tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
netfilter: nfnetlink hook: dump bpf prog id
This allows userspace ("nft list hooks") to show which bpf program
is attached to which hook.
Without this, user only knows bpf prog is attached at prio
x, y, z at INPUT and FORWARD, but can't tell which program is where.
v4: kdoc fixups (Simon Horman)
Link: https://lore.kernel.org/bpf/ZEELzpNCnYJuZyod@corigine.com/
Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20230421170300.24115-4-fw@strlen.de
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
authored by
Florian Westphal
and committed by
Alexei Starovoitov
506a74db
fd9c663b
+89
-16
+21
-3
include/uapi/linux/netfilter/nfnetlink_hook.h
+21
-3
include/uapi/linux/netfilter/nfnetlink_hook.h
···
32
32
/**
33
33
* enum nfnl_hook_chain_info_attributes - chain description
34
34
*
35
-
* NFNLA_HOOK_INFO_DESC: nft chain and table name (enum nft_table_attributes) (NLA_NESTED)
36
-
* NFNLA_HOOK_INFO_TYPE: chain type (enum nfnl_hook_chaintype) (NLA_U32)
35
+
* @NFNLA_HOOK_INFO_DESC: nft chain and table name (NLA_NESTED)
36
+
* @NFNLA_HOOK_INFO_TYPE: chain type (enum nfnl_hook_chaintype) (NLA_U32)
37
+
*
38
+
* NFNLA_HOOK_INFO_DESC depends on NFNLA_HOOK_INFO_TYPE value:
39
+
* NFNL_HOOK_TYPE_NFTABLES: enum nft_table_attributes
40
+
* NFNL_HOOK_TYPE_BPF: enum nfnl_hook_bpf_attributes
37
41
*/
38
42
enum nfnl_hook_chain_info_attributes {
39
43
NFNLA_HOOK_INFO_UNSPEC,
···
59
55
/**
60
56
* enum nfnl_hook_chaintype - chain type
61
57
*
62
-
* @NFNL_HOOK_TYPE_NFTABLES nf_tables base chain
58
+
* @NFNL_HOOK_TYPE_NFTABLES: nf_tables base chain
59
+
* @NFNL_HOOK_TYPE_BPF: bpf program
63
60
*/
64
61
enum nfnl_hook_chaintype {
65
62
NFNL_HOOK_TYPE_NFTABLES = 0x1,
63
+
NFNL_HOOK_TYPE_BPF,
66
64
};
65
+
66
+
/**
67
+
* enum nfnl_hook_bpf_attributes - bpf prog description
68
+
*
69
+
* @NFNLA_HOOK_BPF_ID: bpf program id (NLA_U32)
70
+
*/
71
+
enum nfnl_hook_bpf_attributes {
72
+
NFNLA_HOOK_BPF_UNSPEC,
73
+
NFNLA_HOOK_BPF_ID,
74
+
__NFNLA_HOOK_BPF_MAX,
75
+
};
76
+
#define NFNLA_HOOK_BPF_MAX (__NFNLA_HOOK_BPF_MAX - 1)
67
77
68
78
#endif /* _NFNL_HOOK_H */
+68
-13
net/netfilter/nfnetlink_hook.c
+68
-13
net/netfilter/nfnetlink_hook.c
···
5
5
* Author: Florian Westphal <fw@strlen.de>
6
6
*/
7
7
8
+
#include <linux/bpf.h>
8
9
#include <linux/module.h>
9
10
#include <linux/kallsyms.h>
10
11
#include <linux/kernel.h>
···
58
57
u8 hook;
59
58
};
60
59
60
+
static struct nlattr *nfnl_start_info_type(struct sk_buff *nlskb, enum nfnl_hook_chaintype t)
61
+
{
62
+
struct nlattr *nest = nla_nest_start(nlskb, NFNLA_HOOK_CHAIN_INFO);
