From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44E86C71153 for ; Mon, 4 Sep 2023 11:45:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347759AbjIDLpo (ORCPT ); Mon, 4 Sep 2023 07:45:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47556 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232492AbjIDLpn (ORCPT ); Mon, 4 Sep 2023 07:45:43 -0400 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.216]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 47B121AB; Mon, 4 Sep 2023 04:45:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=JMU8s U9ZldyZxdWa5jQ9IPJKvYaT1NQUbvws9N83oNc=; b=SekLazFZMqmJVUa94F4Az XY12XNjBRGuDWAR5DyWO6TFu8gZFaT8e57RxeSA84K2AYRO6tv2Tl/ky3mA55Cbo pe9sjOF1r3bukVWITPOuNi0W2mE4wOhZ//4mi1PXQrz6wsMoT8lp/95Mn7e5RDJK xIuWrl1HUAqn3J36Z/TVP0= Received: from localhost.localdomain (unknown [111.35.184.199]) by zwqz-smtp-mta-g2-3 (Coremail) with SMTP id _____wA31JCSv_VkIMm5BA--.20917S4; Mon, 04 Sep 2023 19:29:39 +0800 (CST) From: David Wang <00107082@163.com> To: fw@strlen.de Cc: 00107082@163.com, andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, haoluo@google.com, john.fastabend@gmail.com, jolsa@kernel.org, kpsingh@kernel.org, linux-kernel@vger.kernel.org, martin.lau@linux.dev, sdf@google.com, song@kernel.org, yonghong.song@linux.dev Subject: Date: Mon, 4 Sep 2023 19:29:22 +0800 Message-Id: <20230904112922.13882-1-00107082@163.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20230904104856.GE11802@breakpoint.cc> References: <20230904104856.GE11802@breakpoint.cc> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CM-TRANSID: _____wA31JCSv_VkIMm5BA--.20917S4 X-Coremail-Antispam: 1Uf129KBjvJXoW7Kr4DZF45Xr1DXF4kZFyxKrg_yoW8Gr47pa y5GaySka1UJF4fKFn7Wry7Za4IyrZ5Za45Jws8tayjk3y3Xry2gw1vkFW0krWfZ3W8Ww1a vFWj9w1rJws3A3DanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07UUpnQUUUUU= X-Originating-IP: [111.35.184.199] X-CM-SenderInfo: qqqrilqqysqiywtou0bp/xtbBEAfgqmNfu9Xd3gAAsM Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org At 2023-09-04 18:48:56, "Florian Westphal" wrote: >David Wang <00107082@163.com> wrote: >> This sample code implements a simple ipv4 >> blacklist via the new bpf type BPF_PROG_TYPE_NETFILTER, >> which was introduced in 6.4. >> >> The bpf program drops package if destination ip address >> hits a match in the map of type BPF_MAP_TYPE_LPM_TRIE, >> >> The userspace code would load the bpf program, >> attach it to netfilter's FORWARD/OUTPUT hook, >> and then write ip patterns into the bpf map. > >Thanks, I think its good to have this. Thanks for the quick response! Glad to contribute! >> + >> +#define NF_DROP 0 >> +#define NF_ACCEPT 1 > >If you are interested, you could send a patch for nf-next that >makes the uapi headers expose this as enum, AFAIU that would make >the verdict nanes available via vmlinux.h. > I think I can work on this. >> + if (pvalue) { >> + /* cat /sys/kernel/debug/tracing/trace_pipe */ >> + bpf_printk("rule matched with %d...\n", *pvalue); > >If you are interested you could send a patch that adds a kfunc to >nf_bpf_link that exposes nf_log_packet() to bpf. > >nf_log_packet has a terrible api, I suggest to have the kfunc take >'struct nf_hook_state *' instead of 6+ members of that struct as >argument. > Package logging strategy is out of my league, for now, but I will keep eye on this. David