]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/core/bpf-firewall.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tree-wide: make sure net/if.h is included before any linux/ header
[thirdparty/systemd.git] / src / core / bpf-firewall.c
CommitLineData
db9ecf05 1/* SPDX-License-Identifier: LGPL-2.1-or-later */
1988a9d1 2
edda10f2
FS		 3/* Make sure the net/if.h header is included before any linux/ one */
4#include <net/if.h>
1988a9d1
DM		 5#include <arpa/inet.h>
6#include <assert.h>
7#include <errno.h>
8#include <fcntl.h>
01234e1f 9#include <linux/bpf_insn.h>
1988a9d1 10#include <net/ethernet.h>
1988a9d1
DM		 11#include <netinet/ip.h>
12#include <netinet/ip6.h>
13#include <stddef.h>
14#include <stdio.h>
15#include <stdlib.h>
1988a9d1
DM		 16#include <unistd.h>
17
18#include "alloc-util.h"
19#include "bpf-firewall.h"
20#include "bpf-program.h"
21#include "fd-util.h"
84ebe6f0 22#include "in-addr-prefix-util.h"
0a970718 23#include "memory-util.h"
e93672ee 24#include "missing_syscall.h"
1988a9d1 25#include "unit.h"
5cfa33e0 26#include "strv.h"
f140ed02 27#include "virt.h"
1988a9d1
DM		 28
29enum {
30 MAP_KEY_PACKETS,
31 MAP_KEY_BYTES,
32};
33
34enum {
35 ACCESS_ALLOWED = 1,
36 ACCESS_DENIED = 2,
37};
38
39/* Compile instructions for one list of addresses, one direction and one specific verdict on matches. */
40
41static int add_lookup_instructions(
42 BPFProgram *p,
43 int map_fd,
44 int protocol,
45 bool is_ingress,
46 int verdict) {
47
48 int r, addr_offset, addr_size;
49
50 assert(p);
51 assert(map_fd >= 0);
52
53 switch (protocol) {
54
55 case ETH_P_IP:
56 addr_size = sizeof(uint32_t);
57 addr_offset = is_ingress ?
58 offsetof(struct iphdr, saddr) :
59 offsetof(struct iphdr, daddr);
60 break;
61
62 case ETH_P_IPV6:
63 addr_size = 4 * sizeof(uint32_t);
64 addr_offset = is_ingress ?
65 offsetof(struct ip6_hdr, ip6_src.s6_addr) :
66 offsetof(struct ip6_hdr, ip6_dst.s6_addr);
67 break;
68
69 default:
70 return -EAFNOSUPPORT;
71 }
72
73 do {
da890466 74 /* Compare IPv4 with one word instruction (32-bit) */
1988a9d1
DM		 75 struct bpf_insn insn[] = {
76 /* If skb->protocol != ETH_P_IP, skip this whole block. The offset will be set later. */
77 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, htobe16(protocol), 0),
78
79 /*
80 * Call into BPF_FUNC_skb_load_bytes to load the dst/src IP address
81 *
82 * R1: Pointer to the skb
83 * R2: Data offset
84 * R3: Destination buffer on the stack (r10 - 4)
85 * R4: Number of bytes to read (4)
86 */
87
88 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
89 BPF_MOV32_IMM(BPF_REG_2, addr_offset),
90
91 BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
92 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -addr_size),
93
94 BPF_MOV32_IMM(BPF_REG_4, addr_size),
95 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
96
97 /*
98 * Call into BPF_FUNC_map_lookup_elem to see if the address matches any entry in the
99 * LPM trie map. For this to work, the prefixlen field of 'struct bpf_lpm_trie_key'
100 * has to be set to the maximum possible value.
101 *
102 * On success, the looked up value is stored in R0. For this application, the actual
103 * value doesn't matter, however; we just set the bit in @verdict in R8 if we found any
104 * matching value.
