From patchwork Wed Aug 17 14:00:44 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Mack X-Patchwork-Id: 660132 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3sDrkx3pHpz9t2R for ; Thu, 18 Aug 2016 00:11:53 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752795AbcHQOLS (ORCPT ); Wed, 17 Aug 2016 10:11:18 -0400 Received: from svenfoo.org ([82.94.215.22]:47314 "EHLO mail.zonque.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752302AbcHQOLP (ORCPT ); Wed, 17 Aug 2016 10:11:15 -0400 X-Greylist: delayed 616 seconds by postgrey-1.27 at vger.kernel.org; Wed, 17 Aug 2016 10:11:14 EDT Received: from localhost (localhost [127.0.0.1]) by mail.zonque.de (Postfix) with ESMTP id 87E7FB821F; Wed, 17 Aug 2016 16:00:57 +0200 (CEST) Received: from mail.zonque.de ([127.0.0.1]) by localhost (rambrand.bugwerft.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rsOvWndMCPGL; Wed, 17 Aug 2016 16:00:57 +0200 (CEST) Received: from rabotti.localdomain (p5DDC7225.dip0.t-ipconnect.de [93.220.114.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.zonque.de (Postfix) with ESMTPSA id D78F6B821D; Wed, 17 Aug 2016 16:00:56 +0200 (CEST) From: Daniel Mack To: htejun@fb.com, daniel@iogearbox.net, ast@fb.com Cc: davem@davemloft.net, kafai@fb.com, fw@strlen.de, pablo@netfilter.org, harald@redhat.com, netdev@vger.kernel.org, Daniel Mack Subject: [RFC PATCH 1/5] bpf: add new prog type for cgroup socket filtering Date: Wed, 17 Aug 2016 16:00:44 +0200 Message-Id: <1471442448-1248-2-git-send-email-daniel@zonque.org> X-Mailer: git-send-email 2.5.5 In-Reply-To: <1471442448-1248-1-git-send-email-daniel@zonque.org> References: <1471442448-1248-1-git-send-email-daniel@zonque.org> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org For now, this program type is equivalent to BPF_PROG_TYPE_SOCKET_FILTER in terms of checks during the verification process. It may access the skb as well. Programs of this type will be attached to cgroups for network filtering and accounting. Signed-off-by: Daniel Mack --- include/uapi/linux/bpf.h | 1 + kernel/bpf/verifier.c | 1 + net/core/filter.c | 6 ++++++ 3 files changed, 8 insertions(+) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index da218fe..913b147 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -95,6 +95,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_SCHED_ACT, BPF_PROG_TYPE_TRACEPOINT, BPF_PROG_TYPE_XDP, + BPF_PROG_TYPE_CGROUP_SOCKET_FILTER, }; #define BPF_PSEUDO_MAP_FD 1 diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index f72f23b..3f3164e 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1777,6 +1777,7 @@ static bool may_access_skb(enum bpf_prog_type type) case BPF_PROG_TYPE_SOCKET_FILTER: case BPF_PROG_TYPE_SCHED_CLS: case BPF_PROG_TYPE_SCHED_ACT: + case BPF_PROG_TYPE_CGROUP_SOCKET_FILTER: return true; default: return false; diff --git a/net/core/filter.c b/net/core/filter.c index 5708999..c5d8332 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2733,12 +2733,18 @@ static struct bpf_prog_type_list xdp_type __read_mostly = { .type = BPF_PROG_TYPE_XDP, }; +static struct bpf_prog_type_list cg_sk_filter_type __read_mostly = { + .ops = &sk_filter_ops, + .type = BPF_PROG_TYPE_CGROUP_SOCKET_FILTER, +}; + static int __init register_sk_filter_ops(void) { bpf_register_prog_type(&sk_filter_type); bpf_register_prog_type(&sched_cls_type); bpf_register_prog_type(&sched_act_type); bpf_register_prog_type(&xdp_type); + bpf_register_prog_type(&cg_sk_filter_type); return 0; }