net/netfilter/nf_bpf_link.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <linux/bpf.h>
   3 #include <linux/filter.h>
   4 #include <linux/netfilter.h>
   5
   6 #include <net/netfilter/nf_bpf_link.h>
   7 #include <uapi/linux/netfilter_ipv4.h>
   8
   9 static unsigned int nf_hook_run_bpf(void *bpf_prog, struct sk_buff *skb,
  10                                     const struct nf_hook_state *s)
  11 {
  12         const struct bpf_prog *prog = bpf_prog;
  13         struct bpf_nf_ctx ctx = {
  14                 .state = s,
  15                 .skb = skb,
  16         };
  17
  18         return bpf_prog_run(prog, &ctx);
  19 }
  20
  21 struct bpf_nf_link {
  22         struct bpf_link link;
  23         struct nf_hook_ops hook_ops;
  24         struct net *net;
  25         u32 dead;
  26 };
  27
  28 static void bpf_nf_link_release(struct bpf_link *link)
  29 {
  30         struct bpf_nf_link *nf_link = container_of(link, struct bpf_nf_link, link);
  31
  32         if (nf_link->dead)
  33                 return;
  34
  35         /* prevent hook-not-found warning splat from netfilter core when
  36          * .detach was already called
  37          */
  38         if (!cmpxchg(&nf_link->dead, 0, 1))
  39                 nf_unregister_net_hook(nf_link->net, &nf_link->hook_ops);
  40 }
  41
  42 static void bpf_nf_link_dealloc(struct bpf_link *link)
  43 {
  44         struct bpf_nf_link *nf_link = container_of(link, struct bpf_nf_link, link);
  45
  46         kfree(nf_link);
  47 }
  48
  49 static int bpf_nf_link_detach(struct bpf_link *link)
  50 {
  51         bpf_nf_link_release(link);
  52         return 0;
  53 }
  54
  55 static void bpf_nf_link_show_info(const struct bpf_link *link,
  56                                   struct seq_file *seq)
  57 {
  58         struct bpf_nf_link *nf_link = container_of(link, struct bpf_nf_link, link);
  59
  60         seq_printf(seq, "pf:\t%u\thooknum:\t%u\tprio:\t%d\n",
  61                    nf_link->hook_ops.pf, nf_link->hook_ops.hooknum,
  62                    nf_link->hook_ops.priority);
  63 }
  64
  65 static int bpf_nf_link_fill_link_info(const struct bpf_link *link,
  66                                       struct bpf_link_info *info)
  67 {
  68         struct bpf_nf_link *nf_link = container_of(link, struct bpf_nf_link, link);
  69
  70         info->netfilter.pf = nf_link->hook_ops.pf;
  71         info->netfilter.hooknum = nf_link->hook_ops.hooknum;
  72         info->netfilter.priority = nf_link->hook_ops.priority;
  73         info->netfilter.flags = 0;
  74
  75         return 0;
  76 }
  77
  78 static int bpf_nf_link_update(struct bpf_link *link, struct bpf_prog *new_prog,
  79                               struct bpf_prog *old_prog)
  80 {
  81         return -EOPNOTSUPP;
  82 }
  83
  84 static const struct bpf_link_ops bpf_nf_link_lops = {
  85         .release = bpf_nf_link_release,
  86         .dealloc = bpf_nf_link_dealloc,
  87         .detach = bpf_nf_link_detach,
  88         .show_fdinfo = bpf_nf_link_show_info,
  89         .fill_link_info = bpf_nf_link_fill_link_info,
  90         .update_prog = bpf_nf_link_update,
  91 };
  92
  93 static int bpf_nf_check_pf_and_hooks(const union bpf_attr *attr)
  94 {
  95         switch (attr->link_create.netfilter.pf) {
  96         case NFPROTO_IPV4:
  97         case NFPROTO_IPV6:
  98                 if (attr->link_create.netfilter.hooknum >= NF_INET_NUMHOOKS)
  99                         return -EPROTO;
 100                 break;
 101         default:
 102                 return -EAFNOSUPPORT;
 103         }
 104
 105         if (attr->link_create.netfilter.flags)
 106                 return -EOPNOTSUPP;
 107
 108         /* make sure conntrack confirm is always last.
