1 // SPDX-License-Identifier: GPL-2.0-only
2 /* Unstable Conntrack Helpers for XDP and TC-BPF hook
3 *
4 * These are called from the XDP and SCHED_CLS BPF programs. Note that it is
5 * allowed to break compatibility for these functions since the interface they
6 * are exposed through to BPF programs is explicitly unstable.
7 */
8
9 #include <linux/bpf_verifier.h>
10 #include <linux/bpf.h>
11 #include <linux/btf.h>
12 #include <linux/filter.h>
13 #include <linux/mutex.h>
14 #include <linux/types.h>
15 #include <linux/btf_ids.h>
16 #include <linux/net_namespace.h>
17 #include <net/sock.h>
18 #include <net/xdp.h>
19 #include <net/netfilter/nf_conntrack_bpf.h>
20 #include <net/netfilter/nf_conntrack_core.h>
21
22 /* bpf_ct_opts - Options for CT lookup helpers
23 *
24 * Members:
25 * @netns_id - Specify the network namespace for lookup
26 * Values:
27 * BPF_F_CURRENT_NETNS (-1)
28 * Use namespace associated with ctx (xdp_md, __sk_buff)
29 * [0, S32_MAX]
30 * Network Namespace ID
31 * @error - Out parameter, set for any errors encountered
32 * Values:
33 * -EINVAL - Passed NULL for bpf_tuple pointer
34 * -EINVAL - opts->reserved is not 0
35 * -EINVAL - netns_id is less than -1
36 * -EINVAL - opts__sz isn't NF_BPF_CT_OPTS_SZ (16) or 12
37 * -EINVAL - opts->ct_zone_id set when
38 opts__sz isn't NF_BPF_CT_OPTS_SZ (16)
39 * -EPROTO - l4proto isn't one of IPPROTO_TCP or IPPROTO_UDP
40 * -ENONET - No network namespace found for netns_id
41 * -ENOENT - Conntrack lookup could not find entry for tuple
42 * -EAFNOSUPPORT - tuple__sz isn't one of sizeof(tuple->ipv4)
43 * or sizeof(tuple->ipv6)
44 * @l4proto - Layer 4 protocol
45 * Values:
46 * IPPROTO_TCP, IPPROTO_UDP
47 * @dir: - connection tracking tuple direction.
48 * @ct_zone_id - connection tracking zone id.
49 * @ct_zone_dir - connection tracking zone direction.
50 * @reserved - Reserved member, will be reused for more options in future
51 * Values:
52 * 0
53 */
54 struct bpf_ct_opts {
55 s32 netns_id;
56 s32 error;
57 u8 l4proto;
58 u8 dir;
59 u16 ct_zone_id;
60 u8 ct_zone_dir;
61 u8 reserved[3];
62 };
63
64 enum {
65 NF_BPF_CT_OPTS_SZ = 16,
66 };
67
bpf_ct_opts_result(struct bpf_ct_opts * opts,u32 opts__sz,void * ret)68 static void *bpf_ct_opts_result(struct bpf_ct_opts *opts, u32 opts__sz, void *ret)
69 {
70 if (!IS_ERR(ret))
71 return ret;
72 if (opts__sz >= offsetofend(struct bpf_ct_opts, error))
73 opts->error = PTR_ERR(ret);
74 return NULL;
75 }
76
bpf_nf_ct_tuple_parse(struct bpf_sock_tuple * bpf_tuple,u32 tuple_len,u8 protonum,u8 dir,struct nf_conntrack_tuple * tuple)77 static int bpf_nf_ct_tuple_parse(struct bpf_sock_tuple *bpf_tuple,
78 u32 tuple_len, u8 protonum, u8 dir,
79 struct nf_conntrack_tuple *tuple)
80 {
81 union nf_inet_addr *src = dir ? &tuple->dst.u3 : &tuple->src.u3;
82 union nf_inet_addr *dst = dir ? &tuple->src.u3 : &tuple->dst.u3;