105 */
106
107 BPF_LD_MAP_FD(BPF_REG_1, map_fd),
108 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
109 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -addr_size - sizeof(uint32_t)),
110 BPF_ST_MEM(BPF_W, BPF_REG_2, 0, addr_size * 8),
111
112 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
113 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
114 BPF_ALU32_IMM(BPF_OR, BPF_REG_8, verdict),
115 };
116
117 /* Jump label fixup */
118 insn[0].off = ELEMENTSOF(insn) - 1;
119
120 r = bpf_program_add_instructions(p, insn, ELEMENTSOF(insn));
121 if (r < 0)
122 return r;
123
124 } while (false);
125
126 return 0;
127}
128
4c1567f2
AZ		 129static int add_instructions_for_ip_any(
130 BPFProgram *p,
131 int verdict) {
132 int r;
133
134 assert(p);
135
2899aac4 136 const struct bpf_insn insn[] = {
4c1567f2
AZ		 137 BPF_ALU32_IMM(BPF_OR, BPF_REG_8, verdict),
138 };
139
140 r = bpf_program_add_instructions(p, insn, 1);
141 if (r < 0)
142 return r;
143
144 return 0;
145}
146
1988a9d1
DM		 147static int bpf_firewall_compile_bpf(
148 Unit *u,
e0c694c7 149 const char *prog_name,
1988a9d1 150 bool is_ingress,
4c1567f2
AZ		 151 BPFProgram **ret,
152 bool ip_allow_any,
153 bool ip_deny_any) {
1988a9d1 154
2899aac4 155 const struct bpf_insn pre_insn[] = {
1988a9d1
DM		 156 /*
157 * When the eBPF program is entered, R1 contains the address of the skb.
158 * However, R1-R5 are scratch registers that are not preserved when calling
159 * into kernel functions, so we need to save anything that's supposed to
160 * stay around to R6-R9. Save the skb to R6.
161 */
162 BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
163
164 /*
165 * Although we cannot access the skb data directly from eBPF programs used in this
166 * scenario, the kernel has prepared some fields for us to access through struct __sk_buff.
167 * Load the protocol (IPv4, IPv6) used by the packet in flight once and cache it in R7
168 * for later use.
169 */
170 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6, offsetof(struct __sk_buff, protocol)),
171
172 /*
173 * R8 is used to keep track of whether any address check has explicitly allowed or denied the packet
174 * through ACCESS_DENIED or ACCESS_ALLOWED bits. Reset them both to 0 in the beginning.
175 */
176 BPF_MOV32_IMM(BPF_REG_8, 0),
177 };
178
179 /*
180 * The access checkers compiled for the configured allowance and denial lists
181 * write to R8 at runtime. The following code prepares for an early exit that
182 * skip the accounting if the packet is denied.
183 *
184 * R0 = 1
185 * if (R8 == ACCESS_DENIED)
186 * R0 = 0
187 *
188 * This means that if both ACCESS_DENIED and ACCESS_ALLOWED are set, the packet
189 * is allowed to pass.
190 */
2899aac4 191 const struct bpf_insn post_insn[] = {
1988a9d1
DM		 192 BPF_MOV64_IMM(BPF_REG_0, 1),
193 BPF_JMP_IMM(BPF_JNE, BPF_REG_8, ACCESS_DENIED, 1),
194 BPF_MOV64_IMM(BPF_REG_0, 0),
195 };
196
76dc1725 197 _cleanup_(bpf_program_freep) BPFProgram *p = NULL;
1988a9d1
DM		 198 int accounting_map_fd, r;
199 bool access_enabled;
9cc54544 200 CGroupRuntime *crt;
1988a9d1
DM		 201
202 assert(u);
203 assert(ret);
204
9cc54544
LP		 205 crt = unit_get_cgroup_runtime(u);
206 if (!crt) {
207 *ret = NULL;
208 return 0;
209 }
210
1988a9d1 211 accounting_map_fd = is_ingress ?
