| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20200427201246.2995471-1-yhs@fb.com>
Date: Mon, 27 Apr 2020 13:12:46 -0700
From: Yonghong Song <yhs@...com>
To: Andrii Nakryiko <andriin@...com>, <bpf@...r.kernel.org>,
Martin KaFai Lau <kafai@...com>, <netdev@...r.kernel.org>
CC: Alexei Starovoitov <ast@...com>,
Daniel Borkmann <daniel@...earbox.net>, <kernel-team@...com>
Subject: [PATCH bpf-next v1 10/19] bpf: add netlink and ipv6_route targets
This patch added netlink and ipv6_route targets, using
the same seq_ops (except show() and minor changes for stop())
for /proc/net/{netlink,ipv6_route}.
Note that both ipv6_route and netlink have target_feature
set as BPF_DUMP_SEQ_NET_PRIVATE. This is to notify
bpf_iter infrastructure to set net namespace properly
in seq_file private data area.
Since module is not supported for now, ipv6_route is
supported only if the IPV6 is built-in, i.e., not compiled
as a module. The restriction can be lifted once module
is properly supported for bpf_iter.
Signed-off-by: Yonghong Song <yhs@...com>
---
net/ipv6/ip6_fib.c | 71 +++++++++++++++++++++++++++-
net/ipv6/route.c | 30 ++++++++++++
net/netlink/af_netlink.c | 99 +++++++++++++++++++++++++++++++++++++++-
3 files changed, 196 insertions(+), 4 deletions(-)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 46ed56719476..588b5f508b18 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -2467,7 +2467,7 @@ void fib6_gc_cleanup(void)
}
#ifdef CONFIG_PROC_FS
-static int ipv6_route_seq_show(struct seq_file *seq, void *v)
+static int ipv6_route_native_seq_show(struct seq_file *seq, void *v)
{
struct fib6_info *rt = v;
struct ipv6_route_iter *iter = seq->private;
@@ -2625,7 +2625,7 @@ static bool ipv6_route_iter_active(struct ipv6_route_iter *iter)
return w->node && !(w->state == FWS_U && w->node == w->root);
}
-static void ipv6_route_seq_stop(struct seq_file *seq, void *v)
+static void ipv6_route_native_seq_stop(struct seq_file *seq, void *v)
__releases(RCU_BH)
{
struct net *net = seq_file_net(seq);
@@ -2637,6 +2637,73 @@ static void ipv6_route_seq_stop(struct seq_file *seq, void *v)
rcu_read_unlock_bh();
}
+#if IS_BUILTIN(CONFIG_IPV6) && defined(CONFIG_BPF_SYSCALL)
+struct bpf_iter__ipv6_route {
+ __bpf_md_ptr(struct bpf_iter_meta *, meta);
+ __bpf_md_ptr(struct fib6_info *, rt);
+};
+
+static int ipv6_route_prog_seq_show(struct bpf_prog *prog, struct seq_file *seq,
+ u64 session_id, u64 seq_num, void *v)
+{
+ struct bpf_iter__ipv6_route ctx;
+ struct bpf_iter_meta meta;
+ int ret;
+
+ meta.seq = seq;
+ meta.session_id = session_id;
+ meta.seq_num = seq_num;
+ ctx.meta = &meta;
+ ctx.rt = v;
+ ret = bpf_iter_run_prog(prog, &ctx);
+ return ret == 0 ? 0 : -EINVAL;
+}
+
+static int ipv6_route_seq_show(struct seq_file *seq, void *v)
+{
+ struct ipv6_route_iter *iter = seq->private;
+ u64 session_id, seq_num;
+ struct bpf_prog *prog;
+ int ret;
+
+ prog = bpf_iter_get_prog(seq, sizeof(struct ipv6_route_iter),
+ &session_id, &seq_num, false);
+ if (!prog)
+ return ipv6_route_native_seq_show(seq, v);
+
+ ret = ipv6_route_prog_seq_show(prog, seq, session_id, seq_num, v);
+ iter->w.leaf = NULL;
+
+ return ret;
+}
+
+static void ipv6_route_seq_stop(struct seq_file *seq, void *v)
+{
+ u64 session_id, seq_num;
+ struct bpf_prog *prog;
+
+ if (!v) {
+ prog = bpf_iter_get_prog(seq, sizeof(struct ipv6_route_iter),
+ &session_id, &seq_num, true);
+ if (prog)
+ ipv6_route_prog_seq_show(prog, seq, session_id,
+ seq_num, v);
+ }
+
+ ipv6_route_native_seq_stop(seq, v);
+}
+#else
+static int ipv6_route_seq_show(struct seq_file *seq, void *v)
+{
+ return ipv6_route_native_seq_show(seq, v);
+}
+
+static void ipv6_route_seq_stop(struct seq_file *seq, void *v)
+{
+ ipv6_route_native_seq_stop(seq, v);
+}
+#endif
+
const struct seq_operations ipv6_route_seq_ops = {
.start = ipv6_route_seq_start,
.next = ipv6_route_seq_next,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 310cbddaa533..f275a13e2aea 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -6390,6 +6390,28 @@ void __init ip6_route_init_special_entries(void)
#endif
}
+#if IS_BUILTIN(CONFIG_IPV6)
+#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)
+int __init __bpf_iter__ipv6_route(struct bpf_iter_meta *meta, struct fib6_info *rt)
