
190+
static bool nf_is_valid_access(int off, int size, enum bpf_access_type type,
191+
const struct bpf_prog *prog,
192+
struct bpf_insn_access_aux *info)
193+
{
194+
if (off < 0 || off >= sizeof(struct bpf_nf_ctx))
195+
return false;
196+
197+
if (type == BPF_WRITE)
198+
return false;
199+
200+
switch (off) {
201+
case bpf_ctx_range(struct bpf_nf_ctx, skb):
202+
if (size != sizeof_field(struct bpf_nf_ctx, skb))
203+
return false;
204+
205+
return nf_ptr_to_btf_id(info, "sk_buff");
206+
case bpf_ctx_range(struct bpf_nf_ctx, state):
207+
if (size != sizeof_field(struct bpf_nf_ctx, state))
208+
return false;
209+
210+
return nf_ptr_to_btf_id(info, "nf_hook_state");
211+
default:
212+
return false;
213+
}
214+
215+
return false;
216+
}
217+
218+
static const struct bpf_func_proto *
219+
bpf_nf_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
220+
{
221+
return bpf_base_func_proto(func_id);
222+
}
223+
224+
const struct bpf_verifier_ops netfilter_verifier_ops = {
225+
.is_valid_access = nf_is_valid_access,
226+
.get_func_proto = bpf_nf_func_proto,
227+
};

0 commit comments

Comments
 (0)