Commit 84601d6e authored by Florian Westphal's avatar Florian Westphal Committed by Alexei Starovoitov
Browse files

bpf: add bpf_link support for BPF_NETFILTER programs 



Add bpf_link support skeleton.  To keep this reviewable, no bpf program
can be invoked yet, if a program is attached only a c-stub is called and
not the actual bpf program.

Defaults to 'y' if both netfilter and bpf syscall are enabled in kconfig.

Uapi example usage:
	union bpf_attr attr = { };

	attr.link_create.prog_fd = progfd;
	attr.link_create.attach_type = 0; /* unused */
	attr.link_create.netfilter.pf = PF_INET;
	attr.link_create.netfilter.hooknum = NF_INET_LOCAL_IN;
	attr.link_create.netfilter.priority = -128;

	err = bpf(BPF_LINK_CREATE, &attr, sizeof(attr));

... this would attach progfd to ipv4:input hook.

Such hook gets removed automatically if the calling program exits.

BPF_NETFILTER program invocation is added in followup change.

NF_HOOK_OP_BPF enum will eventually be read from nfnetlink_hook, it
allows to tell userspace which program is attached at the given hook
when user runs 'nft hook list' command rather than just the priority
and not-very-helpful 'this hook runs a bpf prog but I can't tell which
one'.

Will also be used to disallow registration of two bpf programs with
same priority in a followup patch.

v4: arm32 cmpxchg only supports 32bit operand
    s/prio/priority/
v3: restrict prog attachment to ip/ip6 for now, lets lift restrictions if
    more use cases pop up (arptables, ebtables, netdev ingress/egress etc).

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20230421170300.24115-2-fw@strlen.de


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 45cea721

include/linux/netfilter.h

+1 −0
Original line number Diff line number Diff line
@@ -80,6 +80,7 @@ typedef unsigned int nf_hookfn(void *priv, 
enum nf_hook_ops_type {

	NF_HOOK_OP_UNDEFINED,

	NF_HOOK_OP_NF_TABLES,

	NF_HOOK_OP_BPF,

};



struct nf_hook_ops {

include/net/netfilter/nf_bpf_link.h

0 → 100644
+10 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */



#if IS_ENABLED(CONFIG_NETFILTER_BPF_LINK)

int bpf_nf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog);

#else

static inline int bpf_nf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)

{

	return -EOPNOTSUPP;

}

#endif

include/uapi/linux/bpf.h

+14 −0
Original line number Diff line number Diff line
@@ -986,6 +986,7 @@ enum bpf_prog_type { 
	BPF_PROG_TYPE_LSM,

	BPF_PROG_TYPE_SK_LOOKUP,

	BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */

	BPF_PROG_TYPE_NETFILTER,

};



enum bpf_attach_type {
@@ -1050,6 +1051,7 @@ enum bpf_link_type { 
	BPF_LINK_TYPE_PERF_EVENT = 7,

	BPF_LINK_TYPE_KPROBE_MULTI = 8,

	BPF_LINK_TYPE_STRUCT_OPS = 9,

	BPF_LINK_TYPE_NETFILTER = 10,



	MAX_BPF_LINK_TYPE,

};
@@ -1560,6 +1562,12 @@ union bpf_attr { 
				 */

				__u64		cookie;

			} tracing;

			struct {

				__u32		pf;

				__u32		hooknum;

				__s32		priority;

				__u32		flags;

			} netfilter;

		};

	} link_create;
@@ -6410,6 +6418,12 @@ struct bpf_link_info { 
		struct {

			__u32 map_id;

		} struct_ops;

		struct {

			__u32 pf;

			__u32 hooknum;

			__s32 priority;

			__u32 flags;

		} netfilter;

	};

} __attribute__((aligned(8)));

kernel/bpf/syscall.c

+6 −0
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ 
#include <linux/rcupdate_trace.h>

#include <linux/memcontrol.h>

#include <linux/trace_events.h>

#include <net/netfilter/nf_bpf_link.h>



#define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \

			  (map)->map_type == BPF_MAP_TYPE_CGROUP_ARRAY || \
@@ -2462,6 +2463,7 @@ static bool is_net_admin_prog_type(enum bpf_prog_type prog_type) 
	case BPF_PROG_TYPE_CGROUP_SYSCTL:

	case BPF_PROG_TYPE_SOCK_OPS:

	case BPF_PROG_TYPE_EXT: /* extends any prog */

	case BPF_PROG_TYPE_NETFILTER:

		return true;

	case BPF_PROG_TYPE_CGROUP_SKB:

		/* always unpriv */
@@ -4588,6 +4590,7 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr) 


	switch (prog->type) {

	case BPF_PROG_TYPE_EXT:

	case BPF_PROG_TYPE_NETFILTER:

		break;

	case BPF_PROG_TYPE_PERF_EVENT:

	case BPF_PROG_TYPE_TRACEPOINT:
@@ -4654,6 +4657,9 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr) 
	case BPF_PROG_TYPE_XDP:

		ret = bpf_xdp_link_attach(attr, prog);

		break;

	case BPF_PROG_TYPE_NETFILTER:

		ret = bpf_nf_link_attach(attr, prog);

		break;

#endif

	case BPF_PROG_TYPE_PERF_EVENT:

	case BPF_PROG_TYPE_TRACEPOINT:

net/netfilter/Kconfig

+3 −0
Original line number Diff line number Diff line
@@ -30,6 +30,9 @@ config NETFILTER_FAMILY_BRIDGE 
config NETFILTER_FAMILY_ARP

	bool



config NETFILTER_BPF_LINK

	def_bool BPF_SYSCALL



config NETFILTER_NETLINK_HOOK

	tristate "Netfilter base hook dump support"

	depends on NETFILTER_ADVANCED