| Message ID | 20230421170300.24115-1-fw@strlen.de (mailing list archive) |
|---|---|
| Headers | show |
| Series | bpf: add netfilter program type | expand |
Hello: This series was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <ast@kernel.org>: On Fri, 21 Apr 2023 19:02:53 +0200 you wrote: > Changes since last version: > - rework test case in last patch wrt. ctx->skb dereference etc (Alexei) > - pacify bpf ci tests, netfilter program type missed string translation > in libbpf helper. > > This still uses runtime btf walk rather than extending > the btf trace array as Alexei suggested, I would do this later (or someone else can). > > [...] Here is the summary with links: - [bpf-next,v5,1/7] bpf: add bpf_link support for BPF_NETFILTER programs https://git.kernel.org/bpf/bpf-next/c/84601d6ee68a - [bpf-next,v5,2/7] bpf: minimal support for programs hooked into netfilter framework https://git.kernel.org/bpf/bpf-next/c/fd9c663b9ad6 - [bpf-next,v5,3/7] netfilter: nfnetlink hook: dump bpf prog id https://git.kernel.org/bpf/bpf-next/c/506a74db7e01 - [bpf-next,v5,4/7] netfilter: disallow bpf hook attachment at same priority https://git.kernel.org/bpf/bpf-next/c/0bdc6da88f5b - [bpf-next,v5,5/7] tools: bpftool: print netfilter link info (no matching commit) - [bpf-next,v5,6/7] bpf: add test_run support for netfilter program type https://git.kernel.org/bpf/bpf-next/c/2b99ef22e0d2 - [bpf-next,v5,7/7] selftests/bpf: add missing netfilter return value and ctx access tests https://git.kernel.org/bpf/bpf-next/c/006c0e44ed92 You are awesome, thank you!
On Fri, Apr 21, 2023 at 06:50:21PM +0000, patchwork-bot+netdevbpf@kernel.org wrote: > Hello: > > This series was applied to bpf/bpf-next.git (master) > by Alexei Starovoitov <ast@kernel.org>: Yay! I'm getting a procedure done on my wrist so I'll be unable to code for a week or two. When I recover I'll get on the conntrack stuff + a selftest. If anyone has a burning desire to do it before then, feel free to go ahead. Thanks, Daniel
Changes since last version: - rework test case in last patch wrt. ctx->skb dereference etc (Alexei) - pacify bpf ci tests, netfilter program type missed string translation in libbpf helper. This still uses runtime btf walk rather than extending the btf trace array as Alexei suggested, I would do this later (or someone else can). v1 cover letter: Add minimal support to hook bpf programs to netfilter hooks, e.g. PREROUTING or FORWARD. For this the most relevant parts for registering a netfilter hook via the in-kernel api are exposed to userspace via bpf_link. The new program type is 'tracing style', i.e. there is no context access rewrite done by verifier, the function argument (struct bpf_nf_ctx) isn't stable. There is no support for direct packet access, dynptr api should be used instead. With this its possible to build a small test program such as: #include "vmlinux.h" extern int bpf_dynptr_from_skb(struct __sk_buff *skb, __u64 flags, struct bpf_dynptr *ptr__uninit) __ksym; extern void *bpf_dynptr_slice(const struct bpf_dynptr *ptr, uint32_t offset, void *buffer, uint32_t buffer__sz) __ksym; SEC("netfilter") int nf_test(struct bpf_nf_ctx *ctx) { struct nf_hook_state *state = ctx->state; struct sk_buff *skb = ctx->skb; const struct iphdr *iph, _iph; const struct tcphdr *th, _th; struct bpf_dynptr ptr; if (bpf_dynptr_from_skb(skb, 0, &ptr)) return NF_DROP; iph = bpf_dynptr_slice(&ptr, 0, &_iph, sizeof(_iph)); if (!iph) return NF_DROP; th = bpf_dynptr_slice(&ptr, iph->ihl << 2, &_th, sizeof(_th)); if (!th) return NF_DROP; bpf_printk("accept %x:%d->%x:%d, hook %d ifin %d\n", iph->saddr, bpf_ntohs(th->source), iph->daddr, bpf_ntohs(th->dest), state->hook, state->in->ifindex); return NF_ACCEPT; } Then, tail /sys/kernel/tracing/trace_pipe. Changes since v3: - uapi: remove 'reserved' struct member, s/prio/priority (Alexei) - add ctx access test cases (Alexei, see last patch) - some arm32 can only handle cmpxchg on u32 (build bot) - Fix kdoc annotations (Simon Horman) - bpftool: prefer p_err, not fprintf (Quentin) - add test cases in separate patch Changes since v2: 1. don't WARN when user calls 'bpftool loink detach' twice restrict attachment to ip+ip6 families, lets relax this later in case arp/bridge/netdev are needed too. 2. show netfilter links in 'bpftool net' output as well. Changes since v1: 1. Don't fail to link when CONFIG_NETFILTER=n (build bot) 2. Use test_progs instead of test_verifier (Alexei) Changes since last RFC version: 1. extend 'bpftool link show' to print prio/hooknum etc 2. extend 'nft list hooks' so it can print the bpf program id 3. Add an extra patch to artificially restrict bpf progs with same priority. Its fine from a technical pov but it will cause ordering issues (most recent one comes first). Can be removed later. 4. Add test_run support for netfilter prog type and a small extension to verifier tests to make sure we can't return verdicts like NF_STOLEN. 5. Alter the netfilter part of the bpf_link uapi struct: - add flags/reserved members. Not used here except returning errors when they are nonzero. Plan is to allow the bpf_link users to enable netfilter defrag or conntrack engine by setting feature flags at link create time in the future. Florian Westphal (7): bpf: add bpf_link support for BPF_NETFILTER programs bpf: minimal support for programs hooked into netfilter framework netfilter: nfnetlink hook: dump bpf prog id netfilter: disallow bpf hook attachment at same priority tools: bpftool: print netfilter link info bpf: add test_run support for netfilter program type selftests/bpf: add missing netfilter return value and ctx access tests include/linux/bpf.h | 3 + include/linux/bpf_types.h | 4 + include/linux/netfilter.h | 1 + include/net/netfilter/nf_bpf_link.h | 15 ++ include/uapi/linux/bpf.h | 14 ++ include/uapi/linux/netfilter/nfnetlink_hook.h | 24 +- kernel/bpf/btf.c | 6 + kernel/bpf/syscall.c | 6 + kernel/bpf/verifier.c | 3 + net/bpf/test_run.c | 158 ++++++++++++ net/core/filter.c | 1 + net/netfilter/Kconfig | 3 + net/netfilter/Makefile | 1 + net/netfilter/core.c | 12 + net/netfilter/nf_bpf_link.c | 228 ++++++++++++++++++ net/netfilter/nfnetlink_hook.c | 81 ++++++- tools/bpf/bpftool/link.c | 83 +++++++ tools/bpf/bpftool/main.h | 3 + tools/bpf/bpftool/net.c | 106 ++++++++ tools/include/uapi/linux/bpf.h | 14 ++ tools/lib/bpf/libbpf.c | 3 + tools/lib/bpf/libbpf_probes.c | 1 + .../selftests/bpf/prog_tests/verifier.c | 4 + .../bpf/progs/verifier_netfilter_ctx.c | 121 ++++++++++ .../bpf/progs/verifier_netfilter_retcode.c | 49 ++++ 25 files changed, 928 insertions(+), 16 deletions(-) create mode 100644 include/net/netfilter/nf_bpf_link.h create mode 100644 net/netfilter/nf_bpf_link.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_netfilter_ctx.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_netfilter_retcode.c