mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
![Andrii Nakryiko](/assets/img/avatar_default.png)
Turn BPF_PROG_RUN into a proper always inlined function. No functional and performance changes are intended, but it makes it much easier to understand what's going on with how BPF programs are actually get executed. It's more obvious what types and callbacks are expected. Also extra () around input parameters can be dropped, as well as `__` variable prefixes intended to avoid naming collisions, which makes the code simpler to read and write. This refactoring also highlighted one extra issue. BPF_PROG_RUN is both a macro and an enum value (BPF_PROG_RUN == BPF_PROG_TEST_RUN). Turning BPF_PROG_RUN into a function causes naming conflict compilation error. So rename BPF_PROG_RUN into lower-case bpf_prog_run(), similar to bpf_prog_run_xdp(), bpf_prog_run_pin_on_cpu(), etc. All existing callers of BPF_PROG_RUN, the macro, are switched to bpf_prog_run() explicitly. Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20210815070609.987780-2-andrii@kernel.org
153 lines
3.6 KiB
C
153 lines
3.6 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/* Xtables module to match packets using a BPF filter.
|
|
* Copyright 2013 Google Inc.
|
|
* Written by Willem de Bruijn <willemb@google.com>
|
|
*/
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/syscalls.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/filter.h>
|
|
#include <linux/bpf.h>
|
|
|
|
#include <linux/netfilter/xt_bpf.h>
|
|
#include <linux/netfilter/x_tables.h>
|
|
|
|
MODULE_AUTHOR("Willem de Bruijn <willemb@google.com>");
|
|
MODULE_DESCRIPTION("Xtables: BPF filter match");
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_ALIAS("ipt_bpf");
|
|
MODULE_ALIAS("ip6t_bpf");
|
|
|
|
static int __bpf_mt_check_bytecode(struct sock_filter *insns, __u16 len,
|
|
struct bpf_prog **ret)
|
|
{
|
|
struct sock_fprog_kern program;
|
|
|
|
if (len > XT_BPF_MAX_NUM_INSTR)
|
|
return -EINVAL;
|
|
|
|
program.len = len;
|
|
program.filter = insns;
|
|
|
|
if (bpf_prog_create(ret, &program)) {
|
|
pr_info_ratelimited("check failed: parse error\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int __bpf_mt_check_fd(int fd, struct bpf_prog **ret)
|
|
{
|
|
struct bpf_prog *prog;
|
|
|
|
prog = bpf_prog_get_type(fd, BPF_PROG_TYPE_SOCKET_FILTER);
|
|
if (IS_ERR(prog))
|
|
return PTR_ERR(prog);
|
|
|
|
*ret = prog;
|
|
return 0;
|
|
}
|
|
|
|
static int __bpf_mt_check_path(const char *path, struct bpf_prog **ret)
|
|
{
|
|
if (strnlen(path, XT_BPF_PATH_MAX) == XT_BPF_PATH_MAX)
|
|
return -EINVAL;
|
|
|
|
*ret = bpf_prog_get_type_path(path, BPF_PROG_TYPE_SOCKET_FILTER);
|
|
return PTR_ERR_OR_ZERO(*ret);
|
|
}
|
|
|
|
static int bpf_mt_check(const struct xt_mtchk_param *par)
|
|
{
|
|
struct xt_bpf_info *info = par->matchinfo;
|
|
|
|
return __bpf_mt_check_bytecode(info->bpf_program,
|
|
info->bpf_program_num_elem,
|
|
&info->filter);
|
|
}
|
|
|
|
static int bpf_mt_check_v1(const struct xt_mtchk_param *par)
|
|
{
|
|
struct xt_bpf_info_v1 *info = par->matchinfo;
|
|
|
|
if (info->mode == XT_BPF_MODE_BYTECODE)
|
|
return __bpf_mt_check_bytecode(info->bpf_program,
|
|
info->bpf_program_num_elem,
|
|
&info->filter);
|
|
else if (info->mode == XT_BPF_MODE_FD_ELF)
|
|
return __bpf_mt_check_fd(info->fd, &info->filter);
|
|
else if (info->mode == XT_BPF_MODE_PATH_PINNED)
|
|
return __bpf_mt_check_path(info->path, &info->filter);
|
|
else
|
|
return -EINVAL;
|
|
}
|
|
|
|
static bool bpf_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
|
{
|
|
const struct xt_bpf_info *info = par->matchinfo;
|
|
|
|
return bpf_prog_run(info->filter, skb);
|
|
}
|
|
|
|
static bool bpf_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
|
|
{
|
|
const struct xt_bpf_info_v1 *info = par->matchinfo;
|
|
|
|
return !!bpf_prog_run_save_cb(info->filter, (struct sk_buff *) skb);
|
|
}
|
|
|
|
static void bpf_mt_destroy(const struct xt_mtdtor_param *par)
|
|
{
|
|
const struct xt_bpf_info *info = par->matchinfo;
|
|
|
|
bpf_prog_destroy(info->filter);
|
|
}
|
|
|
|
static void bpf_mt_destroy_v1(const struct xt_mtdtor_param *par)
|
|
{
|
|
const struct xt_bpf_info_v1 *info = par->matchinfo;
|
|
|
|
bpf_prog_destroy(info->filter);
|
|
}
|
|
|
|
static struct xt_match bpf_mt_reg[] __read_mostly = {
|
|
{
|
|
.name = "bpf",
|
|
.revision = 0,
|
|
.family = NFPROTO_UNSPEC,
|
|
.checkentry = bpf_mt_check,
|
|
.match = bpf_mt,
|
|
.destroy = bpf_mt_destroy,
|
|
.matchsize = sizeof(struct xt_bpf_info),
|
|
.usersize = offsetof(struct xt_bpf_info, filter),
|
|
.me = THIS_MODULE,
|
|
},
|
|
{
|
|
.name = "bpf",
|
|
.revision = 1,
|
|
.family = NFPROTO_UNSPEC,
|
|
.checkentry = bpf_mt_check_v1,
|
|
.match = bpf_mt_v1,
|
|
.destroy = bpf_mt_destroy_v1,
|
|
.matchsize = sizeof(struct xt_bpf_info_v1),
|
|
.usersize = offsetof(struct xt_bpf_info_v1, filter),
|
|
.me = THIS_MODULE,
|
|
},
|
|
};
|
|
|
|
static int __init bpf_mt_init(void)
|
|
{
|
|
return xt_register_matches(bpf_mt_reg, ARRAY_SIZE(bpf_mt_reg));
|
|
}
|
|
|
|
static void __exit bpf_mt_exit(void)
|
|
{
|
|
xt_unregister_matches(bpf_mt_reg, ARRAY_SIZE(bpf_mt_reg));
|
|
}
|
|
|
|
module_init(bpf_mt_init);
|
|
module_exit(bpf_mt_exit);
|