83 union nf_conntrack_man_proto *sport = dir ? (void *)&tuple->dst.u
84 : &tuple->src.u;
85 union nf_conntrack_man_proto *dport = dir ? &tuple->src.u
86 : (void *)&tuple->dst.u;
87
88 if (unlikely(protonum != IPPROTO_TCP && protonum != IPPROTO_UDP))
89 return -EPROTO;
90
91 memset(tuple, 0, sizeof(*tuple));
92
93 switch (tuple_len) {
94 case sizeof(bpf_tuple->ipv4):
95 tuple->src.l3num = AF_INET;
96 src->ip = bpf_tuple->ipv4.saddr;
97 sport->tcp.port = bpf_tuple->ipv4.sport;
98 dst->ip = bpf_tuple->ipv4.daddr;
99 dport->tcp.port = bpf_tuple->ipv4.dport;
100 break;
101 case sizeof(bpf_tuple->ipv6):
102 tuple->src.l3num = AF_INET6;
103 memcpy(src->ip6, bpf_tuple->ipv6.saddr, sizeof(bpf_tuple->ipv6.saddr));
104 sport->tcp.port = bpf_tuple->ipv6.sport;
105 memcpy(dst->ip6, bpf_tuple->ipv6.daddr, sizeof(bpf_tuple->ipv6.daddr));
106 dport->tcp.port = bpf_tuple->ipv6.dport;
107 break;
108 default:
109 return -EAFNOSUPPORT;
110 }
111 tuple->dst.protonum = protonum;
112 tuple->dst.dir = dir;
113
114 return 0;
115 }
116
117 static struct nf_conn *
__bpf_nf_ct_alloc_entry(struct net * net,struct bpf_sock_tuple * bpf_tuple,u32 tuple_len,struct bpf_ct_opts * opts,u32 opts_len,u32 timeout)118 __bpf_nf_ct_alloc_entry(struct net *net, struct bpf_sock_tuple *bpf_tuple,
119 u32 tuple_len, struct bpf_ct_opts *opts, u32 opts_len,
120 u32 timeout)
121 {
122 struct nf_conntrack_tuple otuple, rtuple;
123 struct nf_conntrack_zone ct_zone;
124 struct nf_conn *ct;
125 u8 ct_zone_dir = 0;
126 u16 ct_zone_id;
127 s32 netns_id;
128 u8 l4proto;
129 int err;
130
131 if (!(opts_len == NF_BPF_CT_OPTS_SZ || opts_len == 12))
132 return ERR_PTR(-EINVAL);
133
134 netns_id = READ_ONCE(opts->netns_id);
135 l4proto = READ_ONCE(opts->l4proto);
136 ct_zone_id = READ_ONCE(opts->ct_zone_id);
137 if (opts_len == NF_BPF_CT_OPTS_SZ) {
138 ct_zone_dir = READ_ONCE(opts->ct_zone_dir);
139 if (READ_ONCE(opts->reserved[0]) ||
140 READ_ONCE(opts->reserved[1]) ||
141 READ_ONCE(opts->reserved[2]))
142 return ERR_PTR(-EINVAL);
143 } else {
144 if (ct_zone_id)
145 return ERR_PTR(-EINVAL);
146 }
147
148 if (unlikely(netns_id < BPF_F_CURRENT_NETNS))
149 return ERR_PTR(-EINVAL);
150
151 err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
152 IP_CT_DIR_ORIGINAL, &otuple);
153 if (err < 0)
154 return ERR_PTR(err);
155
156 err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
157 IP_CT_DIR_REPLY, &rtuple);
158 if (err < 0)
159 return ERR_PTR(err);
160
161 if (netns_id >= 0) {
162 net = get_net_ns_by_id(net, netns_id);
163 if (unlikely(!net))
164 return ERR_PTR(-ENONET);
165 }
166
167 if (opts_len == NF_BPF_CT_OPTS_SZ) {
168 if (ct_zone_dir == 0) {
169 ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
170 opts->ct_zone_dir = ct_zone_dir;
171 }
172 nf_ct_zone_init(&ct_zone, ct_zone_id, ct_zone_dir, 0);
173 } else {
174 ct_zone = nf_ct_zone_dflt;
175 }
176
