From nobody Mon Feb 9 20:36:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB979EB64D7 for ; Mon, 26 Jun 2023 23:02:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229895AbjFZXCe (ORCPT ); Mon, 26 Jun 2023 19:02:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51142 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229670AbjFZXCZ (ORCPT ); Mon, 26 Jun 2023 19:02:25 -0400 Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BB8C310E4; Mon, 26 Jun 2023 16:02:23 -0700 (PDT) Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id DC6B75C00D1; Mon, 26 Jun 2023 19:02:21 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Mon, 26 Jun 2023 19:02:21 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm1; t=1687820541; x= 1687906941; bh=LRmuab6R6ClXxsIAWdYJTaRQBWQe0tQBAwVSwfhEFfo=; b=W vGr/IAGBJ68pi0ITGDMOThI/yMAX6bfzgCui+WGs/mNqYRCF5msAqPcRY8BA4Bxz VswhWZdEFDv3gz9ZfHHhe831FsjnSgPPhf4w4wrLENtxlzEQUJydvO7/GzJ+B4Dd FXYdQ3ujPExgosN0qlvN4STM1HMaRkEyrwTGSjou8O9C46+4CPNHxXYMP6ri0brf iTlUOm5eoacHdGzz+8D4o2jNWiiWz9y5+Mf5hX2D7wNpVgGFxVUi1IVmBieud/8W mX0eExhyktgWpYgQ6PNHM9/jmlGW/5ce5hTWkSldFrOo6nkx+FfDq5zeFI2Hpnri 8doXxtygnTC3rly7jHyMg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1687820541; x= 1687906941; bh=LRmuab6R6ClXxsIAWdYJTaRQBWQe0tQBAwVSwfhEFfo=; b=D NdRYjuJs3JQlLviXVmGUlBxSoRC1pfg2ysGH1jy6WVgxBB4giDyW/fnNETWVBx6b 7lMaKzMWaYs8J2yCZhRLnB/5wJWPaZe3yVhNBl4C55n6Hq55mScoRheN5zELF871 twNI2qitcM/glGYECOer1WHFo0Vf7lkOac2O2OseazGn08omZmZH1HHoCVFnguLf MX99aqi516JTx3Fnj/c1mONYcBQ7l0tPoGTJsfPntVMR83NEgjel2DBFGXhp0019 x1ZmRJub4qNVWrGbC3XcEnOBv3FilO6JjPO4VlAtddeQSomXGU6U1IvayG2K6kyB hzBF6EU0+izhyXlfKEMwQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvhedrgeehgedgudejucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne gfrhhlucfvnfffucdlvdefmdenucfjughrpefhvfevufffkffojghfggfgsedtkeertder tddtnecuhfhrohhmpeffrghnihgvlhcuighuuceougiguhesugiguhhuuhdrgiihiieqne cuggftrfgrthhtvghrnhepjeegveeljeehvdevudduffffleelveejueegjedvhedvhedv heethfejgedtieeinecuffhomhgrihhnpehnvghtfhhilhhtvghrrdhpfhenucevlhhush htvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegugihusegugihuuhhu rdighiii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Mon, 26 Jun 2023 19:02:19 -0400 (EDT) From: Daniel Xu To: daniel@iogearbox.net, ast@kernel.org, andrii@kernel.org, fw@strlen.de Cc: martin.lau@linux.dev, song@kernel.org, yhs@fb.com, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, dsahern@kernel.org, Andrii Nakryiko Subject: [PATCH bpf-next 1/7] tools: libbpf: add netfilter link attach helper Date: Mon, 26 Jun 2023 17:02:08 -0600 Message-Id: X-Mailer: git-send-email 2.40.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Add new api function: bpf_program__attach_netfilter. It takes a bpf program (netfilter type), and a pointer to a option struct that contains the desired attachment (protocol family, priority, hook location, ...). It returns a pointer to a 'bpf_link' structure or NULL on error. Next patch adds new netfilter_basic test that uses this function to attach a program to a few pf/hook/priority combinations. Co-developed-by: Florian Westphal Signed-off-by: Florian Westphal Suggested-by: Andrii Nakryiko Signed-off-by: Daniel Xu --- tools/lib/bpf/bpf.c | 8 +++++++ tools/lib/bpf/bpf.h | 6 +++++ tools/lib/bpf/libbpf.c | 47 ++++++++++++++++++++++++++++++++++++++++ tools/lib/bpf/libbpf.h | 15 +++++++++++++ tools/lib/bpf/libbpf.map | 1 + 5 files changed, 77 insertions(+) diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c index ed86b37d8024..3b0da19715e1 100644 --- a/tools/lib/bpf/bpf.c +++ b/tools/lib/bpf/bpf.c @@ -741,6 +741,14 @@ int bpf_link_create(int prog_fd, int target_fd, if (!OPTS_ZEROED(opts, tracing)) return