Add minimal support to hook bpf programs to netfilter hooks,
e.g. PREROUTING or FORWARD.
Hooking is currently possible for all supprted protocols, i.e.
arp, bridge, ip, ip6 and inet (both ipv4/ipv6) pseudo-family.
For this the most relevant parts for registering a netfilter
hook via the in-kernel api are exposed to userspace via bpf_link.
With this its possible to build a small test program such as:
SEC("netfilter")
int nf_test(struct __sk_buff *skb)
{
const struct iphdr *iph = (void *)skb->data;
if (iph + 1 < skb->data_end)
bpf_printk("%x,%x\n", iph->saddr, iph->daddr);
else
return NF_DROP;
return NF_ACCEPT;
}
(output can be observed via /sys/kernel/tracing/trace_pipe).
The prototype is wrong, future versions will instead expose
'struct bpf_nf_ctx' via btf, so programs will have to use
SEC("netfilter")
int nf_test(struct bpf_nf_ctx *ctx)
{
struct sk_buff *skb = ctx->skb; ...
I will work on this next but thought it was better to send
a current snapshot.
This series no longer depends on the proposed in-kernel
nf_hook_slow bpf translator.
Feedback welcome.
Florian Westphal (3):
bpf: add bpf_link support for BPF_NETFILTER programs
libbpf: sync header file, add nf prog section name
bpf: minimal support for programs hooked into netfilter framework
include/linux/bpf_types.h | 4 +
include/linux/netfilter.h | 1 +
include/net/netfilter/nf_hook_bpf.h | 10 ++
include/uapi/linux/bpf.h | 13 ++
kernel/bpf/btf.c | 3 +
kernel/bpf/syscall.c | 7 +
kernel/bpf/verifier.c | 3 +
net/netfilter/Kconfig | 3 +
net/netfilter/Makefile | 1 +
net/netfilter/nf_bpf_link.c | 242 ++++++++++++++++++++++++++++
tools/include/uapi/linux/bpf.h | 13 ++
tools/lib/bpf/libbpf.c | 1 +
12 files changed, 301 insertions(+)
create mode 100644 include/net/netfilter/nf_hook_bpf.h
create mode 100644 net/netfilter/nf_bpf_link.c
--
2.39.1
