tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/* Xtables module to match packets using a BPF filter.
2 * Copyright 2013 Google Inc.
3 * Written by Willem de Bruijn <willemb@google.com>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 */
9
10#include <linux/module.h>
11#include <linux/skbuff.h>
12#include <linux/filter.h>
13
14#include <linux/netfilter/xt_bpf.h>
15#include <linux/netfilter/x_tables.h>
16
17MODULE_AUTHOR("Willem de Bruijn <willemb@google.com>");
18MODULE_DESCRIPTION("Xtables: BPF filter match");
19MODULE_LICENSE("GPL");
20MODULE_ALIAS("ipt_bpf");
21MODULE_ALIAS("ip6t_bpf");
22
23static int bpf_mt_check(const struct xt_mtchk_param *par)
24{
25 struct xt_bpf_info *info = par->matchinfo;
26 struct sock_fprog program;
27
28 program.len = info->bpf_program_num_elem;
29 program.filter = (struct sock_filter __user *) info->bpf_program;
30 if (sk_unattached_filter_create(&info->filter, &program)) {
31 pr_info("bpf: check failed: parse error\n");
32 return -EINVAL;
33 }
34
35 return 0;
36}
37
38static bool bpf_mt(const struct sk_buff *skb, struct xt_action_param *par)
39{
40 const struct xt_bpf_info *info = par->matchinfo;
41
42 return SK_RUN_FILTER(info->filter, skb);
43}
44
45static void bpf_mt_destroy(const struct xt_mtdtor_param *par)
46{
47 const struct xt_bpf_info *info = par->matchinfo;
48 sk_unattached_filter_destroy(info->filter);
49}
50
51static struct xt_match bpf_mt_reg __read_mostly = {
52 .name = "bpf",
53 .revision = 0,
54 .family = NFPROTO_UNSPEC,
55 .checkentry = bpf_mt_check,
56 .match = bpf_mt,
57 .destroy = bpf_mt_destroy,
58 .matchsize = sizeof(struct xt_bpf_info),
59 .me = THIS_MODULE,
60};
61
62static int __init bpf_mt_init(void)
63{
64 return xt_register_match(&bpf_mt_reg);
65}
66
67static void __exit bpf_mt_exit(void)
68{
69 xt_unregister_match(&bpf_mt_reg);
70}
71
72module_init(bpf_mt_init);
73module_exit(bpf_mt_exit);