-
Notifications
You must be signed in to change notification settings - Fork 90
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add sample usage for BPF_PROG_TYPE_NETFILTER
Signed-off-by: David Wang <[email protected]>
- Loading branch information
1 parent
aca10fb
commit 40bbc1d
Showing
6 changed files
with
369 additions
and
62 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,4 +11,7 @@ typedef __u64 u64; | |
|
|
||
| typedef s64 ktime_t; | ||
|
|
||
| typedef u32 uint32_t; | ||
|
|
||
|
|
||
| #endif /* __VMLINUX_TYPES_H__ */ | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| # SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) | ||
|
|
||
| USER_TARGETS := netfilter_ip4_blocklist | ||
| BPF_TARGETS := netfilter_ip4_blocklist.bpf | ||
|
|
||
|
|
||
| LIB_DIR = ../lib | ||
|
|
||
| include $(LIB_DIR)/common.mk |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| # Introduction | ||
|
|
||
| BPF_PROG_TYPE_NETFILTER was introduced in 6.4, now with a new kernel, a bpf program could attach to netfilter hooks and handles package in a similiar way as iptables/nftables. By now, 6.5.0, there is no bpf kfunc implemented yet for DNAT/SNAT, and the only thing a bpf program can do is to decide whether to DROP the package or not. | ||
|
|
||
| * netfilter_ip4_blocklist.c/netfilter_ip4_blocklist.bpf.c | ||
|
|
||
| This sample code implements a simple ipv4 blocklist. | ||
| The bpf program drops package if destination ip address hits a match in the map of type BPF_MAP_TYPE_LPM_TRIE, | ||
| The userspace code would load the bpf program, attach it to netfilter's FORWARD/OUTPUT hook, and then write ip patterns into the bpf map. | ||
|
|
||
|
|
||
| # TODO | ||
|
|
||
| This sample hard-codes ip address to be blocked, just for demonstration. | ||
| It would be better to break the userspace program into two parts: | ||
| * init program | ||
| Loads bpf program and pin bpf program and map into somewhere under /sys/fs/bpf | ||
| * interactive program | ||
| add/delete/query ip blocklist via bpf map under /sys/fs/bpf | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| // SPDX-License-Identifier: GPL-2.0 | ||
|
|
||
| #include "vmlinux_local.h" | ||
| #include "linux/bpf.h" | ||
| #include <bpf/bpf_helpers.h> | ||
|
|
||
|
|
||
| #define NF_DROP 0 | ||
| #define NF_ACCEPT 1 | ||
|
|
||
| int bpf_dynptr_from_skb(struct sk_buff *skb, | ||
| __u64 flags, struct bpf_dynptr *ptr__uninit) __ksym; | ||
| void *bpf_dynptr_slice(const struct bpf_dynptr *ptr, | ||
| uint32_t offset, void *buffer, uint32_t buffer__sz) __ksym; | ||
|
|
||
|
|
||
| struct ipv4_lpm_key { | ||
| __u32 prefixlen; | ||
| __u32 data; | ||
| }; | ||
|
|
||
| struct { | ||
| __uint(type, BPF_MAP_TYPE_LPM_TRIE); | ||
| __type(key, struct ipv4_lpm_key); | ||
| __type(value, __u32); | ||
| __uint(map_flags, BPF_F_NO_PREALLOC); | ||
| __uint(max_entries, 200); | ||
| } ipv4_lpm_map SEC(".maps"); | ||
|
|
||
|
|
||
| SEC("netfilter") | ||
| int netfilter_ip4block(struct bpf_nf_ctx *ctx) | ||
| { | ||
| struct sk_buff *skb = ctx->skb; | ||
| struct bpf_dynptr ptr; | ||
| struct iphdr *p, iph = {}; | ||
| struct ipv4_lpm_key key; | ||
| __u32 *pvalue; | ||
|
|
||
| if (skb->len <= 20 || bpf_dynptr_from_skb(skb, 0, &ptr)) | ||
| return NF_ACCEPT; | ||
| p = bpf_dynptr_slice(&ptr, 0, &iph, sizeof(iph)); | ||
| if (!p) | ||
| return NF_ACCEPT; | ||
|
|
||
| /* ip4 only */ | ||
| if (p->version != 4) | ||
| return NF_ACCEPT; | ||
|
|
||
| /* search p->daddr in trie */ | ||
| key.prefixlen = 32; | ||
| key.data = p->daddr; | ||
| pvalue = bpf_map_lookup_elem(&ipv4_lpm_map, &key); | ||
| if (pvalue) { | ||
| /* cat /sys/kernel/debug/tracing/trace_pipe */ | ||
| bpf_printk("rule matched with %d...\n", *pvalue); | ||
| return NF_DROP; | ||
| } | ||
| return NF_ACCEPT; | ||
| } | ||
|
|
||
| char _license[] SEC("license") = "GPL"; | ||
|
|
Oops, something went wrong.