From patchwork Tue Sep 6 13:46:03 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Mack X-Patchwork-Id: 666589 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3sT7Dm5nMKz9s1h for ; Tue, 6 Sep 2016 23:46:48 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756229AbcIFNqo (ORCPT ); Tue, 6 Sep 2016 09:46:44 -0400 Received: from svenfoo.org ([82.94.215.22]:38303 "EHLO mail.zonque.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755955AbcIFNqR (ORCPT ); Tue, 6 Sep 2016 09:46:17 -0400 Received: from localhost (localhost [127.0.0.1]) by mail.zonque.de (Postfix) with ESMTP id A28FDC02A9; Tue, 6 Sep 2016 15:46:14 +0200 (CEST) Received: from mail.zonque.de ([127.0.0.1]) by localhost (rambrand.bugwerft.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eIXg3VZAo45t; Tue, 6 Sep 2016 15:46:14 +0200 (CEST) Received: from rabotti.localdomain (p5DDC7318.dip0.t-ipconnect.de [93.220.115.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.zonque.de (Postfix) with ESMTPSA id DEFCFC02AC; Tue, 6 Sep 2016 15:46:13 +0200 (CEST) From: Daniel Mack To: htejun@fb.com, daniel@iogearbox.net, ast@fb.com Cc: davem@davemloft.net, kafai@fb.com, fw@strlen.de, pablo@netfilter.org, harald@redhat.com, netdev@vger.kernel.org, sargun@sargun.me, cgroups@vger.kernel.org, Daniel Mack Subject: [PATCH v4 1/6] bpf: add new prog type for cgroup socket filtering Date: Tue, 6 Sep 2016 15:46:03 +0200 Message-Id: <1473169568-30525-2-git-send-email-daniel@zonque.org> X-Mailer: git-send-email 2.5.5 In-Reply-To: <1473169568-30525-1-git-send-email-daniel@zonque.org> References: <1473169568-30525-1-git-send-email-daniel@zonque.org> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org For now, this program type is equivalent to BPF_PROG_TYPE_SOCKET_FILTER in terms of checks during the verification process. It may access the skb as well. Programs of this type will be attached to cgroups for network filtering and accounting. Signed-off-by: Daniel Mack --- include/uapi/linux/bpf.h | 9 +++++++++ kernel/bpf/verifier.c | 1 + net/core/filter.c | 6 ++++++ 3 files changed, 16 insertions(+) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index f896dfa..55f815e 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -96,8 +96,17 @@ enum bpf_prog_type { BPF_PROG_TYPE_TRACEPOINT, BPF_PROG_TYPE_XDP, BPF_PROG_TYPE_PERF_EVENT, + BPF_PROG_TYPE_CGROUP_SOCKET, }; +enum bpf_attach_type { + BPF_CGROUP_INET_INGRESS, + BPF_CGROUP_INET_EGRESS, + __MAX_BPF_ATTACH_TYPE +}; + +#define MAX_BPF_ATTACH_TYPE __MAX_BPF_ATTACH_TYPE + #define BPF_PSEUDO_MAP_FD 1 /* flags for BPF_MAP_UPDATE_ELEM command */ diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 48c2705..1b8a871 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1805,6 +1805,7 @@ static bool may_access_skb(enum bpf_prog_type type) case BPF_PROG_TYPE_SOCKET_FILTER: case BPF_PROG_TYPE_SCHED_CLS: case BPF_PROG_TYPE_SCHED_ACT: + case BPF_PROG_TYPE_CGROUP_SOCKET: return true; default: return false; diff --git a/net/core/filter.c b/net/core/filter.c index a83766b..176b6f2 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2848,12 +2848,18 @@ static struct bpf_prog_type_list xdp_type __read_mostly = { .type = BPF_PROG_TYPE_XDP, }; +static struct bpf_prog_type_list cg_sk_type __read_mostly = { + .ops = &sk_filter_ops, + .type = BPF_PROG_TYPE_CGROUP_SOCKET, +}; + static int __init register_sk_filter_ops(void) { bpf_register_prog_type(&sk_filter_type); bpf_register_prog_type(&sched_cls_type); bpf_register_prog_type(&sched_act_type); bpf_register_prog_type(&xdp_type); + bpf_register_prog_type(&cg_sk_type); return 0; }