nf_flow_table_bpf.c

  1// SPDX-License-Identifier: GPL-2.0-only
  2/* Unstable Flow Table Helpers for XDP hook
  3 *
  4 * These are called from the XDP programs.
  5 * Note that it is allowed to break compatibility for these functions since
  6 * the interface they are exposed through to BPF programs is explicitly
  7 * unstable.
  8 */
  9
 10#include <linux/kernel.h>
 11#include <linux/init.h>
 12#include <linux/module.h>
 13#include <net/netfilter/nf_flow_table.h>
 14#include <linux/bpf.h>
 15#include <linux/btf.h>
 16#include <net/xdp.h>
 17
 18/* bpf_flowtable_opts - options for bpf flowtable helpers
 19 * @error: out parameter, set for any encountered error
 20 */
 21struct bpf_flowtable_opts {
 22	s32 error;
 23};
 24
 25enum {
 26	NF_BPF_FLOWTABLE_OPTS_SZ = 4,
 27};
 28
 29__diag_push();
 30__diag_ignore_all("-Wmissing-prototypes",
 31		  "Global functions as their definitions will be in nf_flow_table BTF");
 32
 33__bpf_kfunc_start_defs();
 34
 35static struct flow_offload_tuple_rhash *
 36bpf_xdp_flow_tuple_lookup(struct net_device *dev,
 37			  struct flow_offload_tuple *tuple, __be16 proto)
 38{
 39	struct flow_offload_tuple_rhash *tuplehash;
 40	struct nf_flowtable *nf_flow_table;
 41	struct flow_offload *nf_flow;
 42
 43	nf_flow_table = nf_flowtable_by_dev(dev);
 44	if (!nf_flow_table)
 45		return ERR_PTR(-ENOENT);
 46
 47	tuplehash = flow_offload_lookup(nf_flow_table, tuple);
 48	if (!tuplehash)
 49		return ERR_PTR(-ENOENT);
 50
 51	nf_flow = container_of(tuplehash, struct flow_offload,
 52			       tuplehash[tuplehash->tuple.dir]);
 53	flow_offload_refresh(nf_flow_table, nf_flow, false);
 54
 55	return tuplehash;
 56}
 57
 58__bpf_kfunc struct flow_offload_tuple_rhash *
 59bpf_xdp_flow_lookup(struct xdp_md *ctx, struct bpf_fib_lookup *fib_tuple,
 60		    struct bpf_flowtable_opts *opts, u32 opts_len)
 61{
 62	struct xdp_buff *xdp = (struct xdp_buff *)ctx;
 63	struct flow_offload_tuple tuple = {
 64		.iifidx = fib_tuple->ifindex,
 65		.l3proto = fib_tuple->family,
 66		.l4proto = fib_tuple->l4_protocol,
 67		.src_port = fib_tuple->sport,
 68		.dst_port = fib_tuple->dport,
 69	};
 70	struct flow_offload_tuple_rhash *tuplehash;
 71	__be16 proto;
 72
 73	if (opts_len != NF_BPF_FLOWTABLE_OPTS_SZ) {
 74		opts->error = -EINVAL;
 75		return NULL;
 76	}
 77
 78	switch (fib_tuple->family) {
 79	case AF_INET:
 80		tuple.src_v4.s_addr = fib_tuple->ipv4_src;
 81		tuple.dst_v4.s_addr = fib_tuple->ipv4_dst;
 82		proto = htons(ETH_P_IP);
 83		break;
 84	case AF_INET6:
 85		tuple.src_v6 = *(struct in6_addr *)&fib_tuple->ipv6_src;
 86		tuple.dst_v6 = *(struct in6_addr *)&fib_tuple->ipv6_dst;
 87		proto = htons(ETH_P_IPV6);
 88		break;
 89	default:
 90		opts->error = -EAFNOSUPPORT;
 91		return NULL;
 92	}
 93
 94	tuplehash = bpf_xdp_flow_tuple_lookup(xdp->rxq->dev, &tuple, proto);
 95	if (IS_ERR(tuplehash)) {
 96		opts->error = PTR_ERR(tuplehash);
 97		return NULL;
 98	}
 99
100	return tuplehash;
101}
102
103__diag_pop()
104
105__bpf_kfunc_end_defs();
106
107BTF_KFUNCS_START(nf_ft_kfunc_set)
108BTF_ID_FLAGS(func, bpf_xdp_flow_lookup, KF_TRUSTED_ARGS | KF_RET_NULL)
109BTF_KFUNCS_END(nf_ft_kfunc_set)
110
111static const struct btf_kfunc_id_set nf_flow_kfunc_set = {
112	.owner = THIS_MODULE,
113	.set   = &nf_ft_kfunc_set,
114};
115
116int nf_flow_register_bpf(void)
117{
118	return register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP,
119					 &nf_flow_kfunc_set);
120}
121EXPORT_SYMBOL_GPL(nf_flow_register_bpf);