blob: a7f16e0f8d68b94bc5743a75c41b538794725724 [file] [log] [blame]
Greg Kroah-Hartmanb2441312017-11-01 15:07:57 +01001/* SPDX-License-Identifier: GPL-2.0 */
Daniel Mack30070982016-11-23 16:52:26 +01002#ifndef _BPF_CGROUP_H
3#define _BPF_CGROUP_H
4
Daniel Mack30070982016-11-23 16:52:26 +01005#include <linux/jump_label.h>
6#include <uapi/linux/bpf.h>
7
8struct sock;
9struct cgroup;
10struct sk_buff;
Lawrence Brakmo40304b22017-06-30 20:02:40 -070011struct bpf_sock_ops_kern;
Daniel Mack30070982016-11-23 16:52:26 +010012
13#ifdef CONFIG_CGROUP_BPF
14
15extern struct static_key_false cgroup_bpf_enabled_key;
16#define cgroup_bpf_enabled static_branch_unlikely(&cgroup_bpf_enabled_key)
17
Alexei Starovoitov324bda9e62017-10-02 22:50:21 -070018struct bpf_prog_list {
19 struct list_head node;
20 struct bpf_prog *prog;
21};
22
23struct bpf_prog_array;
24
Daniel Mack30070982016-11-23 16:52:26 +010025struct cgroup_bpf {
Alexei Starovoitov324bda9e62017-10-02 22:50:21 -070026 /* array of effective progs in this cgroup */
27 struct bpf_prog_array __rcu *effective[MAX_BPF_ATTACH_TYPE];
28
29 /* attached progs to this cgroup and attach flags
30 * when flags == 0 or BPF_F_ALLOW_OVERRIDE the progs list will
31 * have either zero or one element
32 * when BPF_F_ALLOW_MULTI the list can have up to BPF_CGROUP_MAX_PROGS
Daniel Mack30070982016-11-23 16:52:26 +010033 */
Alexei Starovoitov324bda9e62017-10-02 22:50:21 -070034 struct list_head progs[MAX_BPF_ATTACH_TYPE];
35 u32 flags[MAX_BPF_ATTACH_TYPE];
36
37 /* temp storage for effective prog array used by prog_attach/detach */
38 struct bpf_prog_array __rcu *inactive;
Daniel Mack30070982016-11-23 16:52:26 +010039};
40
41void cgroup_bpf_put(struct cgroup *cgrp);
Alexei Starovoitov324bda9e62017-10-02 22:50:21 -070042int cgroup_bpf_inherit(struct cgroup *cgrp);
Daniel Mack30070982016-11-23 16:52:26 +010043
Alexei Starovoitov324bda9e62017-10-02 22:50:21 -070044int __cgroup_bpf_attach(struct cgroup *cgrp, struct bpf_prog *prog,
45 enum bpf_attach_type type, u32 flags);
46int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
47 enum bpf_attach_type type, u32 flags);
Alexei Starovoitov468e2f62017-10-02 22:50:22 -070048int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
49 union bpf_attr __user *uattr);
Daniel Mack30070982016-11-23 16:52:26 +010050
Alexei Starovoitov324bda9e62017-10-02 22:50:21 -070051/* Wrapper for __cgroup_bpf_*() protected by cgroup_mutex */
52int cgroup_bpf_attach(struct cgroup *cgrp, struct bpf_prog *prog,
53 enum bpf_attach_type type, u32 flags);
54int cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
55 enum bpf_attach_type type, u32 flags);
Alexei Starovoitov468e2f62017-10-02 22:50:22 -070056int cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
57 union bpf_attr __user *uattr);
Daniel Mack30070982016-11-23 16:52:26 +010058
David Ahernb2cd1252016-12-01 08:48:03 -080059int __cgroup_bpf_run_filter_skb(struct sock *sk,
60 struct sk_buff *skb,
61 enum bpf_attach_type type);
Daniel Mack30070982016-11-23 16:52:26 +010062
David Ahern610236582016-12-01 08:48:04 -080063int __cgroup_bpf_run_filter_sk(struct sock *sk,
64 enum bpf_attach_type type);
65
Lawrence Brakmo40304b22017-06-30 20:02:40 -070066int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
67 struct bpf_sock_ops_kern *sock_ops,
68 enum bpf_attach_type type);
69
Roman Gushchinebc614f2017-11-05 08:15:32 -050070int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
71 short access, enum bpf_attach_type type);
72
David Ahernb2cd1252016-12-01 08:48:03 -080073/* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
74#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb) \
75({ \
76 int __ret = 0; \
77 if (cgroup_bpf_enabled) \
78 __ret = __cgroup_bpf_run_filter_skb(sk, skb, \
79 BPF_CGROUP_INET_INGRESS); \
80 \
81 __ret; \
Daniel Mack30070982016-11-23 16:52:26 +010082})
83
David Ahernb2cd1252016-12-01 08:48:03 -080084#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb) \
85({ \
86 int __ret = 0; \
87 if (cgroup_bpf_enabled && sk && sk == skb->sk) { \
88 typeof(sk) __sk = sk_to_full_sk(sk); \
89 if (sk_fullsock(__sk)) \
90 __ret = __cgroup_bpf_run_filter_skb(__sk, skb, \
91 BPF_CGROUP_INET_EGRESS); \
92 } \
93 __ret; \
Daniel Mack30070982016-11-23 16:52:26 +010094})
95
David Ahern610236582016-12-01 08:48:04 -080096#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) \
97({ \
98 int __ret = 0; \
99 if (cgroup_bpf_enabled && sk) { \
100 __ret = __cgroup_bpf_run_filter_sk(sk, \
101 BPF_CGROUP_INET_SOCK_CREATE); \
102 } \
103 __ret; \
104})
105
Lawrence Brakmo40304b22017-06-30 20:02:40 -0700106#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) \
107({ \
108 int __ret = 0; \
109 if (cgroup_bpf_enabled && (sock_ops)->sk) { \
110 typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk); \
WANG Congdf39a9f2017-07-17 11:42:55 -0700111 if (__sk && sk_fullsock(__sk)) \
Lawrence Brakmo40304b22017-06-30 20:02:40 -0700112 __ret = __cgroup_bpf_run_filter_sock_ops(__sk, \
113 sock_ops, \
114 BPF_CGROUP_SOCK_OPS); \
115 } \
116 __ret; \
117})
Roman Gushchinebc614f2017-11-05 08:15:32 -0500118
119#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access) \
120({ \
121 int __ret = 0; \
122 if (cgroup_bpf_enabled) \
123 __ret = __cgroup_bpf_check_dev_permission(type, major, minor, \
124 access, \
125 BPF_CGROUP_DEVICE); \
126 \
127 __ret; \
128})
Daniel Mack30070982016-11-23 16:52:26 +0100129#else
130
131struct cgroup_bpf {};
132static inline void cgroup_bpf_put(struct cgroup *cgrp) {}
Alexei Starovoitov324bda9e62017-10-02 22:50:21 -0700133static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }
Daniel Mack30070982016-11-23 16:52:26 +0100134
135#define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
136#define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
David Ahern610236582016-12-01 08:48:04 -0800137#define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
Lawrence Brakmo40304b22017-06-30 20:02:40 -0700138#define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
Roman Gushchinebc614f2017-11-05 08:15:32 -0500139#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; })
Daniel Mack30070982016-11-23 16:52:26 +0100140
141#endif /* CONFIG_CGROUP_BPF */
142
143#endif /* _BPF_CGROUP_H */