libbpf_err(-EINVAL); break; + case BPF_NETFILTER: + attr.link_create.netfilter.pf =3D OPTS_GET(opts, netfilter.pf, 0); + attr.link_create.netfilter.hooknum =3D OPTS_GET(opts, netfilter.hooknum,= 0); + attr.link_create.netfilter.priority =3D OPTS_GET(opts, netfilter.priorit= y, 0); + attr.link_create.netfilter.flags =3D OPTS_GET(opts, netfilter.flags, 0); + if (!OPTS_ZEROED(opts, netfilter)) + return libbpf_err(-EINVAL); + break; default: if (!OPTS_ZEROED(opts, flags)) return libbpf_err(-EINVAL); diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h index 9aa0ee473754..c676295ab9bf 100644 --- a/tools/lib/bpf/bpf.h +++ b/tools/lib/bpf/bpf.h @@ -349,6 +349,12 @@ struct bpf_link_create_opts { struct { __u64 cookie; } tracing; + struct { + __u32 pf; + __u32 hooknum; + __s32 priority; + __u32 flags; + } netfilter; }; size_t :0; }; diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c index 214f828ece6b..a8b9d5abb55f 100644 --- a/tools/lib/bpf/libbpf.c +++ b/tools/lib/bpf/libbpf.c @@ -11811,6 +11811,53 @@ static int attach_iter(const struct bpf_program *p= rog, long cookie, struct bpf_l return libbpf_get_error(*link); } =20 +struct bpf_link *bpf_program__attach_netfilter(const struct bpf_program *p= rog, + const struct bpf_netfilter_opts *opts) +{ + DECLARE_LIBBPF_OPTS(bpf_link_create_opts, link_create_opts); + struct bpf_link *link; + int prog_fd, link_fd; + + if (!OPTS_VALID(opts, bpf_netfilter_opts)) + return libbpf_err_ptr(-EINVAL); + + link_create_opts.netfilter.pf =3D OPTS_GET(opts, pf, 0); + link_create_opts.netfilter.hooknum =3D OPTS_GET(opts, hooknum, 0); + link_create_opts.netfilter.priority =3D OPTS_GET(opts, priority, 0); + link_create_opts.netfilter.flags =3D OPTS_GET(opts, flags, 0); + + prog_fd =3D bpf_program__fd(prog); + if (prog_fd < 0) { + pr_warn("prog '%s': can't attach before loaded\n", prog->name); + return libbpf_err_ptr(-EINVAL); + } + + link =3D calloc(1, sizeof(*link)); + if (!link) + return libbpf_err_ptr(-ENOMEM); + link->detach =3D &bpf_link__detach_fd; + + link_fd =3D bpf_link_create(prog_fd, 0, BPF_NETFILTER, &link_create_opts); + + link->fd =3D ensure_good_fd(link_fd); + + if (link->fd < 0) { + char errmsg[STRERR_BUFSIZE]; + + link_fd =3D -errno; + free(link); + pr_warn("prog '%s': failed to attach to pf:%d,hooknum:%d:prio:%d: %s\n", + prog->name, + OPTS_GET(opts, pf, 0), + OPTS_GET(opts, hooknum, 0), + OPTS_GET(opts, priority, 0), + libbpf_strerror_r(link_fd, errmsg, sizeof(errmsg))); + return libbpf_err_ptr(link_fd); + } + + return link; +} + struct bpf_link *bpf_program__attach(const struct bpf_program *prog) { struct bpf_link *link =3D NULL; diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h index 754da73c643b..10642ad69d76 100644 --- a/tools/lib/bpf/libbpf.h +++ b/tools/lib/bpf/libbpf.h @@ -718,6 +718,21 @@ LIBBPF_API struct bpf_link * bpf_program__attach_freplace(const struct bpf_program *prog, int target_fd, const char *attach_func_name); =20 +struct bpf_netfilter_opts { + /* size of this struct, for forward/backward compatibility */ + size_t sz; + + __u32 pf; + __u32 hooknum; + __s32 priority; + __u32 flags; +}; +#define bpf_netfilter_opts__last_field flags + +LIBBPF_API struct bpf_link * +bpf_program__attach_netfilter(const struct bpf_program *prog, + const struct bpf_netfilter_opts *opts); + struct bpf_map; =20 LIBBPF_API struct bpf_link *bpf_map__attach_struct_ops(const struct bpf_ma= p *map); diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map index 7521a2fb7626..d9ec4407befa 100644 --- a/tools/lib/bpf/libbpf.map +++ b/tools/lib/bpf/libbpf.map @@ -395,4 +395,5 @@ LIBBPF_1.2.0 { LIBBPF_1.3.0 { global: bpf_obj_pin_opts; + bpf_program__attach_netfilter; } LIBBPF_1.2.0; --=20 2.40.1