| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 30 Jun 2023 12:40:02 -0700
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Florian Westphal <fw@...len.de>
Cc: bpf@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH bpf-next v4 1/2] tools: libbpf: add netfilter link attach helper
On Wed, Jun 28, 2023 at 8:27 AM Florian Westphal <fw@...len.de> wrote:
>
> Add new api function: bpf_program__attach_netfilter.
>
> It takes a bpf program (netfilter type), and a pointer to a option struct
> that contains the desired attachment (protocol family, priority, hook
> location, ...).
>
> It returns a pointer to a 'bpf_link' structure or NULL on error.
>
> Next patch adds new netfilter_basic test that uses this function to
> attach a program to a few pf/hook/priority combinations.
>
> v2: change name and use bpf_link_create.
>
> Suggested-by: Andrii Nakryiko <andrii.nakryiko@...il.com>
> Link: https://lore.kernel.org/bpf/CAEf4BzZrmUv27AJp0dDxBDMY_B8e55-wLs8DUKK69vCWsCG_pQ@mail.gmail.com/
> Link: https://lore.kernel.org/bpf/CAEf4BzZ69YgrQW7DHCJUT_X+GqMq_ZQQPBwopaJJVGFD5=d5Vg@mail.gmail.com/
> Signed-off-by: Florian Westphal <fw@...len.de>
> ---
> tools/lib/bpf/bpf.c | 6 ++++++
> tools/lib/bpf/bpf.h | 6 ++++++
> tools/lib/bpf/libbpf.c | 42 ++++++++++++++++++++++++++++++++++++++++
> tools/lib/bpf/libbpf.h | 15 ++++++++++++++
> tools/lib/bpf/libbpf.map | 1 +
> 5 files changed, 70 insertions(+)
>
> diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
> index ed86b37d8024..1b4f85f3c5b1 100644
> --- a/tools/lib/bpf/bpf.c
> +++ b/tools/lib/bpf/bpf.c
> @@ -741,6 +741,12 @@ int bpf_link_create(int prog_fd, int target_fd,
> if (!OPTS_ZEROED(opts, tracing))
> return libbpf_err(-EINVAL);
> break;
> + case BPF_NETFILTER:
> + attr.link_create.netfilter.pf = OPTS_GET(opts, netfilter.pf, 0);
> + attr.link_create.netfilter.hooknum = OPTS_GET(opts, netfilter.hooknum, 0);
> + attr.link_create.netfilter.priority = OPTS_GET(opts, netfilter.priority, 0);
> + attr.link_create.netfilter.flags = OPTS_GET(opts, netfilter.flags, 0);
there should have also done this check:
if (!OPTS_ZEROED(opts, netfilter))
return libbpf_err(-EINVAL);
just like in other cases. I added it while applying to bpf-next, thanks.
> + break;
> default:
> if (!OPTS_ZEROED(opts, flags))
> return libbpf_err(-EINVAL);
> diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
> index 9aa0ee473754..c676295ab9bf 100644
> --- a/tools/lib/bpf/bpf.h
> +++ b/tools/lib/bpf/bpf.h
> @@ -349,6 +349,12 @@ struct bpf_link_create_opts {
> struct {
> __u64 cookie;
> } tracing;
> + struct {
> + __u32 pf;
> + __u32 hooknum;
> + __s32 priority;
> + __u32 flags;
> + } netfilter;
> };
> size_t :0;
> };
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 214f828ece6b..f193eca16382 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -11811,6 +11811,48 @@ static int attach_iter(const struct bpf_program *prog, long cookie, struct bpf_l
> return libbpf_get_error(*link);
> }
>
> +struct bpf_link *bpf_program__attach_netfilter(const struct bpf_program *prog,
> + const struct bpf_netfilter_opts *opts)
> +{
> + LIBBPF_OPTS(bpf_link_create_opts, lopts);
> + struct bpf_link *link;
> + int prog_fd, link_fd;
> +
> + if (!OPTS_VALID(opts, bpf_netfilter_opts))
> + return libbpf_err_ptr(-EINVAL);
> +
> + prog_fd = bpf_program__fd(prog);
> + if (prog_fd < 0) {
> + pr_warn("prog '%s': can't attach before loaded\n", prog->name);
> + return libbpf_err_ptr(-EINVAL);
> + }
> +
> + link = calloc(1, sizeof(*link));
> + if (!link)
> + return libbpf_err_ptr(-ENOMEM);
> +
> + link->detach = &bpf_link__detach_fd;
> +
> + lopts.netfilter.pf = OPTS_GET(opts, pf, 0);
> + lopts.netfilter.hooknum = OPTS_GET(opts, hooknum, 0);
> + lopts.netfilter.priority = OPTS_GET(opts, priority, 0);
> + lopts.netfilter.flags = OPTS_GET(opts, flags, 0);
> +
> + link_fd = bpf_link_create(prog_fd, 0, BPF_NETFILTER, &lopts);
> + if (link_fd < 0) {
> + char errmsg[STRERR_BUFSIZE];
> +
> + link_fd = -errno;
> + free(link);
> + pr_warn("prog '%s': failed to attach to netfilter: %s\n",
> + prog->name, libbpf_strerror_r(link_fd, errmsg, sizeof(errmsg)));
> + return libbpf_err_ptr(link_fd);
> + }
> + link->fd = link_fd;
> +
> + return link;
> +}
> +
> struct bpf_link *bpf_program__attach(const struct bpf_program *prog)
> {
> struct bpf_link *link = NULL;
> diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
> index 754da73c643b..10642ad69d76 100644
> --- a/tools/lib/bpf/libbpf.h
> +++ b/tools/lib/bpf/libbpf.h
> @@ -718,6 +718,21 @@ LIBBPF_API struct bpf_link *
> bpf_program__attach_freplace(const struct bpf_program *prog,
> int target_fd, const char *attach_func_name);
>
> +struct bpf_netfilter_opts {
> + /* size of this struct, for forward/backward compatibility */
> + size_t sz;
> +
> + __u32 pf;
> + __u32 hooknum;
> + __s32 priority;
> + __u32 flags;
> +};
> +#define bpf_netfilter_opts__last_field flags
> +
> +LIBBPF_API struct bpf_link *
> +bpf_program__attach_netfilter(const struct bpf_program *prog,
> + const struct bpf_netfilter_opts *opts);
> +
> struct bpf_map;
>
> LIBBPF_API struct bpf_link *bpf_map__attach_struct_ops(const struct bpf_map *map);
> diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
> index 7521a2fb7626..d9ec4407befa 100644
> --- a/tools/lib/bpf/libbpf.map
> +++ b/tools/lib/bpf/libbpf.map
> @@ -395,4 +395,5 @@ LIBBPF_1.2.0 {
> LIBBPF_1.3.0 {
> global:
> bpf_obj_pin_opts;
> + bpf_program__attach_netfilter;
> } LIBBPF_1.2.0;
> --
> 2.39.3
>
Powered by blists - more mailing lists