Support direct writes to nf_conn:mark from TC and XDP prog types. This is useful when applications want to store per-connection metadata. This is also particularly useful for applications that run both bpf and iptables/nftables because the latter can trivially access this metadata. One example use case would be if a bpf prog is responsible for advanced packet classification and iptables/nftables is later used for routing due to pre-existing/legacy code. Past discussion: - v4: https://lore.kernel.org/bpf/cover.1661192455.git.dxu@xxxxxxxxx/ - v3: https://lore.kernel.org/bpf/cover.1660951028.git.dxu@xxxxxxxxx/ - v2: https://lore.kernel.org/bpf/CAP01T74Sgn354dXGiFWFryu4vg+o8b9s9La1d9zEbC4LGvH4qg@xxxxxxxxxxxxxx/T/ - v1: https://lore.kernel.org/bpf/cover.1660592020.git.dxu@xxxxxxxxx/ Changes since v4: - Use exported function pointer + mutex to handle CONFIG_NF_CONNTRACK=m case Changes since v3: - Use a mutex to protect module load/unload critical section Changes since v2: - Remove use of NOT_INIT for btf_struct_access write path - Disallow nf_conn writing when nf_conntrack module not loaded - Support writing to nf_conn___init:mark Changes since v1: - Add unimplemented stub for when !CONFIG_BPF_SYSCALL Daniel Xu (6): bpf: Remove duplicate PTR_TO_BTF_ID RO check bpf: Add stub for btf_struct_access() bpf: Use 0 instead of NOT_INIT for btf_struct_access() writes bpf: Export btf_type_by_id() and bpf_log() bpf: Add support for writing to nf_conn:mark selftests/bpf: Add tests for writing to nf_conn:mark include/linux/bpf.h | 9 +++ include/net/netfilter/nf_conntrack_bpf.h | 23 +++++++ kernel/bpf/btf.c | 1 + kernel/bpf/verifier.c | 4 +- net/core/filter.c | 54 +++++++++++++++ net/ipv4/bpf_tcp_ca.c | 2 +- net/netfilter/nf_conntrack_bpf.c | 66 ++++++++++++++++++- net/netfilter/nf_conntrack_core.c | 1 + .../testing/selftests/bpf/prog_tests/bpf_nf.c | 2 + .../testing/selftests/bpf/progs/test_bpf_nf.c | 9 ++- .../selftests/bpf/progs/test_bpf_nf_fail.c | 14 ++++ 11 files changed, 178 insertions(+), 7 deletions(-) -- 2.37.1