177 ct = nf_conntrack_alloc(net, &ct_zone, &otuple, &rtuple,
178 GFP_ATOMIC);
179 if (IS_ERR(ct))
180 goto out;
181
182 memset(&ct->proto, 0, sizeof(ct->proto));
183 __nf_ct_set_timeout(ct, timeout * HZ);
184
185 out:
186 if (netns_id >= 0)
187 put_net(net);
188
189 return ct;
190 }
191
__bpf_nf_ct_lookup(struct net * net,struct bpf_sock_tuple * bpf_tuple,u32 tuple_len,struct bpf_ct_opts * opts,u32 opts_len)192 static struct nf_conn *__bpf_nf_ct_lookup(struct net *net,
193 struct bpf_sock_tuple *bpf_tuple,
194 u32 tuple_len, struct bpf_ct_opts *opts,
195 u32 opts_len)
196 {
197 struct nf_conntrack_tuple_hash *hash;
198 struct nf_conntrack_tuple tuple;
199 struct nf_conntrack_zone ct_zone;
200 struct nf_conn *ct;
201 u8 ct_zone_dir = 0;
202 u16 ct_zone_id;
203 s32 netns_id;
204 u8 l4proto;
205 int err;
206
207 if (!opts || !bpf_tuple)
208 return ERR_PTR(-EINVAL);
209 if (!(opts_len == NF_BPF_CT_OPTS_SZ || opts_len == 12))
210 return ERR_PTR(-EINVAL);
211
212 netns_id = READ_ONCE(opts->netns_id);
213 l4proto = READ_ONCE(opts->l4proto);
214 ct_zone_id = READ_ONCE(opts->ct_zone_id);
215 if (opts_len == NF_BPF_CT_OPTS_SZ) {
216 ct_zone_dir = READ_ONCE(opts->ct_zone_dir);
217 if (READ_ONCE(opts->reserved[0]) ||
218 READ_ONCE(opts->reserved[1]) ||
219 READ_ONCE(opts->reserved[2]))
220 return ERR_PTR(-EINVAL);
221 } else {
222 if (ct_zone_id)
223 return ERR_PTR(-EINVAL);
224 }
225 if (unlikely(l4proto != IPPROTO_TCP && l4proto != IPPROTO_UDP))
226 return ERR_PTR(-EPROTO);
227 if (unlikely(netns_id < BPF_F_CURRENT_NETNS))
228 return ERR_PTR(-EINVAL);
229
230 err = bpf_nf_ct_tuple_parse(bpf_tuple, tuple_len, l4proto,
231 IP_CT_DIR_ORIGINAL, &tuple);
232 if (err < 0)
233 return ERR_PTR(err);
234
235 if (netns_id >= 0) {
236 net = get_net_ns_by_id(net, netns_id);
237 if (unlikely(!net))
238 return ERR_PTR(-ENONET);
239 }
240
241 if (opts_len == NF_BPF_CT_OPTS_SZ) {
242 if (ct_zone_dir == 0) {
243 ct_zone_dir = NF_CT_DEFAULT_ZONE_DIR;
244 opts->ct_zone_dir = ct_zone_dir;
245 }
246 nf_ct_zone_init(&ct_zone, ct_zone_id, ct_zone_dir, 0);
247 } else {
248 ct_zone = nf_ct_zone_dflt;
249 }
250
251 hash = nf_conntrack_find_get(net, &ct_zone, &tuple);
252 if (netns_id >= 0)
253 put_net(net);
254 if (!hash)
255 return ERR_PTR(-ENOENT);
256
257 ct = nf_ct_tuplehash_to_ctrack(hash);
258 opts->dir = NF_CT_DIRECTION(hash);
259
260 return ct;
261 }
262
263 BTF_ID_LIST(btf_nf_conn_ids)
BTF_ID(struct,nf_conn)264 BTF_ID(struct, nf_conn)
265 BTF_ID(struct, nf_conn___init)
266
267 /* Check writes into `struct nf_conn` */
268 static int _nf_conntrack_btf_struct_access(struct bpf_verifier_log *log,
269 const struct bpf_reg_state *reg,
270 int off, int size)
271 {
272 const struct btf_type *ncit, *nct, *t;
273 size_t end;
274
275 ncit = btf_type_by_id(reg->btf, btf_nf_conn_ids[1]);
276 nct = btf_type_by_id(reg->btf, btf_nf_conn_ids[0]);
277 t = btf_type_by_id(reg->btf, reg->btf_id);
