From: Florian Westphal <fw@strlen.de>
To: bpf@vger.kernel.org
Cc: <netfilter-devel@vger.kernel.org>, Florian Westphal <fw@strlen.de>
Subject: [PATCH RFC v2 bpf-next 0/3] bpf: add netfilter program type
Date: Thu, 2 Mar 2023 18:27:54 +0100 [thread overview]
Message-ID: <20230302172757.9548-1-fw@strlen.de> (raw)
Add minimal support to hook bpf programs to netfilter hooks,
e.g. PREROUTING or FORWARD.
For this the most relevant parts for registering a netfilter
hook via the in-kernel api are exposed to userspace via bpf_link.
The new program type is 'tracing style' and assumes skb dynptrs are used
rather than 'direct packet access'.
With this its possible to build a small test program such as:
#include "vmlinux.h"
extern int bpf_dynptr_from_skb(struct __sk_buff *skb, __u64 flags,
struct bpf_dynptr *ptr__uninit) __ksym;
extern void *bpf_dynptr_slice(const struct bpf_dynptr *ptr, uint32_t offset,
void *buffer, uint32_t buffer__sz) __ksym;
SEC("netfilter")
int nf_test(struct bpf_nf_ctx *ctx)
{
struct nf_hook_state *state = ctx->state;
struct sk_buff *skb = ctx->skb;
const struct iphdr *iph, _iph;
const struct tcphdr *th, _th;
struct bpf_dynptr ptr;
if (bpf_dynptr_from_skb(skb, 0, &ptr))
return NF_DROP;
iph = bpf_dynptr_slice(&ptr, 0, &_iph, sizeof(_iph));
if (!iph)
return NF_DROP;
th = bpf_dynptr_slice(&ptr, iph->ihl << 2, &_th, sizeof(_th));
if (!th)
return NF_DROP;
bpf_printk("accept %x:%d->%x:%d, hook %d ifin %d\n", iph->saddr, bpf_ntohs(th->source), iph->daddr, bpf_ntohs(th->dest), state->hook, state->in->ifindex);
return NF_ACCEPT;
}
(output can be observed via /sys/kernel/tracing/trace_pipe).
At this point I think its fairly complete. Known problems are:
- no test cases, I will look into this. Might take some time
though because I might have to extend libbpf first.
- nfnetlink_hook needs minor work so that it can dump the bpf
program id. As-is, userspace could see that a bpf program
is attached to e.g. forward and output, but it cannot tell
which program. This is fairly simple and doesn't need changes
on bpf side.
I will work on these address those two next unless anyone spots
a fundamental issue with this rfc set.
Florian Westphal (3):
bpf: add bpf_link support for BPF_NETFILTER programs
libbpf: sync header file, add nf prog section name
bpf: minimal support for programs hooked into netfilter framework
include/linux/bpf_types.h | 4 +
include/linux/netfilter.h | 1 +
include/net/netfilter/nf_hook_bpf.h | 8 ++
include/uapi/linux/bpf.h | 12 ++
kernel/bpf/btf.c | 5 +
kernel/bpf/syscall.c | 6 +
kernel/bpf/verifier.c | 3 +
net/netfilter/Kconfig | 3 +
net/netfilter/Makefile | 1 +
net/netfilter/nf_bpf_link.c | 192 ++++++++++++++++++++++++++++
tools/include/uapi/linux/bpf.h | 12 ++
tools/lib/bpf/libbpf.c | 1 +
12 files changed, 248 insertions(+)
create mode 100644 include/net/netfilter/nf_hook_bpf.h
create mode 100644 net/netfilter/nf_bpf_link.c
--
2.39.2
next reply other threads:[~2023-03-02 17:28 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-02 17:27 Florian Westphal [this message]
2023-03-02 17:27 ` [PATCH RFC v2 bpf-next 1/3] bpf: add bpf_link support for BPF_NETFILTER programs Florian Westphal
2023-03-02 20:07 ` kernel test robot
2023-03-02 20:28 ` Stanislav Fomichev
2023-03-03 0:27 ` Florian Westphal
2023-03-23 0:41 ` Daniel Xu
2023-03-23 18:31 ` Stanislav Fomichev
2023-03-24 17:33 ` Daniel Xu
2023-03-24 17:58 ` Stanislav Fomichev
2023-03-24 18:22 ` Florian Westphal
2023-03-24 19:22 ` Stanislav Fomichev
2023-03-02 21:10 ` kernel test robot
2023-03-02 17:27 ` [PATCH RFC v2 bpf-next 2/3] libbpf: sync header file, add nf prog section name Florian Westphal
2023-03-02 17:27 ` [PATCH RFC v2 bpf-next 3/3] bpf: minimal support for programs hooked into netfilter framework Florian Westphal
2023-03-02 19:59 ` Toke Høiland-Jørgensen
2023-03-02 23:53 ` Florian Westphal
2023-03-03 0:06 ` Toke Høiland-Jørgensen
2023-03-02 19:59 ` [PATCH RFC v2 bpf-next 0/3] bpf: add netfilter program type Toke Høiland-Jørgensen
2023-03-23 0:36 ` Daniel Xu
2023-03-24 18:36 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230302172757.9548-1-fw@strlen.de \
--to=fw@strlen.de \
--cc=bpf@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.