Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9290d742 authored by Daniel Mack's avatar Daniel Mack Committed by Chenbo Feng
Browse files

UPSTREAM: net: ipv4, ipv6: run cgroup eBPF egress programs 



Cherry-pick from commit 33b486793cb31311f3a91ae4fe4be5926e7677b0

If the cgroup associated with the receiving socket has an eBPF
programs installed, run them from ip_output(), ip6_output() and
ip_mc_output(). From mentioned functions we have two socket contexts
as per 7026b1dd ("netfilter: Pass socket pointer down through
okfn()."). We explicitly need to use sk instead of skb->sk here,
since otherwise the same program would run multiple times on egress
when encap devices are involved, which is not desired in our case.

eBPF programs used in this context are expected to either return 1 to
let the packet pass, or != 1 to drop them. The programs have access to
the skb through bpf_skb_load_bytes(), and the payload starts at the
network headers (L3).

Note that cgroup_bpf_run_filter() is stubbed out as static inline nop
for !CONFIG_CGROUP_BPF, and is otherwise guarded by a static key if
the feature is unused.

Signed-off-by: default avatarDaniel Mack <daniel@zonque.org>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Bug: 30950746
Change-Id: Ib6928205f098548b7a69d0e6d878fc8ed0242e8e
parent 719a297a

net/ipv4/ip_output.c

+24 −2
Original line number Diff line number Diff line
@@ -74,6 +74,7 @@ 
#include <net/checksum.h>

#include <net/inetpeer.h>

#include <net/lwtunnel.h>

#include <linux/bpf-cgroup.h>

#include <linux/igmp.h>

#include <linux/netfilter_ipv4.h>

#include <linux/netfilter_bridge.h>
@@ -287,6 +288,13 @@ static int ip_finish_output_gso(struct net *net, struct sock *sk, 
static int ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)

{

	unsigned int mtu;

	int ret;



	ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);

	if (ret) {

		kfree_skb(skb);

		return ret;

	}



#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)

	/* Policy lookup after SNAT yielded a new policy */
@@ -305,6 +313,20 @@ static int ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *sk 
	return ip_finish_output2(net, sk, skb);

}



static int ip_mc_finish_output(struct net *net, struct sock *sk,

			       struct sk_buff *skb)

{

	int ret;



	ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);

	if (ret) {

		kfree_skb(skb);

		return ret;

	}



	return dev_loopback_xmit(net, sk, skb);

}



int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb)

{

	struct rtable *rt = skb_rtable(skb);
@@ -342,7 +364,7 @@ int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb) 
			if (newskb)

				NF_HOOK(NFPROTO_IPV4, NF_INET_POST_ROUTING,

					net, sk, newskb, NULL, newskb->dev,

					dev_loopback_xmit);

					ip_mc_finish_output);

		}



		/* Multicasts with ttl 0 must not go beyond the host */
@@ -358,7 +380,7 @@ int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb) 
		if (newskb)

			NF_HOOK(NFPROTO_IPV4, NF_INET_POST_ROUTING,

				net, sk, newskb, NULL, newskb->dev,

				dev_loopback_xmit);

				ip_mc_finish_output);

	}



	return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,

net/ipv6/ip6_output.c

+9 −0
Original line number Diff line number Diff line
@@ -39,6 +39,7 @@ 
#include <linux/module.h>

#include <linux/slab.h>



#include <linux/bpf-cgroup.h>

#include <linux/netfilter.h>

#include <linux/netfilter_ipv6.h>
@@ -131,6 +132,14 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * 


static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)

{

	int ret;



	ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);

	if (ret) {

		kfree_skb(skb);

		return ret;

	}



	if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||

	    dst_allfrag(skb_dst(skb)) ||

	    (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))