278 if (t != nct && t != ncit) {
279 bpf_log(log, "only read is supported\n");
280 return -EACCES;
281 }
282
283 /* `struct nf_conn` and `struct nf_conn___init` have the same layout
284 * so we are safe to simply merge offset checks here
285 */
286 switch (off) {
287 #if defined(CONFIG_NF_CONNTRACK_MARK)
288 case offsetof(struct nf_conn, mark):
289 end = offsetofend(struct nf_conn, mark);
290 break;
291 #endif
292 default:
293 bpf_log(log, "no write support to nf_conn at off %d\n", off);
294 return -EACCES;
295 }
296
297 if (off + size > end) {
298 bpf_log(log,
299 "write access at off %d with size %d beyond the member of nf_conn ended at %zu\n",
300 off, size, end);
301 return -EACCES;
302 }
303
304 return 0;
305 }
306
307 __bpf_kfunc_start_defs();
308
309 /* bpf_xdp_ct_alloc - Allocate a new CT entry
310 *
311 * Parameters:
312 * @xdp_ctx - Pointer to ctx (xdp_md) in XDP program
313 * Cannot be NULL
314 * @bpf_tuple - Pointer to memory representing the tuple to look up
315 * Cannot be NULL
316 * @tuple__sz - Length of the tuple structure
317 * Must be one of sizeof(bpf_tuple->ipv4) or
318 * sizeof(bpf_tuple->ipv6)
319 * @opts - Additional options for allocation (documented above)
320 * Cannot be NULL
321 * @opts__sz - Length of the bpf_ct_opts structure
322 * Must be NF_BPF_CT_OPTS_SZ (16) or 12
323 */
324 __bpf_kfunc struct nf_conn___init *
bpf_xdp_ct_alloc(struct xdp_md * xdp_ctx,struct bpf_sock_tuple * bpf_tuple,u32 tuple__sz,struct bpf_ct_opts * opts,u32 opts__sz)325 bpf_xdp_ct_alloc(struct xdp_md *xdp_ctx, struct bpf_sock_tuple *bpf_tuple,
326 u32 tuple__sz, struct bpf_ct_opts *opts, u32 opts__sz)
327 {
328 struct xdp_buff *ctx = (struct xdp_buff *)xdp_ctx;
329 struct nf_conn *nfct;
330
331 nfct = __bpf_nf_ct_alloc_entry(dev_net(ctx->rxq->dev), bpf_tuple, tuple__sz,
332 opts, opts__sz, 10);
333 return (struct nf_conn___init *)bpf_ct_opts_result(opts, opts__sz, nfct);
334 }
335
336 /* bpf_xdp_ct_lookup - Lookup CT entry for the given tuple, and acquire a
337 * reference to it
338 *
339 * Parameters:
340 * @xdp_ctx - Pointer to ctx (xdp_md) in XDP program
341 * Cannot be NULL
342 * @bpf_tuple - Pointer to memory representing the tuple to look up
343 * Cannot be NULL
344 * @tuple__sz - Length of the tuple structure
345 * Must be one of sizeof(bpf_tuple->ipv4) or
346 * sizeof(bpf_tuple->ipv6)
347 * @opts - Additional options for lookup (documented above)
348 * Cannot be NULL
349 * @opts__sz - Length of the bpf_ct_opts structure
350 * Must be NF_BPF_CT_OPTS_SZ (16) or 12
351 */
352 __bpf_kfunc struct nf_conn *
bpf_xdp_ct_lookup(struct xdp_md * xdp_ctx,struct bpf_sock_tuple * bpf_tuple,u32 tuple__sz,struct bpf_ct_opts * opts,u32 opts__sz)353 bpf_xdp_ct_lookup(struct xdp_md *xdp_ctx, struct bpf_sock_tuple *bpf_tuple,
354 u32 tuple__sz, struct bpf_ct_opts *opts, u32 opts__sz)
355 {
