Commit 52364abb authored by Florian Westphal's avatar Florian Westphal Committed by Andrii Nakryiko
Browse files

libbpf: Add netfilter link attach helper 



Add new api function: bpf_program__attach_netfilter.

It takes a bpf program (netfilter type), and a pointer to a option struct
that contains the desired attachment (protocol family, priority, hook
location, ...).

It returns a pointer to a 'bpf_link' structure or NULL on error.

Next patch adds new netfilter_basic test that uses this function to
attach a program to a few pf/hook/priority combinations.

v2: change name and use bpf_link_create.

Suggested-by: default avatarAndrii Nakryiko <andrii.nakryiko@gmail.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Reviewed-by: default avatarToke Høiland-Jørgensen <toke@redhat.com>
Acked-by: default avatarDaniel Xu <dxu@dxuuu.xyz>
Link: https://lore.kernel.org/bpf/CAEf4BzZrmUv27AJp0dDxBDMY_B8e55-wLs8DUKK69vCWsCG_pQ@mail.gmail.com/
Link: https://lore.kernel.org/bpf/CAEf4BzZ69YgrQW7DHCJUT_X+GqMq_ZQQPBwopaJJVGFD5=d5Vg@mail.gmail.com/
Link: https://lore.kernel.org/bpf/20230628152738.22765-2-fw@strlen.de
parent 2d2c9516

tools/lib/bpf/bpf.c

+8 −0
Original line number Diff line number Diff line
@@ -741,6 +741,14 @@ int bpf_link_create(int prog_fd, int target_fd, 
		if (!OPTS_ZEROED(opts, tracing))

			return libbpf_err(-EINVAL);

		break;

	case BPF_NETFILTER:

		attr.link_create.netfilter.pf = OPTS_GET(opts, netfilter.pf, 0);

		attr.link_create.netfilter.hooknum = OPTS_GET(opts, netfilter.hooknum, 0);

		attr.link_create.netfilter.priority = OPTS_GET(opts, netfilter.priority, 0);

		attr.link_create.netfilter.flags = OPTS_GET(opts, netfilter.flags, 0);

		if (!OPTS_ZEROED(opts, netfilter))

			return libbpf_err(-EINVAL);

		break;

	default:

		if (!OPTS_ZEROED(opts, flags))

			return libbpf_err(-EINVAL);

tools/lib/bpf/bpf.h

+6 −0
Original line number Diff line number Diff line
@@ -349,6 +349,12 @@ struct bpf_link_create_opts { 
		struct {

			__u64 cookie;

		} tracing;

		struct {

			__u32 pf;

			__u32 hooknum;

			__s32 priority;

			__u32 flags;

		} netfilter;

	};

	size_t :0;

};

tools/lib/bpf/libbpf.c

+42 −0
Original line number Diff line number Diff line
@@ -11815,6 +11815,48 @@ static int attach_iter(const struct bpf_program *prog, long cookie, struct bpf_l 
	return libbpf_get_error(*link);

}



struct bpf_link *bpf_program__attach_netfilter(const struct bpf_program *prog,

					       const struct bpf_netfilter_opts *opts)

{

	LIBBPF_OPTS(bpf_link_create_opts, lopts);

	struct bpf_link *link;

	int prog_fd, link_fd;



	if (!OPTS_VALID(opts, bpf_netfilter_opts))

		return libbpf_err_ptr(-EINVAL);



	prog_fd = bpf_program__fd(prog);

	if (prog_fd < 0) {

		pr_warn("prog '%s': can't attach before loaded\n", prog->name);

		return libbpf_err_ptr(-EINVAL);

	}



	link = calloc(1, sizeof(*link));

	if (!link)

		return libbpf_err_ptr(-ENOMEM);



	link->detach = &bpf_link__detach_fd;



	lopts.netfilter.pf = OPTS_GET(opts, pf, 0);

	lopts.netfilter.hooknum = OPTS_GET(opts, hooknum, 0);

	lopts.netfilter.priority = OPTS_GET(opts, priority, 0);

	lopts.netfilter.flags = OPTS_GET(opts, flags, 0);



	link_fd = bpf_link_create(prog_fd, 0, BPF_NETFILTER, &lopts);

	if (link_fd < 0) {

		char errmsg[STRERR_BUFSIZE];



		link_fd = -errno;

		free(link);

		pr_warn("prog '%s': failed to attach to netfilter: %s\n",

			prog->name, libbpf_strerror_r(link_fd, errmsg, sizeof(errmsg)));

		return libbpf_err_ptr(link_fd);

	}

	link->fd = link_fd;



	return link;

}



struct bpf_link *bpf_program__attach(const struct bpf_program *prog)

{

	struct bpf_link *link = NULL;

tools/lib/bpf/libbpf.h

+15 −0
Original line number Diff line number Diff line
@@ -718,6 +718,21 @@ LIBBPF_API struct bpf_link * 
bpf_program__attach_freplace(const struct bpf_program *prog,

			     int target_fd, const char *attach_func_name);



struct bpf_netfilter_opts {

	/* size of this struct, for forward/backward compatibility */

	size_t sz;



	__u32 pf;

	__u32 hooknum;

	__s32 priority;

	__u32 flags;

};

#define bpf_netfilter_opts__last_field flags



LIBBPF_API struct bpf_link *

bpf_program__attach_netfilter(const struct bpf_program *prog,

			      const struct bpf_netfilter_opts *opts);



struct bpf_map;



LIBBPF_API struct bpf_link *bpf_map__attach_struct_ops(const struct bpf_map *map);

tools/lib/bpf/libbpf.map

+1 −0
Original line number Diff line number Diff line
@@ -395,4 +395,5 @@ LIBBPF_1.2.0 { 
LIBBPF_1.3.0 {

	global:

		bpf_obj_pin_opts;

		bpf_program__attach_netfilter;

} LIBBPF_1.2.0;