 109          *
 110          * In the future, if userspace can e.g. request defrag, then
 111          * "defrag_requested && prio before NF_IP_PRI_CONNTRACK_DEFRAG"
 112          * should fail.
 113          */
 114         switch (attr->link_create.netfilter.priority) {
 115         case NF_IP_PRI_FIRST: return -ERANGE; /* sabotage_in and other warts */
 116         case NF_IP_PRI_LAST: return -ERANGE; /* e.g. conntrack confirm */
 117         }
 118
 119         return 0;
 120 }
 121
 122 int bpf_nf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 123 {
 124         struct net *net = current->nsproxy->net_ns;
 125         struct bpf_link_primer link_primer;
 126         struct bpf_nf_link *link;
 127         int err;
 128
 129         if (attr->link_create.flags)
 130                 return -EINVAL;
 131
 132         err = bpf_nf_check_pf_and_hooks(attr);
 133         if (err)
 134                 return err;
 135
 136         link = kzalloc(sizeof(*link), GFP_USER);
 137         if (!link)
 138                 return -ENOMEM;
 139
 140         bpf_link_init(&link->link, BPF_LINK_TYPE_NETFILTER, &bpf_nf_link_lops, prog);
 141
 142         link->hook_ops.hook = nf_hook_run_bpf;
 143         link->hook_ops.hook_ops_type = NF_HOOK_OP_BPF;
 144         link->hook_ops.priv = prog;
 145
 146         link->hook_ops.pf = attr->link_create.netfilter.pf;
 147         link->hook_ops.priority = attr->link_create.netfilter.priority;
 148         link->hook_ops.hooknum = attr->link_create.netfilter.hooknum;
 149
 150         link->net = net;
 151         link->dead = false;
 152
 153         err = bpf_link_prime(&link->link, &link_primer);
 154         if (err) {
 155                 kfree(link);
 156                 return err;
 157         }
 158
 159         err = nf_register_net_hook(net, &link->hook_ops);
 160         if (err) {
 161                 bpf_link_cleanup(&link_primer);
 162                 return err;
 163         }
 164
 165         return bpf_link_settle(&link_primer);
 166 }
 167
 168 const struct bpf_prog_ops netfilter_prog_ops = {
 169 };
 170
 171 static bool nf_ptr_to_btf_id(struct bpf_insn_access_aux *info, const char *name)
 172 {
 173         struct btf *btf;
 174         s32 type_id;
 175
 176         btf = bpf_get_btf_vmlinux();
 177         if (IS_ERR_OR_NULL(btf))
 178                 return false;
 179
 180         type_id = btf_find_by_name_kind(btf, name, BTF_KIND_STRUCT);
 181         if (WARN_ON_ONCE(type_id < 0))
 182                 return false;
 183
 184         info->btf = btf;
 185         info->btf_id = type_id;
 186         info->reg_type = PTR_TO_BTF_ID | PTR_TRUSTED;
 187         return true;
 188 }
 189
 190 static bool nf_is_valid_access(int off, int size, enum bpf_access_type type,
 191                                const struct bpf_prog *prog,
 192                                struct bpf_insn_access_aux *info)
 193 {
 194         if (off < 0 || off >= sizeof(struct bpf_nf_ctx))
 195                 return false;
 196
 197         if (type == BPF_WRITE)
 198                 return false;
 199
 200         switch (off) {
 201         case bpf_ctx_range(struct bpf_nf_ctx, skb):
 202                 if (size != sizeof_field(struct bpf_nf_ctx, skb))
 203                         return false;
 204
 205                 return nf_ptr_to_btf_id(info, "sk_buff");
 206         case bpf_ctx_range(struct bpf_nf_ctx, state):
 207                 if (size != sizeof_field(struct bpf_nf_ctx, state))
 208                         return false;
 209
 210                 return nf_ptr_to_btf_id(info, "nf_hook_state");
 211         default:
 212                 return false;
 213         }
 214
 215         return false;
 216 }
 217
 218 static const struct bpf_func_proto *
 219 bpf_nf_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 220 {
 221         return bpf_base_func_proto(func_id);
 222 }
 223
 224 const struct bpf_verifier_ops netfilter_verifier_ops = {
 225         .is_valid_access        = nf_is_valid_access,
 226         .get_func_proto         = bpf_nf_func_proto,
 227 };