Willem de Bruijn | e6f30c7 | 2013-01-18 07:17:30 +0000 | [diff] [blame] | 1 | /* Xtables module to match packets using a BPF filter. |
| 2 | * Copyright 2013 Google Inc. |
| 3 | * Written by Willem de Bruijn <willemb@google.com> |
| 4 | * |
| 5 | * This program is free software; you can redistribute it and/or modify |
| 6 | * it under the terms of the GNU General Public License version 2 as |
| 7 | * published by the Free Software Foundation. |
| 8 | */ |
| 9 | |
| 10 | #include <linux/module.h> |
| 11 | #include <linux/skbuff.h> |
| 12 | #include <linux/filter.h> |
| 13 | |
| 14 | #include <linux/netfilter/xt_bpf.h> |
| 15 | #include <linux/netfilter/x_tables.h> |
| 16 | |
| 17 | MODULE_AUTHOR("Willem de Bruijn <willemb@google.com>"); |
| 18 | MODULE_DESCRIPTION("Xtables: BPF filter match"); |
| 19 | MODULE_LICENSE("GPL"); |
| 20 | MODULE_ALIAS("ipt_bpf"); |
| 21 | MODULE_ALIAS("ip6t_bpf"); |
| 22 | |
| 23 | static int bpf_mt_check(const struct xt_mtchk_param *par) |
| 24 | { |
| 25 | struct xt_bpf_info *info = par->matchinfo; |
Daniel Borkmann | b1fcd35 | 2014-05-23 18:43:58 +0200 | [diff] [blame] | 26 | struct sock_fprog_kern program; |
Willem de Bruijn | e6f30c7 | 2013-01-18 07:17:30 +0000 | [diff] [blame] | 27 | |
| 28 | program.len = info->bpf_program_num_elem; |
Daniel Borkmann | b1fcd35 | 2014-05-23 18:43:58 +0200 | [diff] [blame] | 29 | program.filter = info->bpf_program; |
| 30 | |
Alexei Starovoitov | 7ae457c | 2014-07-30 20:34:16 -0700 | [diff] [blame^] | 31 | if (bpf_prog_create(&info->filter, &program)) { |
Willem de Bruijn | e6f30c7 | 2013-01-18 07:17:30 +0000 | [diff] [blame] | 32 | pr_info("bpf: check failed: parse error\n"); |
| 33 | return -EINVAL; |
| 34 | } |
| 35 | |
| 36 | return 0; |
| 37 | } |
| 38 | |
| 39 | static bool bpf_mt(const struct sk_buff *skb, struct xt_action_param *par) |
| 40 | { |
| 41 | const struct xt_bpf_info *info = par->matchinfo; |
| 42 | |
Alexei Starovoitov | 7ae457c | 2014-07-30 20:34:16 -0700 | [diff] [blame^] | 43 | return BPF_PROG_RUN(info->filter, skb); |
Willem de Bruijn | e6f30c7 | 2013-01-18 07:17:30 +0000 | [diff] [blame] | 44 | } |
| 45 | |
| 46 | static void bpf_mt_destroy(const struct xt_mtdtor_param *par) |
| 47 | { |
| 48 | const struct xt_bpf_info *info = par->matchinfo; |
Alexei Starovoitov | 7ae457c | 2014-07-30 20:34:16 -0700 | [diff] [blame^] | 49 | bpf_prog_destroy(info->filter); |
Willem de Bruijn | e6f30c7 | 2013-01-18 07:17:30 +0000 | [diff] [blame] | 50 | } |
| 51 | |
| 52 | static struct xt_match bpf_mt_reg __read_mostly = { |
| 53 | .name = "bpf", |
| 54 | .revision = 0, |
| 55 | .family = NFPROTO_UNSPEC, |
| 56 | .checkentry = bpf_mt_check, |
| 57 | .match = bpf_mt, |
| 58 | .destroy = bpf_mt_destroy, |
| 59 | .matchsize = sizeof(struct xt_bpf_info), |
| 60 | .me = THIS_MODULE, |
| 61 | }; |
| 62 | |
| 63 | static int __init bpf_mt_init(void) |
| 64 | { |
| 65 | return xt_register_match(&bpf_mt_reg); |
| 66 | } |
| 67 | |
| 68 | static void __exit bpf_mt_exit(void) |
| 69 | { |
| 70 | xt_unregister_match(&bpf_mt_reg); |
| 71 | } |
| 72 | |
| 73 | module_init(bpf_mt_init); |
| 74 | module_exit(bpf_mt_exit); |