libbpf: Add netfilter link attach helper

Add new api function: bpf_program__attach_netfilter.

It takes a bpf program (netfilter type), and a pointer to a option struct
that contains the desired attachment (protocol family, priority, hook
location, ...).

It returns a pointer to a 'bpf_link' structure or NULL on error.

Next patch adds new netfilter_basic test that uses this function to
attach a program to a few pf/hook/priority combinations.

v2: change name and use bpf_link_create.

Suggested-by: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Acked-by: Daniel Xu <dxu@dxuuu.xyz>
Link: https://lore.kernel.org/bpf/CAEf4BzZrmUv27AJp0dDxBDMY_B8e55-wLs8DUKK69vCWsCG_pQ@mail.gmail.com/
Link: https://lore.kernel.org/bpf/CAEf4BzZ69YgrQW7DHCJUT_X+GqMq_ZQQPBwopaJJVGFD5=d5Vg@mail.gmail.com/
Link: https://lore.kernel.org/bpf/20230628152738.22765-2-fw@strlen.de

diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index ed86b37..3b0da19 100644 (file)
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -741,6 +741,14 @@ int bpf_link_create(int prog_fd, int target_fd,
                if (!OPTS_ZEROED(opts, tracing))
                        return libbpf_err(-EINVAL);
                break;
+       case BPF_NETFILTER:
+               attr.link_create.netfilter.pf = OPTS_GET(opts, netfilter.pf, 0);
+               attr.link_create.netfilter.hooknum = OPTS_GET(opts, netfilter.hooknum, 0);
+               attr.link_create.netfilter.priority = OPTS_GET(opts, netfilter.priority, 0);
+               attr.link_create.netfilter.flags = OPTS_GET(opts, netfilter.flags, 0);
+               if (!OPTS_ZEROED(opts, netfilter))
+                       return libbpf_err(-EINVAL);
+               break;
        default:
                if (!OPTS_ZEROED(opts, flags))
                        return libbpf_err(-EINVAL);

diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
index 9aa0ee4..c676295 100644 (file)
--- a/tools/lib/bpf/bpf.h
+++ b/tools/lib/bpf/bpf.h
@@ -349,6 +349,12 @@ struct bpf_link_create_opts {
                struct {
                        __u64 cookie;
                } tracing;
+               struct {
+                       __u32 pf;
+                       __u32 hooknum;
+                       __s32 priority;
+                       __u32 flags;
+               } netfilter;
        };
        size_t :0;
 };

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index d793a1b..1c6588a 100644 (file)
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -11815,6 +11815,48 @@ static int attach_iter(const struct bpf_program *prog, long cookie, struct bpf_l
        return libbpf_get_error(*link);
 }
 
+struct bpf_link *bpf_program__attach_netfilter(const struct bpf_program *prog,
+                                              const struct bpf_netfilter_opts *opts)
+{
+       LIBBPF_OPTS(bpf_link_create_opts, lopts);
+       struct bpf_link *link;
+       int prog_fd, link_fd;
+
+       if (!OPTS_VALID(opts, bpf_netfilter_opts))
+               return libbpf_err_ptr(-EINVAL);
+
+       prog_fd = bpf_program__fd(prog);
+       if (prog_fd < 0) {
+               pr_warn("prog '%s': can't attach before loaded\n", prog->name);
+               return libbpf_err_ptr(-EINVAL);
+       }
+
+       link = calloc(1, sizeof(*link));
+       if (!link)
+               return libbpf_err_ptr(-ENOMEM);
+
+       link->detach = &bpf_link__detach_fd;
+
+       lopts.netfilter.pf = OPTS_GET(opts, pf, 0);
+       lopts.netfilter.hooknum = OPTS_GET(opts, hooknum, 0);
+       lopts.netfilter.priority = OPTS_GET(opts, priority, 0);
+       lopts.netfilter.flags = OPTS_GET(opts, flags, 0);
+
+       link_fd = bpf_link_create(prog_fd, 0, BPF_NETFILTER, &lopts);
+       if (link_fd < 0) {
+               char errmsg[STRERR_BUFSIZE];
+
+               link_fd = -errno;
+               free(link);
+               pr_warn("prog '%s': failed to attach to netfilter: %s\n",
+                       prog->name, libbpf_strerror_r(link_fd, errmsg, sizeof(errmsg)));
+               return libbpf_err_ptr(link_fd);
+       }
+       link->fd = link_fd;
+
+       return link;
+}
+
 struct bpf_link *bpf_program__attach(const struct bpf_program *prog)
 {
        struct bpf_link *link = NULL;

diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index 754da73..10642ad 100644 (file)
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -718,6 +718,21 @@ LIBBPF_API struct bpf_link *
 bpf_program__attach_freplace(const struct bpf_program *prog,
                             int target_fd, const char *attach_func_name);
 
+struct bpf_netfilter_opts {
+       /* size of this struct, for forward/backward compatibility */
+       size_t sz;
+
+       __u32 pf;
+       __u32 hooknum;
+       __s32 priority;
+       __u32 flags;
+};
+#define bpf_netfilter_opts__last_field flags
+
+LIBBPF_API struct bpf_link *
+bpf_program__attach_netfilter(const struct bpf_program *prog,
+                             const struct bpf_netfilter_opts *opts);
+
 struct bpf_map;
 
 LIBBPF_API struct bpf_link *bpf_map__attach_struct_ops(const struct bpf_map *map);

diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
index 7521a2f..d9ec440 100644 (file)
--- a/tools/lib/bpf/libbpf.map
+++ b/tools/lib/bpf/libbpf.map
@@ -395,4 +395,5 @@ LIBBPF_1.2.0 {
 LIBBPF_1.3.0 {
        global:
                bpf_obj_pin_opts;
+               bpf_program__attach_netfilter;
 } LIBBPF_1.2.0;