iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bpf: fix availability probing for seg6 helpers

Browse Source 
bpf_lwt_seg6_* helpers require CONFIG_IPV6_SEG6_BPF, and currently
return -EOPNOTSUPP to indicate unavailability. This patch forces the
BPF verifier to reject programs using these helpers when
!CONFIG_IPV6_SEG6_BPF, allowing users to more easily probe if they are
available or not.

Signed-off-by: Mathieu Xhonneux <m.xhonneux@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
This commit is contained in:
Mathieu Xhonneux 2018-07-10 16:54:02 +00:00 committed by Daniel Borkmann
parent 59ee4129a2
commit 61d769807f
1 changed files with 8 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
net/core/filter.c
View File

@ -4536,10 +4536,10 @@ static const struct bpf_func_proto bpf_lwt_push_encap_proto = {
.arg4_type = ARG_CONST_SIZE .arg4_type = ARG_CONST_SIZE
}; };
#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
BPF_CALL_4(bpf_lwt_seg6_store_bytes, struct sk_buff *, skb, u32, offset, BPF_CALL_4(bpf_lwt_seg6_store_bytes, struct sk_buff *, skb, u32, offset,
const void *, from, u32, len) const void *, from, u32, len)
{ {
#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
struct seg6_bpf_srh_state *srh_state = struct seg6_bpf_srh_state *srh_state =
this_cpu_ptr(&seg6_bpf_srh_states); this_cpu_ptr(&seg6_bpf_srh_states);
void *srh_tlvs, *srh_end, *ptr; void *srh_tlvs, *srh_end, *ptr;
@ -4565,9 +4565,6 @@ BPF_CALL_4(bpf_lwt_seg6_store_bytes, struct sk_buff *, skb, u32, offset,
memcpy(skb->data + offset, from, len); memcpy(skb->data + offset, from, len);
return 0; return 0;
#else /* CONFIG_IPV6_SEG6_BPF */
return -EOPNOTSUPP;
#endif
} }
static const struct bpf_func_proto bpf_lwt_seg6_store_bytes_proto = { static const struct bpf_func_proto bpf_lwt_seg6_store_bytes_proto = {
@ -4583,7 +4580,6 @@ static const struct bpf_func_proto bpf_lwt_seg6_store_bytes_proto = {
BPF_CALL_4(bpf_lwt_seg6_action, struct sk_buff *, skb, BPF_CALL_4(bpf_lwt_seg6_action, struct sk_buff *, skb,
u32, action, void *, param, u32, param_len) u32, action, void *, param, u32, param_len)
{ {
#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
struct seg6_bpf_srh_state *srh_state = struct seg6_bpf_srh_state *srh_state =
this_cpu_ptr(&seg6_bpf_srh_states); this_cpu_ptr(&seg6_bpf_srh_states);
struct ipv6_sr_hdr *srh; struct ipv6_sr_hdr *srh;
@ -4631,9 +4627,6 @@ BPF_CALL_4(bpf_lwt_seg6_action, struct sk_buff *, skb,
default: default:
return -EINVAL; return -EINVAL;
} }
#else /* CONFIG_IPV6_SEG6_BPF */
return -EOPNOTSUPP;
#endif
} }
static const struct bpf_func_proto bpf_lwt_seg6_action_proto = { static const struct bpf_func_proto bpf_lwt_seg6_action_proto = {
@ -4649,7 +4642,6 @@ static const struct bpf_func_proto bpf_lwt_seg6_action_proto = {
BPF_CALL_3(bpf_lwt_seg6_adjust_srh, struct sk_buff *, skb, u32, offset, BPF_CALL_3(bpf_lwt_seg6_adjust_srh, struct sk_buff *, skb, u32, offset,
s32, len) s32, len)
{ {
#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
struct seg6_bpf_srh_state *srh_state = struct seg6_bpf_srh_state *srh_state =
this_cpu_ptr(&seg6_bpf_srh_states); this_cpu_ptr(&seg6_bpf_srh_states);
void *srh_end, *srh_tlvs, *ptr; void *srh_end, *srh_tlvs, *ptr;
@ -4693,9 +4685,6 @@ BPF_CALL_3(bpf_lwt_seg6_adjust_srh, struct sk_buff *, skb, u32, offset,
srh_state->hdrlen += len; srh_state->hdrlen += len;
srh_state->valid = 0; srh_state->valid = 0;
return 0; return 0;
#else /* CONFIG_IPV6_SEG6_BPF */
return -EOPNOTSUPP;
#endif
} }
static const struct bpf_func_proto bpf_lwt_seg6_adjust_srh_proto = { static const struct bpf_func_proto bpf_lwt_seg6_adjust_srh_proto = {
@ -4706,6 +4695,7 @@ static const struct bpf_func_proto bpf_lwt_seg6_adjust_srh_proto = {
.arg2_type = ARG_ANYTHING, .arg2_type = ARG_ANYTHING,
.arg3_type = ARG_ANYTHING, .arg3_type = ARG_ANYTHING,
}; };
#endif /* CONFIG_IPV6_SEG6_BPF */
bool bpf_helper_changes_pkt_data(void *func) bool bpf_helper_changes_pkt_data(void *func)
{ {
@ -4727,11 +4717,12 @@ bool bpf_helper_changes_pkt_data(void *func)
func == bpf_xdp_adjust_meta || func == bpf_xdp_adjust_meta ||
func == bpf_msg_pull_data || func == bpf_msg_pull_data ||
func == bpf_xdp_adjust_tail || func == bpf_xdp_adjust_tail ||
func == bpf_lwt_push_encap || #if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
func == bpf_lwt_seg6_store_bytes || func == bpf_lwt_seg6_store_bytes ||
func == bpf_lwt_seg6_adjust_srh || func == bpf_lwt_seg6_adjust_srh ||
func == bpf_lwt_seg6_action func == bpf_lwt_seg6_action ||
) #endif
func == bpf_lwt_push_encap)
return true; return true;
return false; return false;
@ -5066,12 +5057,14 @@ static const struct bpf_func_proto *
lwt_seg6local_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) lwt_seg6local_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
{ {
switch (func_id) { switch (func_id) {
#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
case BPF_FUNC_lwt_seg6_store_bytes: case BPF_FUNC_lwt_seg6_store_bytes:
return &bpf_lwt_seg6_store_bytes_proto; return &bpf_lwt_seg6_store_bytes_proto;
case BPF_FUNC_lwt_seg6_action: case BPF_FUNC_lwt_seg6_action:
return &bpf_lwt_seg6_action_proto; return &bpf_lwt_seg6_action_proto;
case BPF_FUNC_lwt_seg6_adjust_srh: case BPF_FUNC_lwt_seg6_adjust_srh:
return &bpf_lwt_seg6_adjust_srh_proto; return &bpf_lwt_seg6_adjust_srh_proto;
#endif
default: default:
return lwt_out_func_proto(func_id, prog); return lwt_out_func_proto(func_id, prog);
} }