• Shmulik Ladkani's avatar
    netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1' · 98589a09
    Shmulik Ladkani authored
    Commit 2c16d603 ("netfilter: xt_bpf: support ebpf") introduced
    support for attaching an eBPF object by an fd, with the
    'bpf_mt_check_v1' ABI expecting the '.fd' to be specified upon each
    IPT_SO_SET_REPLACE call.
    
    However this breaks subsequent iptables calls:
    
     # iptables -A INPUT -m bpf --object-pinned /sys/fs/bpf/xxx -j ACCEPT
     # iptables -A INPUT -s 5.6.7.8 -j ACCEPT
     iptables: Invalid argument. Run `dmesg' for more information.
    
    That's because iptables works by loading existing rules using
    IPT_SO_GET_ENTRIES to userspace, then issuing IPT_SO_SET_REPLACE with
    the replacement set.
    
    However, the loaded 'xt_bpf_info_v1' has an arbitrary '.fd' number
    (from the initial "iptables -m bpf" invocation) - so when 2nd invocation
    occurs, userspace passes a bogus fd number, which leads to
    'bpf_mt_check_v1' to fail.
    
    One suggested solution [1] was to hack iptables userspace, to perform a
    "entries fixup" immediatley after IPT_SO_GET_ENTRIES, by opening a new,
    process-local fd per every 'xt_bpf_info_v1' entry seen.
    
    However, in [2] both Pablo Neira Ayuso and Willem de Bruijn suggested to
    depricate the xt_bpf_info_v1 ABI dealing with pinned ebpf objects.
    
    This fix changes the XT_BPF_MODE_FD_PINNED behavior to ignore the given
    '.fd' and instead perform an in-kernel lookup for the bpf object given
    the provided '.path'.
    
    It also defines an alias for the XT_BPF_MODE_FD_PINNED mode, named
    XT_BPF_MODE_PATH_PINNED, to better reflect the fact that the user is
    expected to provide the path of the pinned object.
    
    Existing XT_BPF_MODE_FD_ELF behavior (non-pinned fd mode) is preserved.
    
    References: [1] https://marc.info/?l=netfilter-devel&m=150564724607440&w=2
                [2] https://marc.info/?l=netfilter-devel&m=150575727129880&w=2Reported-by: default avatarRafael Buchbinder <rafi@rbk.ms>
    Signed-off-by: default avatarShmulik Ladkani <shmulik.ladkani@gmail.com>
    Acked-by: default avatarWillem de Bruijn <willemb@google.com>
    Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    98589a09
inode.c 9.84 KB