include/linux/bpf-cgroup.h

   1 #ifndef _BPF_CGROUP_H
   2 #define _BPF_CGROUP_H
   3
   4 #include <linux/jump_label.h>
   5 #include <uapi/linux/bpf.h>
   6
   7 struct sock;
   8 struct cgroup;
   9 struct sk_buff;
  10 struct bpf_sock_ops_kern;
  11
  12 #ifdef CONFIG_CGROUP_BPF
  13
  14 extern struct static_key_false cgroup_bpf_enabled_key;
  15 #define cgroup_bpf_enabled static_branch_unlikely(&cgroup_bpf_enabled_key)
  16
  17 struct bpf_prog_list {
  18         struct list_head node;
  19         struct bpf_prog *prog;
  20 };
  21
  22 struct bpf_prog_array;
  23
  24 struct cgroup_bpf {
  25         /* array of effective progs in this cgroup */
  26         struct bpf_prog_array __rcu *effective[MAX_BPF_ATTACH_TYPE];
  27
  28         /* attached progs to this cgroup and attach flags
  29          * when flags == 0 or BPF_F_ALLOW_OVERRIDE the progs list will
  30          * have either zero or one element
  31          * when BPF_F_ALLOW_MULTI the list can have up to BPF_CGROUP_MAX_PROGS
  32          */
  33         struct list_head progs[MAX_BPF_ATTACH_TYPE];
  34         u32 flags[MAX_BPF_ATTACH_TYPE];
  35
  36         /* temp storage for effective prog array used by prog_attach/detach */
  37         struct bpf_prog_array __rcu *inactive;
  38 };
  39
  40 void cgroup_bpf_put(struct cgroup *cgrp);
  41 int cgroup_bpf_inherit(struct cgroup *cgrp);
  42
  43 int __cgroup_bpf_attach(struct cgroup *cgrp, struct bpf_prog *prog,
  44                         enum bpf_attach_type type, u32 flags);
  45 int __cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
  46                         enum bpf_attach_type type, u32 flags);
  47 int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
  48                        union bpf_attr __user *uattr);
  49
  50 /* Wrapper for __cgroup_bpf_*() protected by cgroup_mutex */
  51 int cgroup_bpf_attach(struct cgroup *cgrp, struct bpf_prog *prog,
  52                       enum bpf_attach_type type, u32 flags);
  53 int cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog,
  54                       enum bpf_attach_type type, u32 flags);
  55 int cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,
  56                      union bpf_attr __user *uattr);
  57
  58 int __cgroup_bpf_run_filter_skb(struct sock *sk,
  59                                 struct sk_buff *skb,
  60                                 enum bpf_attach_type type);
  61
  62 int __cgroup_bpf_run_filter_sk(struct sock *sk,
  63                                enum bpf_attach_type type);
  64
  65 int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
  66                                      struct bpf_sock_ops_kern *sock_ops,
  67                                      enum bpf_attach_type type);
  68
  69 /* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */
  70 #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb)                             \
  71 ({                                                                            \
  72         int __ret = 0;                                                        \
  73         if (cgroup_bpf_enabled)                                               \
  74                 __ret = __cgroup_bpf_run_filter_skb(sk, skb,                  \
  75                                                     BPF_CGROUP_INET_INGRESS); \
  76                                                                               \
  77         __ret;                                                                \
  78 })
  79
  80 #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb)                               \
  81 ({                                                                             \
  82         int __ret = 0;                                                         \
  83         if (cgroup_bpf_enabled && sk && sk == skb->sk) {                       \
  84                 typeof(sk) __sk = sk_to_full_sk(sk);                           \
  85                 if (sk_fullsock(__sk))                                         \
  86                         __ret = __cgroup_bpf_run_filter_skb(__sk, skb,         \
  87                                                       BPF_CGROUP_INET_EGRESS); \
  88         }                                                                      \
  89         __ret;                                                                 \
  90 })
  91
  92 #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk)                                      \
  93 ({                                                                             \
  94         int __ret = 0;                                                         \
  95         if (cgroup_bpf_enabled && sk) {                                        \
  96                 __ret = __cgroup_bpf_run_filter_sk(sk,                         \
  97                                                  BPF_CGROUP_INET_SOCK_CREATE); \
  98         }                                                                      \
  99         __ret;                                                                 \
 100 })
 101
 102 #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops)                                 \
 103 ({                                                                             \
 104         int __ret = 0;                                                         \
 105         if (cgroup_bpf_enabled && (sock_ops)->sk) {            \
 106                 typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk);               \
 107                 if (__sk && sk_fullsock(__sk))                                 \
 108                         __ret = __cgroup_bpf_run_filter_sock_ops(__sk,         \
 109                                                                  sock_ops,     \
 110                                                          BPF_CGROUP_SOCK_OPS); \
 111         }                                                                      \
 112         __ret;                                                                 \
 113 })
 114 #else
 115
 116 struct cgroup_bpf {};
 117 static inline void cgroup_bpf_put(struct cgroup *cgrp) {}
 118 static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; }
 119
 120 #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk,skb) ({ 0; })
 121 #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; })
 122 #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; })
 123 #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
 124
 125 #endif /* CONFIG_CGROUP_BPF */
 126
 127 #endif /* _BPF_CGROUP_H */