include/linux/bpf-cgroup.h

   1 /* SPDX-License-Identifier: GPL-2.0 */
   2 #ifndef _BPF_CGROUP_H
   3 #define _BPF_CGROUP_H
   4
   5 #include <linux/bpf.h>
   6 #include <linux/errno.h>
   7 #include <linux/jump_label.h>
   8 #include <linux/percpu.h>
   9 #include <linux/rbtree.h>
  10 #include <uapi/linux/bpf.h>
  11
  12 struct sock;
  13 struct sockaddr;
  14 struct cgroup;
  15 struct sk_buff;
  16 struct bpf_map;
  17 struct bpf_prog;
  18 struct bpf_sock_ops_kern;
  19 struct bpf_cgroup_storage;
  20
  21 #ifdef CONFIG_CGROUP_BPF
  22
  23 extern struct static_key_false cgroup_bpf_enabled_key;
  24 #define cgroup_bpf_enabled static_branch_unlikely(&cgroup_bpf_enabled_key)
  25
  26 DECLARE_PER_CPU(struct bpf_cgroup_storage*,
  27                 bpf_cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE]);
  28
  29 #define for_each_cgroup_storage_type(stype) \
  30         for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++)
  31
  32 struct bpf_cgroup_storage_map;
  33
  34 struct bpf_storage_buffer {
  35         struct rcu_head rcu;
  36         char data[0];
  37 };
  38
  39 struct bpf_cgroup_storage {
  40         struct bpf_storage_buffer *buf;
  41         struct bpf_cgroup_storage_map *map;
  42         struct bpf_cgroup_storage_key key;
  43         struct list_head list;
  44         struct rb_node node;
  45         struct rcu_head rcu;
  46 };
  47
  48 struct bpf_prog_list {
  49         struct list_head node;
  50         struct bpf_prog *prog;
  51         struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE];
  52 };
  53
  54 struct bpf_prog_array;
  55
  56 struct cgroup_bpf {
  57         /* array of effective progs in this cgroup */
  58         struct bpf_prog_array __rcu *effective[MAX_BPF_ATTACH_TYPE];
  59
  60         /* attached progs to this cgroup and attach flags
  61          * when flags == 0 or BPF_F_ALLOW_OVERRIDE the progs list will
  62          * have either zero or one element
  63          * when BPF_F_ALLOW_MULTI the list can have up to BPF_CGROUP_MAX_PROGS
  64          */
  65         struct list_head progs[MAX_BPF_ATTACH_TYPE];
  66         u32 flags[MAX_BPF_ATTACH_TYPE];
  67
  68         /* temp storage for effective prog array used by prog_attach/detach */
  69         struct bpf_prog_array __rcu *inactive;
  70 };
  71
  72 void cgroup_bpf_put(struct cgroup *cgrp);
  73 int cgroup_bpf_inherit(struct cgroup *cgrp);
  74
  75 int __cgroup_bpf_attach(struct cgroup *cgrp, struct bpf_prog *prog,
  76                         enum bpf_attach_type type, u32 flags);
  77 int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
  78                         enum bpf_attach_type type, u32 flags);
  79 int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
  80                        union bpf_attr __user *uattr);
  81
  82 /* Wrapper for __cgroup_bpf_*() protected by cgroup_mutex */
  83 int cgroup_bpf_attach(struct cgroup *cgrp, struct bpf_prog *prog,
  84                       enum bpf_attach_type type, u32 flags);
  85 int cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
  86                       enum bpf_attach_type type, u32 flags);
  87 int cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
  88                      union bpf_attr __user *uattr);
  89
  90 int __cgroup_bpf_run_filter_skb(struct sock *sk,
  91                                 struct sk_buff *skb,
  92                                 enum bpf_attach_type type);
  93
  94 int __cgroup_bpf_run_filter_sk(struct sock *sk,
  95                                enum bpf_attach_type type);
  96
  97 int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
  98                                       struct sockaddr *uaddr,
  99                                       enum bpf_attach_type type,
 100                                       void *t_ctx);
 101
 102 int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
 103                                      struct bpf_sock_ops_kern *sock_ops,
 104                                      enum bpf_attach_type type);
 105
 106 int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
 107                                       short access, enum bpf_attach_type type);
 108
 109 static inline enum bpf_cgroup_storage_type cgroup_storage_type(
 110         struct bpf_map *map)
 111 {
 112         return BPF_CGROUP_STORAGE_SHARED;
 113 }
 114
 115 static inline void bpf_cgroup_storage_set(struct bpf_cgroup_storage
 116                                           *storage[MAX_BPF_CGROUP_STORAGE_TYPE])
 117 {
 118         enum bpf_cgroup_storage_type stype;
 119
 120         for_each_cgroup_storage_type(stype)
 121                 this_cpu_write(bpf_cgroup_storage[stype], storage[stype]);
 122 }
 123
 124 struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(struct bpf_prog *prog,
 125                                         enum bpf_cgroup_storage_type stype);
 126 void bpf_cgroup_storage_free(struct bpf_cgroup_storage *storage);
 127 void bpf_cgroup_storage_link(struct bpf_cgroup_storage *storage,
 128                              struct cgroup *cgroup,
 129                              enum bpf_attach_type type);
 130 void bpf_cgroup_storage_unlink(struct bpf_cgroup_storage *storage);
 131 int bpf_cgroup_storage_assign(struct bpf_prog *prog, struct bpf_map *map);
 132 void bpf_cgroup_storage_release(struct bpf_prog *prog, struct bpf_map *map);
