xt_bpf: fix handling of pinned objects
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest2 patches 9 repliesIn review
- v12 patches 1 replySuperseded
Changes in v2 from the cover letter
- fixed From field
Patches in v2 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | iptables: support match info fixup after tc_initinclude/ iptables/ iptables/ | +72 | 8 replies | |
| 2/2 | extensions: xt_bpf: get the pinned ebpf object when match is initializedextensions/ | +9 | 1 reply |
Reviews trailers per patch
1 of 2 patches has a Reviewed-by or Acked-by.
| Patch | Willem de Bruijn |
|---|---|
| 1/2 | |
| 2/2 | A-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH v2 0/2] xt_bpf: fix handling of pinned objects
From: Rafael Buchbinder <[email protected]>
From: Rafael Buchbinder <[email protected]>
Following set of commits fixes xt_bpf extension to correctly handle pinned eBPF programs.
The origin of the bug lies in the fact that xt_bpf_info_v1 structure requires an open file descriptor to create an eBPF match. This file descriptor is checked on every replace. However, as this file descriptor is valid only for the iptables invocation which loads the eBPF for the first time, all subsequent iptables invocations fail in bpf_mt_check (kernel) function.
See discussion in [1] for more details.
The following patches add a hook in extensions which is called immediately after TC_INIT to fixup whatever needs to be fixed up. In case of xt_bpf, the fixup function gets the eBPF object by path to populate xt_bpf_info_v1 structure with a valid file descriptor.
[1] https://marc.info/?l=netfilter-devel&m=150530909630143&w=2
Since v1:
- fixed From field
Rafael Buchbinder (2):
iptables: support match info fixup after tc_init
extensions: xt_bpf: get the pinned ebpf object when match is
initialized
extensions/libxt_bpf.c | 9 +++++++++ include/xtables.h | 3 +++ iptables/ip6tables.c | 35 +++++++++++++++++++++++++++++++++++ iptables/iptables.c | 34 ++++++++++++++++++++++++++++++++++ 4 files changed, 81 insertions(+)
Signature · 1 line
2.14.1