9cc54544
LP		 212 crt->ip_accounting_ingress_map_fd :
213 crt->ip_accounting_egress_map_fd;
1988a9d1
DM		 214
215 access_enabled =
9cc54544
LP		 216 crt->ipv4_allow_map_fd >= 0 ||
217 crt->ipv6_allow_map_fd >= 0 ||
218 crt->ipv4_deny_map_fd >= 0 ||
219 crt->ipv6_deny_map_fd >= 0 ||
4c1567f2
AZ		 220 ip_allow_any ||
221 ip_deny_any;
1988a9d1
DM		 222
223 if (accounting_map_fd < 0 && !access_enabled) {
224 *ret = NULL;
225 return 0;
226 }
227
8fe9dbb9 228 r = bpf_program_new(BPF_PROG_TYPE_CGROUP_SKB, prog_name, &p);
1988a9d1
DM		 229 if (r < 0)
230 return r;
231
232 r = bpf_program_add_instructions(p, pre_insn, ELEMENTSOF(pre_insn));
233 if (r < 0)
234 return r;
235
236 if (access_enabled) {
237 /*
238 * The simple rule this function translates into eBPF instructions is:
239 *
240 * - Access will be granted when an address matches an entry in @list_allow
241 * - Otherwise, access will be denied when an address matches an entry in @list_deny
242 * - Otherwise, access will be granted
243 */
244
9cc54544
LP		 245 if (crt->ipv4_deny_map_fd >= 0) {
246 r = add_lookup_instructions(p, crt->ipv4_deny_map_fd, ETH_P_IP, is_ingress, ACCESS_DENIED);
1988a9d1
DM		 247 if (r < 0)
248 return r;
249 }
250
9cc54544
LP		 251 if (crt->ipv6_deny_map_fd >= 0) {
252 r = add_lookup_instructions(p, crt->ipv6_deny_map_fd, ETH_P_IPV6, is_ingress, ACCESS_DENIED);
1988a9d1
DM		 253 if (r < 0)
254 return r;
255 }
256
9cc54544
LP		 257 if (crt->ipv4_allow_map_fd >= 0) {
258 r = add_lookup_instructions(p, crt->ipv4_allow_map_fd, ETH_P_IP, is_ingress, ACCESS_ALLOWED);
1988a9d1
DM		 259 if (r < 0)
260 return r;
261 }
262
9cc54544
LP		 263 if (crt->ipv6_allow_map_fd >= 0) {
264 r = add_lookup_instructions(p, crt->ipv6_allow_map_fd, ETH_P_IPV6, is_ingress, ACCESS_ALLOWED);
1988a9d1
DM		 265 if (r < 0)
266 return r;
267 }
4c1567f2
AZ		 268
269 if (ip_allow_any) {
270 r = add_instructions_for_ip_any(p, ACCESS_ALLOWED);
271 if (r < 0)
272 return r;
273 }
274
275 if (ip_deny_any) {
276 r = add_instructions_for_ip_any(p, ACCESS_DENIED);
277 if (r < 0)
278 return r;
279 }
1988a9d1
DM		 280 }
281
282 r = bpf_program_add_instructions(p, post_insn, ELEMENTSOF(post_insn));
283 if (r < 0)
284 return r;
285
286 if (accounting_map_fd >= 0) {
287 struct bpf_insn insn[] = {
288 /*
289 * If R0 == 0, the packet will be denied; skip the accounting instructions in this case.
290 * The jump label will be fixed up later.
291 */
292 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 0),
293
294 /* Count packets */
295 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_PACKETS), /* r0 = 0 */
296 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
297 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
298 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
299 BPF_LD_MAP_FD(BPF_REG_1, accounting_map_fd), /* load map fd to r1 */
300 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
301 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
302 BPF_MOV64_IMM(BPF_REG_1, 1), /* r1 = 1 */
303 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
304
305 /* Count bytes */
306 BPF_MOV64_IMM(BPF_REG_0, MAP_KEY_BYTES), /* r0 = 1 */
307 BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), /* *(u32 *)(fp - 4) = r0 */
308 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
309 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), /* r2 = fp - 4 */
310 BPF_LD_MAP_FD(BPF_REG_1, accounting_map_fd),
311 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
312 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
313 BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct __sk_buff, len)), /* r1 = skb->len */
314 BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_0, BPF_REG_1, 0, 0), /* xadd r0 += r1 */
315
316 /* Allow the packet to pass */
317 BPF_MOV64_IMM(BPF_REG_0, 1),
318 };
319
320 /* Jump label fixup */
321 insn[0].off = ELEMENTSOF(insn) - 1;
322
323 r = bpf_program_add_instructions(p, insn, ELEMENTSOF(insn));
324 if (r < 0)
325 return r;
326 }
327
328 do {
329 /*
330 * Exit from the eBPF program, R0 contains the verdict.
331 * 0 means the packet is denied, 1 means the packet may pass.
