Skip to contentSkip to conversation

net: export attach/detach filter routines

PATCH In review Michael S. Tsirkin 3 participants 5 messages Feb 14, 2010 – Feb 15, 2010 1 message not in the archive

Subsystems (5)
Networking Network drivers BPF BPF networking +1 more subsystems
lore
Share & tools
lore

Michael S. Tsirkin

author
#1 lore raw

PATCH 1/2 net: export attach/detach filter routines

In reply to a message not in the archive

Export sk_attach_filter/sk_detach_filter routines, so that tun module can use them.

Signed-off-by Michael S. Tsirkin <[email protected]>
---
 net/core/filter.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
net/core/filter.c +2 -0
index 4e0712a..08e40f3 100644
@@ -530,6 +530,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 		sk_filter_delayed_uncharge(sk, old_fp);
 	return 0;
 }
+EXPORT_SYMBOL_GPL(sk_attach_filter);
 
 int sk_detach_filter(struct sock *sk)
 {

@@ -546,3 +547,4 @@ int sk_detach_filter(struct sock *sk)
 	rcu_read_unlock_bh();
 	return ret;
 }
+EXPORT_SYMBOL_GPL(sk_detach_filter);
Signature · 1 line
1.6.6.144.g5c3af
author
#2 lore raw

PATCH 2/2 tun: socket filter support

In reply to a message not in the archive

This patch adds Linux Socket Filter support to
tun driver.

Signed-off-by Michael S. Tsirkin <[email protected]>
---
 drivers/net/tun.c      |   26 ++++++++++++++++++++++++++
 include/linux/if_tun.h |    3 +++
 2 files changed, 29 insertions(+), 0 deletions(-)
drivers/net/tun.c +26 -0
index 5adb3d1..ce1efa4 100644
@@ -61,6 +61,7 @@
 #include <linux/crc32.h>
 #include <linux/nsproxy.h>
 #include <linux/virtio_net.h>
+#include <linux/rcupdate.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>

@@ -366,6 +367,10 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
 	if (!check_filter(&tun->txflt, skb))
 		goto drop;
 
+	if (tun->socket.sk->sk_filter &&
+	    sk_filter(tun->socket.sk, skb))
+		goto drop;
+
 	if (skb_queue_len(&tun->socket.sk->sk_receive_queue) >= dev->tx_queue_len) {
 		if (!(tun->flags & TUN_ONE_QUEUE)) {
 			/* Normal queueing mode. */

@@ -1162,6 +1167,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
 	struct tun_file *tfile = file->private_data;
 	struct tun_struct *tun;
 	void __user* argp = (void __user*)arg;
+	struct sock_fprog fprog;
 	struct ifreq ifr;
 	int sndbuf;
 	int ret;

@@ -1309,6 +1315,26 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
 		tun->socket.sk->sk_sndbuf = sndbuf;
 		break;
 
+	case TUNATTACHFILTER:
+		/* Can be set only for TAPs */
+		ret = -EINVAL;
+		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
+			break;
+		ret = -EFAULT;
+		if (copy_from_user(&fprog, argp, sizeof(fprog)))
+			break;
+
+		ret = sk_attach_filter(&fprog, tun->socket.sk);
+		break;
+
+	case TUNDETACHFILTER:
+		/* Can be set only for TAPs */
+		ret = -EINVAL;
+		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
+			break;
+		ret = sk_detach_filter(tun->socket.sk);
+		break;
+
 	default:
 		ret = -EINVAL;
 		break;
include/linux/if_tun.h +3 -0
index 404abe0..1350a24 100644
@@ -18,6 +18,7 @@
 
 #include <linux/types.h>
 #include <linux/if_ether.h>
+#include <linux/filter.h>
 
 /* Read queue size */
 #define TUN_READQ_SIZE	500

@@ -48,6 +49,8 @@
 #define TUNGETIFF      _IOR('T', 210, unsigned int)
 #define TUNGETSNDBUF   _IOR('T', 211, int)
 #define TUNSETSNDBUF   _IOW('T', 212, int)
+#define TUNATTACHFILTER _IOW('T', 213, struct sock_fprog)
+#define TUNDETACHFILTER _IOW('T', 214, struct sock_fprog)
 
 /* TUNSETIFF ifr flags */
 #define IFF_TUN		0x0001
Signature · 1 line
1.6.6.144.g5c3af
#3 lore raw

Re: [PATCH 2/2] tun: socket filter support

Quoted 10 lines · Michael S. Tsirkin
drivers/net/tun.c +10 -0
+	case TUNATTACHFILTER:
+		/* Can be set only for TAPs */
+		ret = -EINVAL;
+		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
+			break;
+		ret = -EFAULT;
+		if (copy_from_user(&fprog, argp, sizeof(fprog)))
+			break;
+
+		ret = sk_attach_filter(&fprog, tun->socket.sk);

drivers/net/tun.c static long __tun_chr_ioctl(struct file *file, unsigned int cmd, · line 1337

Quoted 10 lines
drivers/net/tun.c +10 -0
+		break;
+
+	case TUNDETACHFILTER:
+		/* Can be set only for TAPs */
+		ret = -EINVAL;
+		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
+			break;
+		ret = sk_detach_filter(tun->socket.sk);
+		break;
+

I'm not sure how the tun socket is exposed, but won't the regular SO_ATTACH_FILTER/SO_DETACH_FILTER setsockopts already work for tun sockets?

#4 lore raw

Re: [PATCH 2/2] tun: socket filter support

Quoted 3 lines · Patrick McHardy

I'm not sure how the tun socket is exposed, but won't the regular SO_ATTACH_FILTER/SO_DETACH_FILTER setsockopts already work for tun sockets?

The tun socket is not exposed at all, it's an implementation detail of the tun/tap driver, which only has a chardev interface with ioctl methods.

Arnd

#5 lore raw

Re: [PATCH 2/2] tun: socket filter support

Quoted 8 lines · Arnd Bergmann
Quoted 3 lines · Patrick McHardy

I'm not sure how the tun socket is exposed, but won't the regular SO_ATTACH_FILTER/SO_DETACH_FILTER setsockopts already work for tun sockets?

The tun socket is not exposed at all, it's an implementation detail of the tun/tap driver, which only has a chardev interface with ioctl methods.

I see, thanks for the explanation.