+{
+ return 0;
+}
+
+static int __init bpf_iter_register(void)
+{
+ struct bpf_iter_reg reg_info = {
+ .target = "ipv6_route",
+ .target_func_name = "__bpf_iter__ipv6_route",
+ .seq_ops = &ipv6_route_seq_ops,
+ .seq_priv_size = sizeof(struct ipv6_route_iter),
+ .target_feature = BPF_DUMP_SEQ_NET_PRIVATE,
+ };
+
+ return bpf_iter_reg_target(®_info);
+}
+#endif
+#endif
+
int __init ip6_route_init(void)
{
int ret;
@@ -6452,6 +6474,14 @@ int __init ip6_route_init(void)
if (ret)
goto out_register_late_subsys;
+#if IS_BUILTIN(CONFIG_IPV6)
+#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)
+ ret = bpf_iter_register();
+ if (ret)
+ goto out_register_late_subsys;
+#endif
+#endif
+
for_each_possible_cpu(cpu) {
struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 5ded01ca8b20..b6192cd66801 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2596,7 +2596,7 @@ static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos)
return __netlink_seq_next(seq);
}
-static void netlink_seq_stop(struct seq_file *seq, void *v)
+static void netlink_native_seq_stop(struct seq_file *seq, void *v)
{
struct nl_seq_iter *iter = seq->private;
@@ -2607,7 +2607,7 @@ static void netlink_seq_stop(struct seq_file *seq, void *v)
}
-static int netlink_seq_show(struct seq_file *seq, void *v)
+static int netlink_native_seq_show(struct seq_file *seq, void *v)
{
if (v == SEQ_START_TOKEN) {
seq_puts(seq,
@@ -2634,6 +2634,80 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
return 0;
}
+#ifdef CONFIG_BPF_SYSCALL
+struct bpf_iter__netlink {
+ __bpf_md_ptr(struct bpf_iter_meta *, meta);
+ __bpf_md_ptr(struct netlink_sock *, sk);
+};
+
+int __init __bpf_iter__netlink(struct bpf_iter_meta *meta, struct netlink_sock *sk)
+{
+ return 0;
+}
+
+static int netlink_prog_seq_show(struct bpf_prog *prog, struct seq_file *seq,
+ u64 session_id, u64 seq_num, void *v)
+{
+ struct bpf_iter__netlink ctx;
+ struct bpf_iter_meta meta;
+ int ret = 0;
+
+ meta.seq = seq;
+ meta.session_id = session_id;
+ meta.seq_num = seq_num;
+ ctx.meta = &meta;
+ ctx.sk = nlk_sk((struct sock *)v);
+ ret = bpf_iter_run_prog(prog, &ctx);
+ return ret == 0 ? 0 : -EINVAL;
+}
+
+static int netlink_seq_show(struct seq_file *seq, void *v)
+{
+ u64 session_id, seq_num;
+ struct bpf_prog *prog;
+
+ prog = bpf_iter_get_prog(seq, sizeof(struct nl_seq_iter),
+ &session_id, &seq_num, false);
+ if (!prog)
+ return netlink_native_seq_show(seq, v);
+
+ if (v == SEQ_START_TOKEN)
+ return 0;
+
+ return netlink_prog_seq_show(prog, seq, session_id,
+ seq_num - 1, v);
+}
+
+static void netlink_seq_stop(struct seq_file *seq, void *v)
+{
+ u64 session_id, seq_num;
+ struct bpf_prog *prog;
+
+ if (!v) {
+ prog = bpf_iter_get_prog(seq, sizeof(struct nl_seq_iter),
+ &session_id, &seq_num, true);
+ if (prog) {
+ if (seq_num)
+ seq_num = seq_num - 1;
+ netlink_prog_seq_show(prog, seq, session_id,
+ seq_num, v);
+ }
+ }
+
+ netlink_native_seq_stop(seq, v);
+}
+#else
+static int netlink_seq_show(struct seq_file *seq, void *v)
+{
+ return netlink_native_seq_show(seq, v);
+}
+
+static void netlink_seq_stop(struct seq_file *seq, void *v)
+{
+ netlink_native_seq_stop(seq, v);
+}
+#endif
+
static const struct seq_operations netlink_seq_ops = {
.start = netlink_seq_start,
.next = netlink_seq_next,
@@ -2740,6 +2814,21 @@ static const struct rhashtable_params netlink_rhashtable_params = {
.automatic_shrinking = true,
};
+#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)
+static int __init bpf_iter_register(void)
+{
+ struct bpf_iter_reg reg_info = {
+ .target = "netlink",
+ .target_func_name = "__bpf_iter__netlink",
+ .seq_ops = &netlink_seq_ops,
+ .seq_priv_size = sizeof(struct nl_seq_iter),
+ .target_feature = BPF_DUMP_SEQ_NET_PRIVATE,
+ };
+
+ return bpf_iter_reg_target(®_info);
+}
+#endif
+
static int __init netlink_proto_init(void)
{
int i;
@@ -2748,6 +2837,12 @@ static int __init netlink_proto_init(void)
if (err != 0)
goto out;
+#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)
+ err = bpf_iter_register();
+ if (err)
+ goto out;
+#endif
+
BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > sizeof_field(struct sk_buff, cb));
nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
--
2.24.1
Powered by blists - more mailing lists