63
+
int ret;
64
+
65
+
if (!nest)
66
+
return NULL;
67
+
68
+
ret = nla_put_be32(nlskb, NFNLA_HOOK_INFO_TYPE, htonl(t));
69
+
if (ret == 0)
70
+
return nest;
71
+
72
+
nla_nest_cancel(nlskb, nest);
73
+
return NULL;
74
+
}
75
+
76
+
static int nfnl_hook_put_bpf_prog_info(struct sk_buff *nlskb,
77
+
const struct nfnl_dump_hook_data *ctx,
78
+
unsigned int seq,
79
+
const struct bpf_prog *prog)
80
+
{
81
+
struct nlattr *nest, *nest2;
82
+
int ret;
83
+
84
+
if (!IS_ENABLED(CONFIG_NETFILTER_BPF_LINK))
85
+
return 0;
86
+
87
+
if (WARN_ON_ONCE(!prog))
88
+
return 0;
89
+
90
+
nest = nfnl_start_info_type(nlskb, NFNL_HOOK_TYPE_BPF);
91
+
if (!nest)
92
+
return -EMSGSIZE;
93
+
94
+
nest2 = nla_nest_start(nlskb, NFNLA_HOOK_INFO_DESC);
95
+
if (!nest2)
96
+
goto cancel_nest;
97
+
98
+
ret = nla_put_be32(nlskb, NFNLA_HOOK_BPF_ID, htonl(prog->aux->id));
99
+
if (ret)
100
+
goto cancel_nest;
101
+
102
+
nla_nest_end(nlskb, nest2);
103
+
nla_nest_end(nlskb, nest);
104
+
return 0;
105
+
106
+
cancel_nest:
107
+
nla_nest_cancel(nlskb, nest);
108
+
return -EMSGSIZE;
109
+
}
110
+
61
111
static int nfnl_hook_put_nft_chain_info(struct sk_buff *nlskb,
62
112
const struct nfnl_dump_hook_data *ctx,
63
113
unsigned int seq,
64
-
const struct nf_hook_ops *ops)
114
+
struct nft_chain *chain)
65
115
{
66
116
struct net *net = sock_net(nlskb->sk);
67
117
struct nlattr *nest, *nest2;
68
-
struct nft_chain *chain;
69
118
int ret = 0;
70
119
71
-
if (ops->hook_ops_type != NF_HOOK_OP_NF_TABLES)
72
-
return 0;
73
-
74
-
chain = ops->priv;
75
120
if (WARN_ON_ONCE(!chain))
76
121
return 0;
77
122
78
123
if (!nft_is_active(net, chain))
79
124
return 0;
80
125
81
-
nest = nla_nest_start(nlskb, NFNLA_HOOK_CHAIN_INFO);
126
+
nest = nfnl_start_info_type(nlskb, NFNL_HOOK_TYPE_NFTABLES);
82
127
if (!nest)
83
128
return -EMSGSIZE;
84
-
85
-
ret = nla_put_be32(nlskb, NFNLA_HOOK_INFO_TYPE,
86
-
htonl(NFNL_HOOK_TYPE_NFTABLES));
87
-
if (ret)
88
-
goto cancel_nest;
89
129
90
130
nest2 = nla_nest_start(nlskb, NFNLA_HOOK_INFO_DESC);
91
131
if (!nest2)
···
213
171
if (ret)
214
172
goto nla_put_failure;
215
173
216
-
ret = nfnl_hook_put_nft_chain_info(nlskb, ctx, seq, ops);
174
+
switch (ops->hook_ops_type) {
175
+
case NF_HOOK_OP_NF_TABLES:
176
+
ret = nfnl_hook_put_nft_chain_info(nlskb, ctx, seq, ops->priv);
177
+
break;
178
+
case NF_HOOK_OP_BPF:
179
+
ret = nfnl_hook_put_bpf_prog_info(nlskb, ctx, seq, ops->priv);
180
+
break;
181
+
case NF_HOOK_OP_UNDEFINED:
182
+
break;
183
+
default:
184
+
WARN_ON_ONCE(1);
185
+
break;
186
+
}
187
+
217
188
if (ret)
218
189
goto nla_put_failure;
219
190