 133
 134 /* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
 135 #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb)                             \
 136 ({                                                                            \
 137         int __ret = 0;                                                        \
 138         if (cgroup_bpf_enabled)                                               \
 139                 __ret = __cgroup_bpf_run_filter_skb(sk, skb,                  \
 140                                                     BPF_CGROUP_INET_INGRESS); \
 141                                                                               \
 142         __ret;                                                                \
 143 })
 144
 145 #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb)                               \
 146 ({                                                                             \
 147         int __ret = 0;                                                         \
 148         if (cgroup_bpf_enabled && sk && sk == skb->sk) {                       \
 149                 typeof(sk) __sk = sk_to_full_sk(sk);                           \
 150                 if (sk_fullsock(__sk))                                         \
 151                         __ret = __cgroup_bpf_run_filter_skb(__sk, skb,         \
 152                                                       BPF_CGROUP_INET_EGRESS); \
 153         }                                                                      \
 154         __ret;                                                                 \
 155 })
 156
 157 #define BPF_CGROUP_RUN_SK_PROG(sk, type)                                       \
 158 ({                                                                             \
 159         int __ret = 0;                                                         \
 160         if (cgroup_bpf_enabled) {                                              \
 161                 __ret = __cgroup_bpf_run_filter_sk(sk, type);                  \
 162         }                                                                      \
 163         __ret;                                                                 \
 164 })
 165
 166 #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk)                                      \
 167         BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET_SOCK_CREATE)
 168
 169 #define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk)                                \
 170         BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET4_POST_BIND)
 171
 172 #define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk)                                \
 173         BPF_CGROUP_RUN_SK_PROG(sk, BPF_CGROUP_INET6_POST_BIND)
 174
 175 #define BPF_CGROUP_RUN_SA_PROG(sk, uaddr, type)                                \
 176 ({                                                                             \
 177         int __ret = 0;                                                         \
 178         if (cgroup_bpf_enabled)                                                \
 179                 __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type,     \
 180                                                           NULL);               \
 181         __ret;                                                                 \
 182 })
 183
 184 #define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type, t_ctx)                    \
 185 ({                                                                             \
 186         int __ret = 0;                                                         \
 187         if (cgroup_bpf_enabled) {                                              \
 188                 lock_sock(sk);                                                 \
 189                 __ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type,     \
 190                                                           t_ctx);              \
 191                 release_sock(sk);                                              \
 192         }                                                                      \
 193         __ret;                                                                 \
 194 })
 195
 196 #define BPF_CGROUP_RUN_PROG_INET4_BIND(sk, uaddr)                              \
 197         BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET4_BIND)
 198
 199 #define BPF_CGROUP_RUN_PROG_INET6_BIND(sk, uaddr)                              \
 200         BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_BIND)
 201
 202 #define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (cgroup_bpf_enabled && \
 203                                             sk->sk_prot->pre_connect)
 204
 205 #define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr)                           \
 206         BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET4_CONNECT)
 207
 208 #define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr)                           \
 209         BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_CONNECT)
 210
 211 #define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr)                      \
 212         BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_CONNECT, NULL)
