From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> Date: Mon, 19 Feb 2018 17:37:06 +0100 > From nf_tables_newrule(), this calls nft_jit_rule() that transforms > our internal expression structure layout to abstract syntax tree, then > we walk over this syntax tree to generate the BPF instructions that are > placed in the rule jit buffer. From the commit phase, collect all jit > buffers, place them in a BPF program that gets attached to the chain. > > This should be good enough to test simple payload and meta match. For > more sophisticated stuff, we may use internal bpf helpers to call our > _eval() functions. > > Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> I'm very suprised that this is generating classical BPF filters. We have native eBPF and that is what anything generating new code should be using, rather than the 20+ year old CBPF. Furthermore, we should not ever generate and use bpf code snippets to use directly in the kernel. Instead, all BPF code should be given to the kernel from userspace through the bpf syscall interface, so that the boundry is distinct and the verifier can be run properly on all pieces of eBPF code before the kernel uses it. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