356 struct xdp_buff *ctx = (struct xdp_buff *)xdp_ctx;
357 struct net *caller_net;
358 struct nf_conn *nfct;
359
360 caller_net = dev_net(ctx->rxq->dev);
361 nfct = __bpf_nf_ct_lookup(caller_net, bpf_tuple, tuple__sz, opts, opts__sz);
362 return bpf_ct_opts_result(opts, opts__sz, nfct);
363 }
364
365 /* bpf_skb_ct_alloc - Allocate a new CT entry
366 *
367 * Parameters:
368 * @skb_ctx - Pointer to ctx (__sk_buff) in TC program
369 * Cannot be NULL
370 * @bpf_tuple - Pointer to memory representing the tuple to look up
371 * Cannot be NULL
372 * @tuple__sz - Length of the tuple structure
373 * Must be one of sizeof(bpf_tuple->ipv4) or
374 * sizeof(bpf_tuple->ipv6)
375 * @opts - Additional options for allocation (documented above)
376 * Cannot be NULL
377 * @opts__sz - Length of the bpf_ct_opts structure
378 * Must be NF_BPF_CT_OPTS_SZ (16) or 12
379 */
380 __bpf_kfunc struct nf_conn___init *
bpf_skb_ct_alloc(struct __sk_buff * skb_ctx,struct bpf_sock_tuple * bpf_tuple,u32 tuple__sz,struct bpf_ct_opts * opts,u32 opts__sz)381 bpf_skb_ct_alloc(struct __sk_buff *skb_ctx, struct bpf_sock_tuple *bpf_tuple,
382 u32 tuple__sz, struct bpf_ct_opts *opts, u32 opts__sz)
383 {
384 struct sk_buff *skb = (struct sk_buff *)skb_ctx;
385 struct nf_conn *nfct;
386 struct net *net;
387
388 net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk);
389 nfct = __bpf_nf_ct_alloc_entry(net, bpf_tuple, tuple__sz, opts, opts__sz, 10);
390 return (struct nf_conn___init *)bpf_ct_opts_result(opts, opts__sz, nfct);
391 }
392
393 /* bpf_skb_ct_lookup - Lookup CT entry for the given tuple, and acquire a
394 * reference to it
395 *
396 * Parameters:
397 * @skb_ctx - Pointer to ctx (__sk_buff) in TC program
398 * Cannot be NULL
399 * @bpf_tuple - Pointer to memory representing the tuple to look up
400 * Cannot be NULL
401 * @tuple__sz - Length of the tuple structure
402 * Must be one of sizeof(bpf_tuple->ipv4) or
403 * sizeof(bpf_tuple->ipv6)
404 * @opts - Additional options for lookup (documented above)
405 * Cannot be NULL
406 * @opts__sz - Length of the bpf_ct_opts structure
407 * Must be NF_BPF_CT_OPTS_SZ (16) or 12
408 */
409 __bpf_kfunc struct nf_conn *
bpf_skb_ct_lookup(struct __sk_buff * skb_ctx,struct bpf_sock_tuple * bpf_tuple,u32 tuple__sz,struct bpf_ct_opts * opts,u32 opts__sz)410 bpf_skb_ct_lookup(struct __sk_buff *skb_ctx, struct bpf_sock_tuple *bpf_tuple,
411 u32 tuple__sz, struct bpf_ct_opts *opts, u32 opts__sz)
412 {
413 struct sk_buff *skb = (struct sk_buff *)skb_ctx;
414 struct net *caller_net;
415 struct nf_conn *nfct;
416
417 caller_net = skb->dev ? dev_net(skb->dev) : sock_net(skb->sk);
418 nfct = __bpf_nf_ct_lookup(caller_net, bpf_tuple, tuple__sz, opts, opts__sz);
419 return bpf_ct_opts_result(opts, opts__sz, nfct);
420 }
421
422 /* bpf_ct_insert_entry - Add the provided entry into a CT map
423 *
424 * This must be invoked for referenced PTR_TO_BTF_ID.