 213
 214 #define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr)                      \
 215         BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_CONNECT, NULL)
 216
 217 #define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx)                \
 218         BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_SENDMSG, t_ctx)
 219
 220 #define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx)                \
 221         BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_SENDMSG, t_ctx)
 222
 223 #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops)                                 \
 224 ({                                                                             \
 225         int __ret = 0;                                                         \
 226         if (cgroup_bpf_enabled && (sock_ops)->sk) {            \
 227                 typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk);               \
 228                 if (__sk && sk_fullsock(__sk))                                 \
 229                         __ret = __cgroup_bpf_run_filter_sock_ops(__sk,         \
 230                                                                  sock_ops,     \
 231                                                          BPF_CGROUP_SOCK_OPS); \
 232         }                                                                      \
 233         __ret;                                                                 \
 234 })
 235
 236 #define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access)         \
 237 ({                                                                            \
 238         int __ret = 0;                                                        \
 239         if (cgroup_bpf_enabled)                                               \
 240                 __ret = __cgroup_bpf_check_dev_permission(type, major, minor, \
 241                                                           access,             \
 242                                                           BPF_CGROUP_DEVICE); \
 243                                                                               \
 244         __ret;                                                                \
 245 })
 246 int cgroup_bpf_prog_attach(const union bpf_attr *attr,
 247                            enum bpf_prog_type ptype, struct bpf_prog *prog);
 248 int cgroup_bpf_prog_detach(const union bpf_attr *attr,
 249                            enum bpf_prog_type ptype);
 250 int cgroup_bpf_prog_query(const union bpf_attr *attr,
 251                           union bpf_attr __user *uattr);
 252 #else
 253
 254 struct bpf_prog;
 255 struct cgroup_bpf {};
 256 static inline void cgroup_bpf_put(struct cgroup *cgrp) {}
 257 static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }
 258
 259 static inline int cgroup_bpf_prog_attach(const union bpf_attr *attr,
 260                                          enum bpf_prog_type ptype,
 261                                          struct bpf_prog *prog)
 262 {
 263         return -EINVAL;
 264 }
 265
 266 static inline int cgroup_bpf_prog_detach(const union bpf_attr *attr,
 267                                          enum bpf_prog_type ptype)
 268 {
 269         return -EINVAL;
 270 }
 271
 272 static inline int cgroup_bpf_prog_query(const union bpf_attr *attr,
 273                                         union bpf_attr __user *uattr)
 274 {
 275         return -EINVAL;
 276 }
 277
 278 static inline void bpf_cgroup_storage_set(
 279         struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE]) {}
 280 static inline int bpf_cgroup_storage_assign(struct bpf_prog *prog,
 281                                             struct bpf_map *map) { return 0; }
 282 static inline void bpf_cgroup_storage_release(struct bpf_prog *prog,
 283                                               struct bpf_map *map) {}
 284 static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
 285         struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return 0; }
 286 static inline void bpf_cgroup_storage_free(
 287         struct bpf_cgroup_storage *storage) {}
 288
 289 #define cgroup_bpf_enabled (0)
 290 #define BPF_CGROUP_PRE_CONNECT_ENABLED(sk) (0)
 291 #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
 292 #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
 293 #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
 294 #define BPF_CGROUP_RUN_PROG_INET4_BIND(sk, uaddr) ({ 0; })
 295 #define BPF_CGROUP_RUN_PROG_INET6_BIND(sk, uaddr) ({ 0; })
 296 #define BPF_CGROUP_RUN_PROG_INET4_POST_BIND(sk) ({ 0; })
 297 #define BPF_CGROUP_RUN_PROG_INET6_POST_BIND(sk) ({ 0; })
 298 #define BPF_CGROUP_RUN_PROG_INET4_CONNECT(sk, uaddr) ({ 0; })
 299 #define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })
 300 #define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })
 301 #define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
 302 #define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
 303 #define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
 304 #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
 305 #define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; })
 306
 307 #define for_each_cgroup_storage_type(stype) for (; false; )
 308
 309 #endif /* CONFIG_CGROUP_BPF */
 310
 311 #endif /* _BPF_CGROUP_H */