332 */
2899aac4 333 const struct bpf_insn insn[] = {
1988a9d1
DM		 334 BPF_EXIT_INSN()
335 };
336
337 r = bpf_program_add_instructions(p, insn, ELEMENTSOF(insn));
338 if (r < 0)
339 return r;
340 } while (false);
341
1cc6c93a 342 *ret = TAKE_PTR(p);
1988a9d1
DM		 343
344 return 0;
345}
346
84ebe6f0
YW		 347static int bpf_firewall_count_access_items(Set *prefixes, size_t *n_ipv4, size_t *n_ipv6) {
348 struct in_addr_prefix *a;
1988a9d1
DM		 349
350 assert(n_ipv4);
351 assert(n_ipv6);
352
84ebe6f0 353 SET_FOREACH(a, prefixes)
1988a9d1
DM		 354 switch (a->family) {
355
356 case AF_INET:
357 (*n_ipv4)++;
358 break;
359
360 case AF_INET6:
361 (*n_ipv6)++;
362 break;
363
364 default:
365 return -EAFNOSUPPORT;
366 }
1988a9d1
DM		 367
368 return 0;
369}
370
371static int bpf_firewall_add_access_items(
84ebe6f0 372 Set *prefixes,
1988a9d1
DM		 373 int ipv4_map_fd,
374 int ipv6_map_fd,
375 int verdict) {
376
377 struct bpf_lpm_trie_key *key_ipv4, *key_ipv6;
84ebe6f0 378 struct in_addr_prefix *a;
1988a9d1 379 uint64_t value = verdict;
1988a9d1
DM		 380 int r;
381
382 key_ipv4 = alloca0(offsetof(struct bpf_lpm_trie_key, data) + sizeof(uint32_t));
383 key_ipv6 = alloca0(offsetof(struct bpf_lpm_trie_key, data) + sizeof(uint32_t) * 4);
384
84ebe6f0 385 SET_FOREACH(a, prefixes)
1988a9d1
DM		 386 switch (a->family) {
387
388 case AF_INET:
389 key_ipv4->prefixlen = a->prefixlen;
390 memcpy(key_ipv4->data, &a->address, sizeof(uint32_t));
391
392 r = bpf_map_update_element(ipv4_map_fd, key_ipv4, &value);
393 if (r < 0)
394 return r;
395
396 break;
397
398 case AF_INET6:
399 key_ipv6->prefixlen = a->prefixlen;
400 memcpy(key_ipv6->data, &a->address, 4 * sizeof(uint32_t));
401
402 r = bpf_map_update_element(ipv6_map_fd, key_ipv6, &value);
403 if (r < 0)
404 return r;
405
406 break;
407
408 default:
409 return -EAFNOSUPPORT;
410 }
1988a9d1
DM		 411
412 return 0;
413}
414
415static int bpf_firewall_prepare_access_maps(
416 Unit *u,
417 int verdict,
418 int *ret_ipv4_map_fd,
4c1567f2
AZ		 419 int *ret_ipv6_map_fd,
420 bool *ret_has_any) {
1988a9d1 421
254d1313 422 _cleanup_close_ int ipv4_map_fd = -EBADF, ipv6_map_fd = -EBADF;
1988a9d1
DM		 423 size_t n_ipv4 = 0, n_ipv6 = 0;
424 Unit *p;
425 int r;
426
427 assert(ret_ipv4_map_fd);
428 assert(ret_ipv6_map_fd);
4c1567f2 429 assert(ret_has_any);
1988a9d1 430
12f64221 431 for (p = u; p; p = UNIT_GET_SLICE(p)) {
1988a9d1 432 CGroupContext *cc;
84ebe6f0
YW		 433 Set *prefixes;
434 bool *reduced;
1988a9d1
DM		 435
436 cc = unit_get_cgroup_context(p);
437 if (!cc)
438 continue;
439
84ebe6f0
YW		 440 prefixes = verdict == ACCESS_ALLOWED ? cc->ip_address_allow : cc->ip_address_deny;
441 reduced = verdict == ACCESS_ALLOWED ? &cc->ip_address_allow_reduced : &cc->ip_address_deny_reduced;
442
443 if (!*reduced) {
