Add sample usage for BPF_PROG_TYPE_NETFILTER #98
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,4 +11,7 @@ typedef __u64 u64; | |
|
|
||
| typedef s64 ktime_t; | ||
|
|
||
| typedef u32 uint32_t; | ||
|
|
||
|
|
||
| #endif /* __VMLINUX_TYPES_H__ */ | ||
Submodule libbpf
updated
99 files
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| # SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) | ||
|
|
||
| USER_TARGETS := netfilter_ip4_blocklist | ||
| BPF_TARGETS := netfilter_ip4_blocklist.bpf | ||
|
|
||
|
|
||
| LIB_DIR = ../lib | ||
|
|
||
| include $(LIB_DIR)/common.mk |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| # Introduction | ||
|
|
||
| BPF_PROG_TYPE_NETFILTER was introduced in 6.4, now with a new kernel, a bpf program could attach to netfilter hooks and handles package in a similiar way as iptables/nftables. By now, 6.5.0, there is no bpf kfunc implemented yet for DNAT/SNAT, and the only thing a bpf program can do is to decide whether to DROP the package or not. | ||
|
|
||
| * netfilter_ip4_blocklist.c/netfilter_ip4_blocklist.bpf.c | ||
|
|
||
| This sample code implements a simple ipv4 blocklist. | ||
| The bpf program drops package if destination ip address hits a match in the map of type BPF_MAP_TYPE_LPM_TRIE, | ||
| The userspace code would load the bpf program, attach it to netfilter's FORWARD/OUTPUT hook, and then write ip patterns into the bpf map. | ||
|
|
||
|
|
||
| # TODO | ||
|
|
||
| This sample hard-codes ip address to be blocked, just for demonstration. | ||
| It would be better to break the userspace program into two parts: | ||
| * init program | ||
| Loads bpf program and pin bpf program and map into somewhere under /sys/fs/bpf | ||
| * interactive program | ||
| add/delete/query ip blocklist via bpf map under /sys/fs/bpf | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| // SPDX-License-Identifier: GPL-2.0 | ||
|
|
||
| #include "vmlinux_local.h" | ||
| #include "linux/bpf.h" | ||
| #include <bpf/bpf_helpers.h> | ||
|
|
||
|
|
||
| #define NF_DROP 0 | ||
| #define NF_ACCEPT 1 | ||
|
|
||
| int bpf_dynptr_from_skb(struct sk_buff *skb, | ||
| __u64 flags, struct bpf_dynptr *ptr__uninit) __ksym; | ||
| void *bpf_dynptr_slice(const struct bpf_dynptr *ptr, | ||
| uint32_t offset, void *buffer, uint32_t buffer__sz) __ksym; | ||
|
|
||
|
|
||
| struct ipv4_lpm_key { | ||
| __u32 prefixlen; | ||
| __u32 data; | ||
| }; | ||
|
|
||
| struct { | ||
| __uint(type, BPF_MAP_TYPE_LPM_TRIE); | ||
| __type(key, struct ipv4_lpm_key); | ||
| __type(value, __u32); | ||
| __uint(map_flags, BPF_F_NO_PREALLOC); | ||
| __uint(max_entries, 200); | ||
| } ipv4_lpm_map SEC(".maps"); | ||
|
|
||
|
|
||
| SEC("netfilter") | ||
| int netfilter_ip4block(struct bpf_nf_ctx *ctx) | ||
| { | ||
| struct sk_buff *skb = ctx->skb; | ||
| struct bpf_dynptr ptr; | ||
| struct iphdr *p, iph = {}; | ||
| struct ipv4_lpm_key key; | ||
| __u32 *pvalue; | ||
|
|
||
| if (skb->len <= 20 || bpf_dynptr_from_skb(skb, 0, &ptr)) | ||
| return NF_ACCEPT; | ||
|
There was a problem hiding this comment. For consistency, let's have an empty line after this early return as well as the other ones. |
||
| p = bpf_dynptr_slice(&ptr, 0, &iph, sizeof(iph)); | ||
| if (!p) | ||
| return NF_ACCEPT; | ||
|
|
||
| /* ip4 only */ | ||
| if (p->version != 4) | ||
| return NF_ACCEPT; | ||
|
|
||
| /* search p->daddr in trie */ | ||
| key.prefixlen = 32; | ||
| key.data = p->daddr; | ||
| pvalue = bpf_map_lookup_elem(&ipv4_lpm_map, &key); | ||
| if (pvalue) { | ||
| /* cat /sys/kernel/debug/tracing/trace_pipe */ | ||
| bpf_printk("rule matched with %d...\n", *pvalue); | ||
| return NF_DROP; | ||
| } | ||
| return NF_ACCEPT; | ||
| } | ||
|
|
||
| char _license[] SEC("license") = "GPL"; | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please follow the kernel networking style of declaring variables in reverse x-mas tree order