425 *
426 * @nfct - Pointer to referenced nf_conn___init object, obtained
427 * using bpf_xdp_ct_alloc or bpf_skb_ct_alloc.
428 */
bpf_ct_insert_entry(struct nf_conn___init * nfct_i)429 __bpf_kfunc struct nf_conn *bpf_ct_insert_entry(struct nf_conn___init *nfct_i)
430 {
431 struct nf_conn *nfct = (struct nf_conn *)nfct_i;
432 int err;
433
434 if (!nf_ct_is_confirmed(nfct))
435 nfct->timeout += nfct_time_stamp;
436 nfct->status |= IPS_CONFIRMED;
437 err = nf_conntrack_hash_check_insert(nfct);
438 if (err < 0) {
439 nf_conntrack_free(nfct);
440 return NULL;
441 }
442 return nfct;
443 }
444
445 /* bpf_ct_release - Release acquired nf_conn object
446 *
447 * This must be invoked for referenced PTR_TO_BTF_ID, and the verifier rejects
448 * the program if any references remain in the program in all of the explored
449 * states.
450 *
451 * Parameters:
452 * @nf_conn - Pointer to referenced nf_conn object, obtained using
453 * bpf_xdp_ct_lookup or bpf_skb_ct_lookup.
454 */
bpf_ct_release(struct nf_conn * nfct)455 __bpf_kfunc void bpf_ct_release(struct nf_conn *nfct)
456 {
457 nf_ct_put(nfct);
458 }
459
460 /* bpf_ct_set_timeout - Set timeout of allocated nf_conn
461 *
462 * Sets the default timeout of newly allocated nf_conn before insertion.
463 * This helper must be invoked for refcounted pointer to nf_conn___init.
464 *
465 * Parameters:
466 * @nfct - Pointer to referenced nf_conn object, obtained using
467 * bpf_xdp_ct_alloc or bpf_skb_ct_alloc.
468 * @timeout - Timeout in msecs.
469 */
bpf_ct_set_timeout(struct nf_conn___init * nfct,u32 timeout)470 __bpf_kfunc void bpf_ct_set_timeout(struct nf_conn___init *nfct, u32 timeout)
471 {
472 __nf_ct_set_timeout((struct nf_conn *)nfct, msecs_to_jiffies(timeout));
473 }
474
475 /* bpf_ct_change_timeout - Change timeout of inserted nf_conn
476 *
477 * Change timeout associated of the inserted or looked up nf_conn.
478 * This helper must be invoked for refcounted pointer to nf_conn.
479 *
480 * Parameters:
481 * @nfct - Pointer to referenced nf_conn object, obtained using
482 * bpf_ct_insert_entry, bpf_xdp_ct_lookup, or bpf_skb_ct_lookup.
483 * @timeout - New timeout in msecs.
