tc: bpf: generalize pedit action

existing TC action 'pedit' can munge any bits of the packet.
Generalize it for use in bpf programs attached as cls_bpf and act_bpf via
bpf_skb_store_bytes() helper function.

Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Reviewed-by: Jiri Pirko <jiri@resnulli.us>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 280a315de8d6c8bc6eecf4ef08d0c7bac27f3caa..d5cda067115aaaa0f2b00a41c5a3d8c68ad114b3 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -59,6 +59,7 @@ enum bpf_arg_type {
        ARG_PTR_TO_STACK,       /* any pointer to eBPF program stack */
        ARG_CONST_STACK_SIZE,   /* number of bytes accessed from stack */
 
+       ARG_PTR_TO_CTX,         /* pointer to context */
        ARG_ANYTHING,           /* any (initialized) argument is ok */
 };
 

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 27dc4ec588402e2cf1ee5e285719fc8eb4ea876e..74aab6e0d96436b5d24e19c18e9c8d81dc14eee9 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -168,6 +168,7 @@ enum bpf_func_id {
        BPF_FUNC_map_delete_elem, /* int map_delete_elem(&map, &key) */
        BPF_FUNC_get_prandom_u32, /* u32 prandom_u32(void) */
        BPF_FUNC_get_smp_processor_id, /* u32 raw_smp_processor_id(void) */
+       BPF_FUNC_skb_store_bytes, /* int skb_store_bytes(skb, offset, from, len) */
        __BPF_FUNC_MAX_ID,
 };
 

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 0e714f799ec075ddaa43c3ff643abaed30ad2ce9..630a7bac1e513e330785283e38aa1dfbe9eb5c50 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -773,6 +773,8 @@ static int check_func_arg(struct verifier_env *env, u32 regno,
                expected_type = CONST_IMM;
        } else if (arg_type == ARG_CONST_MAP_PTR) {
                expected_type = CONST_PTR_TO_MAP;
+       } else if (arg_type == ARG_PTR_TO_CTX) {
+               expected_type = PTR_TO_CTX;
        } else {
                verbose("unsupported arg_type %d\n", arg_type);
                return -EFAULT;

diff --git a/net/core/filter.c b/net/core/filter.c
index 32f43c59908c49daacbbb5e2060e057fd3eed422..444a07e4f68d7eca3e1c324ae91991d32779ae4d 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1175,6 +1175,56 @@ int sk_attach_bpf(u32 ufd, struct sock *sk)
        return 0;
 }
 
+static u64 bpf_skb_store_bytes(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
+{
+       struct sk_buff *skb = (struct sk_buff *) (long) r1;
+       unsigned int offset = (unsigned int) r2;
+       void *from = (void *) (long) r3;
+       unsigned int len = (unsigned int) r4;
+       char buf[16];
+       void *ptr;
+
+       /* bpf verifier guarantees that:
+        * 'from' pointer points to bpf program stack
+        * 'len' bytes of it were initialized
+        * 'len' > 0
+        * 'skb' is a valid pointer to 'struct sk_buff'
+        *
+        * so check for invalid 'offset' and too large 'len'
+        */
+       if (offset > 0xffff || len > sizeof(buf))
+               return -EFAULT;
+
+       if (skb_cloned(skb) && !skb_clone_writable(skb, offset + len))
+               return -EFAULT;
+
+       ptr = skb_header_pointer(skb, offset, len, buf);
+       if (unlikely(!ptr))
+               return -EFAULT;
+
+       skb_postpull_rcsum(skb, ptr, len);
+
+       memcpy(ptr, from, len);
+
+       if (ptr == buf)
+               /* skb_store_bits cannot return -EFAULT here */
+               skb_store_bits(skb, offset, ptr, len);
+
+       if (skb->ip_summed == CHECKSUM_COMPLETE)
+               skb->csum = csum_add(skb->csum, csum_partial(ptr, len, 0));
+       return 0;
+}
+
+const struct bpf_func_proto bpf_skb_store_bytes_proto = {
+       .func           = bpf_skb_store_bytes,
+       .gpl_only       = false,
+       .ret_type       = RET_INTEGER,
+       .arg1_type      = ARG_PTR_TO_CTX,
+       .arg2_type      = ARG_ANYTHING,
+       .arg3_type      = ARG_PTR_TO_STACK,
+       .arg4_type      = ARG_CONST_STACK_SIZE,
+};
+
 static const struct bpf_func_proto *
 sk_filter_func_proto(enum bpf_func_id func_id)
 {
@@ -1194,6 +1244,17 @@ sk_filter_func_proto(enum bpf_func_id func_id)
        }
 }
 
+static const struct bpf_func_proto *
+tc_cls_act_func_proto(enum bpf_func_id func_id)
+{
+       switch (func_id) {
+       case BPF_FUNC_skb_store_bytes:
+               return &bpf_skb_store_bytes_proto;
+       default:
+               return sk_filter_func_proto(func_id);
+       }
+}
+
 static bool sk_filter_is_valid_access(int off, int size,
                                      enum bpf_access_type type)
 {
@@ -1270,18 +1331,24 @@ static const struct bpf_verifier_ops sk_filter_ops = {
        .convert_ctx_access = sk_filter_convert_ctx_access,
 };
 
+static const struct bpf_verifier_ops tc_cls_act_ops = {
+       .get_func_proto = tc_cls_act_func_proto,
+       .is_valid_access = sk_filter_is_valid_access,
+       .convert_ctx_access = sk_filter_convert_ctx_access,
+};
+
 static struct bpf_prog_type_list sk_filter_type __read_mostly = {
        .ops = &sk_filter_ops,
        .type = BPF_PROG_TYPE_SOCKET_FILTER,
 };
 
 static struct bpf_prog_type_list sched_cls_type __read_mostly = {
-       .ops = &sk_filter_ops,
+       .ops = &tc_cls_act_ops,
        .type = BPF_PROG_TYPE_SCHED_CLS,
 };
 
 static struct bpf_prog_type_list sched_act_type __read_mostly = {
-       .ops = &sk_filter_ops,
+       .ops = &tc_cls_act_ops,
        .type = BPF_PROG_TYPE_SCHED_ACT,
 };