xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: xt_bpf: support ebpf

Browse Source 
Add support for attaching an eBPF object by file descriptor.

The iptables binary can be called with a path to an elf object or a
pinned bpf object. Also pass the mode and path to the kernel to be
able to return it later for iptables dump and save.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Willem de Bruijn
2016-12-06 16:25:02 -05:00
committed by Pablo Neira Ayuso
parent 5bad87348c
commit 2c16d60332
2 changed files with 101 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
include/uapi/linux/netfilter/xt_bpf.h
View File

@@ -2,9 +2,11 @@
#define _XT_BPF_H
#include <linux/filter.h>
#include <linux/limits.h>
#include <linux/types.h>
#define XT_BPF_MAX_NUM_INSTR 64
#define XT_BPF_PATH_MAX (XT_BPF_MAX_NUM_INSTR * sizeof(struct sock_filter))
struct bpf_prog;
@@ -16,4 +18,23 @@ struct xt_bpf_info {
struct bpf_prog *filter __attribute__((aligned(8)));
};
enum xt_bpf_modes {
XT_BPF_MODE_BYTECODE,
XT_BPF_MODE_FD_PINNED,
XT_BPF_MODE_FD_ELF,
};
struct xt_bpf_info_v1 {
__u16 mode;
__u16 bpf_program_num_elem;
__s32 fd;
union {
struct sock_filter bpf_program[XT_BPF_MAX_NUM_INSTR];
char path[XT_BPF_PATH_MAX];
};
/* only used in the kernel */
struct bpf_prog *filter __attribute__((aligned(8)));
};
#endif /*_XT_BPF_H */