484 */
bpf_ct_change_timeout(struct nf_conn * nfct,u32 timeout)485 __bpf_kfunc int bpf_ct_change_timeout(struct nf_conn *nfct, u32 timeout)
486 {
487 return __nf_ct_change_timeout(nfct, msecs_to_jiffies(timeout));
488 }
489
490 /* bpf_ct_set_status - Set status field of allocated nf_conn
491 *
492 * Set the status field of the newly allocated nf_conn before insertion.
493 * This must be invoked for referenced PTR_TO_BTF_ID to nf_conn___init.
494 *
495 * Parameters:
496 * @nfct - Pointer to referenced nf_conn object, obtained using
497 * bpf_xdp_ct_alloc or bpf_skb_ct_alloc.
498 * @status - New status value.
499 */
bpf_ct_set_status(const struct nf_conn___init * nfct,u32 status)500 __bpf_kfunc int bpf_ct_set_status(const struct nf_conn___init *nfct, u32 status)
501 {
502 return nf_ct_change_status_common((struct nf_conn *)nfct, status);
503 }
504
505 /* bpf_ct_change_status - Change status of inserted nf_conn
506 *
507 * Change the status field of the provided connection tracking entry.
508 * This must be invoked for referenced PTR_TO_BTF_ID to nf_conn.
509 *
510 * Parameters:
511 * @nfct - Pointer to referenced nf_conn object, obtained using
512 * bpf_ct_insert_entry, bpf_xdp_ct_lookup or bpf_skb_ct_lookup.
513 * @status - New status value.
514 */
bpf_ct_change_status(struct nf_conn * nfct,u32 status)515 __bpf_kfunc int bpf_ct_change_status(struct nf_conn *nfct, u32 status)
516 {
517 return nf_ct_change_status_common(nfct, status);
518 }
519
520 __bpf_kfunc_end_defs();
521
522 BTF_KFUNCS_START(nf_ct_kfunc_set)
523 BTF_ID_FLAGS(func, bpf_xdp_ct_alloc, KF_ACQUIRE | KF_RET_NULL)
524 BTF_ID_FLAGS(func, bpf_xdp_ct_lookup, KF_ACQUIRE | KF_RET_NULL)
525 BTF_ID_FLAGS(func, bpf_skb_ct_alloc, KF_ACQUIRE | KF_RET_NULL)
526 BTF_ID_FLAGS(func, bpf_skb_ct_lookup, KF_ACQUIRE | KF_RET_NULL)
527 BTF_ID_FLAGS(func, bpf_ct_insert_entry, KF_ACQUIRE | KF_RET_NULL | KF_RELEASE)
528 BTF_ID_FLAGS(func, bpf_ct_release, KF_RELEASE)
529 BTF_ID_FLAGS(func, bpf_ct_set_timeout)
530 BTF_ID_FLAGS(func, bpf_ct_change_timeout)
531 BTF_ID_FLAGS(func, bpf_ct_set_status)
532 BTF_ID_FLAGS(func, bpf_ct_change_status)
533 BTF_KFUNCS_END(nf_ct_kfunc_set)
534
535 static const struct btf_kfunc_id_set nf_conntrack_kfunc_set = {
536 .owner = THIS_MODULE,
537 .set = &nf_ct_kfunc_set,
538 };
539
register_nf_conntrack_bpf(void)540 int register_nf_conntrack_bpf(void)
541 {
542 int ret;
543
544 ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &nf_conntrack_kfunc_set);
545 ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS, &nf_conntrack_kfunc_set);
546 if (!ret) {
547 mutex_lock(&nf_conn_btf_access_lock);
548 nfct_btf_struct_access = _nf_conntrack_btf_struct_access;
549 mutex_unlock(&nf_conn_btf_access_lock);
550 }
551
552 return ret;
553 }
554
cleanup_nf_conntrack_bpf(void)555 void cleanup_nf_conntrack_bpf(void)
556 {
557 mutex_lock(&nf_conn_btf_access_lock);
558 nfct_btf_struct_access = NULL;
559 mutex_unlock(&nf_conn_btf_access_lock);
560 }
561