On Wed, Jun 28, 2023 at 8:27 AM Florian Westphal <fw@xxxxxxxxx> wrote: > > Add new api function: bpf_program__attach_netfilter. > > It takes a bpf program (netfilter type), and a pointer to a option struct > that contains the desired attachment (protocol family, priority, hook > location, ...). > > It returns a pointer to a 'bpf_link' structure or NULL on error. > > Next patch adds new netfilter_basic test that uses this function to > attach a program to a few pf/hook/priority combinations. > > v2: change name and use bpf_link_create. > > Suggested-by: Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx> > Link: https://lore.kernel.org/bpf/CAEf4BzZrmUv27AJp0dDxBDMY_B8e55-wLs8DUKK69vCWsCG_pQ@xxxxxxxxxxxxxx/ > Link: https://lore.kernel.org/bpf/CAEf4BzZ69YgrQW7DHCJUT_X+GqMq_ZQQPBwopaJJVGFD5=d5Vg@xxxxxxxxxxxxxx/ > Signed-off-by: Florian Westphal <fw@xxxxxxxxx> > --- > tools/lib/bpf/bpf.c | 6 ++++++ > tools/lib/bpf/bpf.h | 6 ++++++ > tools/lib/bpf/libbpf.c | 42 ++++++++++++++++++++++++++++++++++++++++ > tools/lib/bpf/libbpf.h | 15 ++++++++++++++ > tools/lib/bpf/libbpf.map | 1 + > 5 files changed, 70 insertions(+) > > diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c > index ed86b37d8024..1b4f85f3c5b1 100644 > --- a/tools/lib/bpf/bpf.c > +++ b/tools/lib/bpf/bpf.c > @@ -741,6 +741,12 @@ int bpf_link_create(int prog_fd, int target_fd, > if (!OPTS_ZEROED(opts, tracing)) > return libbpf_err(-EINVAL); > break; > + case BPF_NETFILTER: > + attr.link_create.netfilter.pf = OPTS_GET(opts, netfilter.pf, 0); > + attr.link_create.netfilter.hooknum = OPTS_GET(opts, netfilter.hooknum, 0); > + attr.link_create.netfilter.priority = OPTS_GET(opts, netfilter.priority, 0); > + attr.link_create.netfilter.flags = OPTS_GET(opts, netfilter.flags, 0); there should have also done this check: if (!OPTS_ZEROED(opts, netfilter)) return libbpf_err(-EINVAL); just like in other cases. I added it while applying to bpf-next, thanks. > + break; > default: > if (!OPTS_ZEROED(opts, flags)) > return libbpf_err(-EINVAL); > diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h > index 9aa0ee473754..c676295ab9bf 100644 > --- a/tools/lib/bpf/bpf.h > +++ b/tools/lib/bpf/bpf.h > @@ -349,6 +349,12 @@ struct bpf_link_create_opts { > struct { > __u64 cookie; > } tracing; > + struct { > + __u32 pf; > + __u32 hooknum; > + __s32 priority; > + __u32 flags; > + } netfilter; > }; > size_t :0; > }; > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c > index 214f828ece6b..f193eca16382 100644 > --- a/tools/lib/bpf/libbpf.c > +++ b/tools/lib/bpf/libbpf.c > @@ -11811,6 +11811,48 @@ static int attach_iter(const struct bpf_program *prog, long cookie, struct bpf_l > return libbpf_get_error(*link); > } > > +struct bpf_link *bpf_program__attach_netfilter(const struct bpf_program *prog, > + const struct bpf_netfilter_opts *opts) > +{ > + LIBBPF_OPTS(bpf_link_create_opts, lopts); > + struct bpf_link *link; > + int prog_fd, link_fd; > + > + if (!OPTS_VALID(opts, bpf_netfilter_opts)) > + return libbpf_err_ptr(-EINVAL); > + > + prog_fd = bpf_program__fd(prog); > + if (prog_fd < 0) { > + pr_warn("prog '%s': can't attach before loaded\n", prog->name); > + return libbpf_err_ptr(-EINVAL); > + } > + > + link = calloc(1, sizeof(*link)); > + if (!link) > + return libbpf_err_ptr(-ENOMEM); > + > + link->detach = &bpf_link__detach_fd; > + > + lopts.netfilter.pf = OPTS_GET(opts, pf, 0); > + lopts.netfilter.hooknum = OPTS_GET(opts, hooknum, 0); > + lopts.netfilter.priority = OPTS_GET(opts, priority, 0); > + lopts.netfilter.flags = OPTS_GET(opts, flags, 0); > + > + link_fd = bpf_link_create(prog_fd, 0, BPF_NETFILTER, &lopts); > + if (link_fd < 0) { > + char errmsg[STRERR_BUFSIZE]; > + > + link_fd = -errno; > + free(link); > + pr_warn("prog '%s': failed to attach to netfilter: %s\n", > + prog->name, libbpf_strerror_r(link_fd, errmsg, sizeof(errmsg))); > + return libbpf_err_ptr(link_fd); > + } > + link->fd = link_fd; > + > + return link; > +} > + > struct bpf_link *bpf_program__attach(const struct bpf_program *prog) > { > struct bpf_link *link = NULL; > diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h > index 754da73c643b..10642ad69d76 100644 > --- a/tools/lib/bpf/libbpf.h > +++ b/tools/lib/bpf/libbpf.h > @@ -718,6 +718,21 @@ LIBBPF_API struct bpf_link * > bpf_program__attach_freplace(const struct bpf_program *prog, > int target_fd, const char *attach_func_name); > > +struct bpf_netfilter_opts { > + /* size of this struct, for forward/backward compatibility */ > + size_t sz; > + > + __u32 pf; > + __u32 hooknum; > + __s32 priority; > + __u32 flags; > +}; > +#define bpf_netfilter_opts__last_field flags > + > +LIBBPF_API struct bpf_link * > +bpf_program__attach_netfilter(const struct bpf_program *prog, > + const struct bpf_netfilter_opts *opts); > + > struct bpf_map; > > LIBBPF_API struct bpf_link *bpf_map__attach_struct_ops(const struct bpf_map *map); > diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map > index 7521a2fb7626..d9ec4407befa 100644 > --- a/tools/lib/bpf/libbpf.map > +++ b/tools/lib/bpf/libbpf.map > @@ -395,4 +395,5 @@ LIBBPF_1.2.0 { > LIBBPF_1.3.0 { > global: > bpf_obj_pin_opts; > + bpf_program__attach_netfilter; > } LIBBPF_1.2.0; > -- > 2.39.3 >
