Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c16d603 authored by Willem de Bruijn's avatar Willem de Bruijn Committed by Pablo Neira Ayuso
Browse files

netfilter: xt_bpf: support ebpf 



Add support for attaching an eBPF object by file descriptor.

The iptables binary can be called with a path to an elf object or a
pinned bpf object. Also pass the mode and path to the kernel to be
able to return it later for iptables dump and save.

Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 5bad8734

include/uapi/linux/netfilter/xt_bpf.h

+21 −0
Original line number Diff line number Diff line
@@ -2,9 +2,11 @@ 
#define _XT_BPF_H



#include <linux/filter.h>

#include <linux/limits.h>

#include <linux/types.h>



#define XT_BPF_MAX_NUM_INSTR	64

#define XT_BPF_PATH_MAX		(XT_BPF_MAX_NUM_INSTR * sizeof(struct sock_filter))



struct bpf_prog;
@@ -16,4 +18,23 @@ struct xt_bpf_info { 
	struct bpf_prog *filter __attribute__((aligned(8)));

};



enum xt_bpf_modes {

	XT_BPF_MODE_BYTECODE,

	XT_BPF_MODE_FD_PINNED,

	XT_BPF_MODE_FD_ELF,

};



struct xt_bpf_info_v1 {

	__u16 mode;

	__u16 bpf_program_num_elem;

	__s32 fd;

	union {

		struct sock_filter bpf_program[XT_BPF_MAX_NUM_INSTR];

		char path[XT_BPF_PATH_MAX];

	};



	/* only used in the kernel */

	struct bpf_prog *filter __attribute__((aligned(8)));

};



#endif /*_XT_BPF_H */

net/netfilter/xt_bpf.c

+80 −16
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
#include <linux/module.h>

#include <linux/skbuff.h>

#include <linux/filter.h>

#include <linux/bpf.h>



#include <linux/netfilter/xt_bpf.h>

#include <linux/netfilter/x_tables.h>
@@ -20,15 +21,15 @@ MODULE_LICENSE("GPL"); 
MODULE_ALIAS("ipt_bpf");

MODULE_ALIAS("ip6t_bpf");



static int bpf_mt_check(const struct xt_mtchk_param *par)

static int __bpf_mt_check_bytecode(struct sock_filter *insns, __u16 len,

				   struct bpf_prog **ret)

{

	struct xt_bpf_info *info = par->matchinfo;

	struct sock_fprog_kern program;



	program.len = info->bpf_program_num_elem;

	program.filter = info->bpf_program;

	program.len = len;

	program.filter = insns;



	if (bpf_prog_create(&info->filter, &program)) {

	if (bpf_prog_create(ret, &program)) {

		pr_info("bpf: check failed: parse error\n");

		return -EINVAL;

	}
@@ -36,6 +37,42 @@ static int bpf_mt_check(const struct xt_mtchk_param *par) 
	return 0;

}



static int __bpf_mt_check_fd(int fd, struct bpf_prog **ret)

{

	struct bpf_prog *prog;



	prog = bpf_prog_get_type(fd, BPF_PROG_TYPE_SOCKET_FILTER);

	if (IS_ERR(prog))

		return PTR_ERR(prog);



	*ret = prog;

	return 0;

}



static int bpf_mt_check(const struct xt_mtchk_param *par)

{

	struct xt_bpf_info *info = par->matchinfo;



	return __bpf_mt_check_bytecode(info->bpf_program,

				       info->bpf_program_num_elem,

				       &info->filter);

}



static int bpf_mt_check_v1(const struct xt_mtchk_param *par)

{

	struct xt_bpf_info_v1 *info = par->matchinfo;



	if (info->mode == XT_BPF_MODE_BYTECODE)

		return __bpf_mt_check_bytecode(info->bpf_program,

					       info->bpf_program_num_elem,

					       &info->filter);

	else if (info->mode == XT_BPF_MODE_FD_PINNED ||

		 info->mode == XT_BPF_MODE_FD_ELF)

		return __bpf_mt_check_fd(info->fd, &info->filter);

	else

		return -EINVAL;

}



static bool bpf_mt(const struct sk_buff *skb, struct xt_action_param *par)

{

	const struct xt_bpf_info *info = par->matchinfo;
@@ -43,13 +80,29 @@ static bool bpf_mt(const struct sk_buff *skb, struct xt_action_param *par) 
	return BPF_PROG_RUN(info->filter, skb);

}



static bool bpf_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)

{

	const struct xt_bpf_info_v1 *info = par->matchinfo;



	return !!bpf_prog_run_save_cb(info->filter, (struct sk_buff *) skb);

}



static void bpf_mt_destroy(const struct xt_mtdtor_param *par)

{

	const struct xt_bpf_info *info = par->matchinfo;



	bpf_prog_destroy(info->filter);

}



static struct xt_match bpf_mt_reg __read_mostly = {

static void bpf_mt_destroy_v1(const struct xt_mtdtor_param *par)

{

	const struct xt_bpf_info_v1 *info = par->matchinfo;



	bpf_prog_destroy(info->filter);

}



static struct xt_match bpf_mt_reg[] __read_mostly = {

	{

		.name		= "bpf",

		.revision	= 0,

		.family		= NFPROTO_UNSPEC,
@@ -58,16 +111,27 @@ static struct xt_match bpf_mt_reg __read_mostly = { 
		.destroy	= bpf_mt_destroy,

		.matchsize	= sizeof(struct xt_bpf_info),

		.me		= THIS_MODULE,

	},

	{

		.name		= "bpf",

		.revision	= 1,

		.family		= NFPROTO_UNSPEC,

		.checkentry	= bpf_mt_check_v1,

		.match		= bpf_mt_v1,

		.destroy	= bpf_mt_destroy_v1,

		.matchsize	= sizeof(struct xt_bpf_info_v1),

		.me		= THIS_MODULE,

	},

};



static int __init bpf_mt_init(void)

{

	return xt_register_match(&bpf_mt_reg);

	return xt_register_matches(bpf_mt_reg, ARRAY_SIZE(bpf_mt_reg));

}



static void __exit bpf_mt_exit(void)

{

	xt_unregister_match(&bpf_mt_reg);

	xt_unregister_matches(bpf_mt_reg, ARRAY_SIZE(bpf_mt_reg));

}



module_init(bpf_mt_init);