444 r = in_addr_prefixes_reduce(prefixes);
445 if (r < 0)
446 return r;
447
448 *reduced = true;
449 }
4c1567f2 450
84ebe6f0 451 bpf_firewall_count_access_items(prefixes, &n_ipv4, &n_ipv6);
4c1567f2
AZ		 452
453 /* Skip making the LPM trie map in cases where we are using "any" in order to hack around
454 * needing CAP_SYS_ADMIN for allocating LPM trie map. */
84ebe6f0 455 if (in_addr_prefixes_is_any(prefixes)) {
4c1567f2
AZ		 456 *ret_has_any = true;
457 return 0;
458 }
1988a9d1
DM		 459 }
460
461 if (n_ipv4 > 0) {
25d9c6cd 462 char *name = strjoina("4_", u->id);
1988a9d1 463 ipv4_map_fd = bpf_map_new(
25d9c6cd 464 name,
1988a9d1
DM		 465 BPF_MAP_TYPE_LPM_TRIE,
466 offsetof(struct bpf_lpm_trie_key, data) + sizeof(uint32_t),
467 sizeof(uint64_t),
468 n_ipv4,
469 BPF_F_NO_PREALLOC);
470 if (ipv4_map_fd < 0)
471 return ipv4_map_fd;
472 }
473
474 if (n_ipv6 > 0) {
25d9c6cd 475 char *name = strjoina("6_", u->id);
1988a9d1 476 ipv6_map_fd = bpf_map_new(
25d9c6cd 477 name,
1988a9d1
DM		 478 BPF_MAP_TYPE_LPM_TRIE,
479 offsetof(struct bpf_lpm_trie_key, data) + sizeof(uint32_t)*4,
480 sizeof(uint64_t),
481 n_ipv6,
482 BPF_F_NO_PREALLOC);
483 if (ipv6_map_fd < 0)
484 return ipv6_map_fd;
485 }
486
12f64221 487 for (p = u; p; p = UNIT_GET_SLICE(p)) {
1988a9d1
DM		 488 CGroupContext *cc;
489
490 cc = unit_get_cgroup_context(p);
491 if (!cc)
492 continue;
493
494 r = bpf_firewall_add_access_items(verdict == ACCESS_ALLOWED ? cc->ip_address_allow : cc->ip_address_deny,
495 ipv4_map_fd, ipv6_map_fd, verdict);
496 if (r < 0)
497 return r;
498 }
499
1e59b545
LP		 500 *ret_ipv4_map_fd = TAKE_FD(ipv4_map_fd);
501 *ret_ipv6_map_fd = TAKE_FD(ipv6_map_fd);
4c1567f2 502 *ret_has_any = false;
1988a9d1
DM		 503 return 0;
504}
505
9cc54544 506static int bpf_firewall_prepare_accounting_maps(Unit *u, bool enabled, CGroupRuntime *crt) {
1988a9d1
DM		 507 int r;
508
51283461 509 assert(u);
9cc54544 510 assert(crt);
1988a9d1
DM		 511
512 if (enabled) {
9cc54544 513 if (crt->ip_accounting_ingress_map_fd < 0) {
25d9c6cd
DM		 514 char *name = strjoina("I_", u->id);
515 r = bpf_map_new(name, BPF_MAP_TYPE_ARRAY, sizeof(int), sizeof(uint64_t), 2, 0);
1988a9d1
DM		 516 if (r < 0)
517 return r;
518
9cc54544 519 crt->ip_accounting_ingress_map_fd = r;
1988a9d1
DM		 520 }
521
9cc54544 522 if (crt->ip_accounting_egress_map_fd < 0) {
25d9c6cd
DM		 523 char *name = strjoina("E_", u->id);
524 r = bpf_map_new(name, BPF_MAP_TYPE_ARRAY, sizeof(int), sizeof(uint64_t), 2, 0);
1988a9d1
DM		 525 if (r < 0)
526 return r;
527
9cc54544 528 crt->ip_accounting_egress_map_fd = r;
1988a9d1 529 }
51283461 530
1988a9d1 531 } else {
9cc54544
LP		 532 crt->ip_accounting_ingress_map_fd = safe_close(crt->ip_accounting_ingress_map_fd);
533 crt->ip_accounting_egress_map_fd = safe_close(crt->ip_accounting_egress_map_fd);
51283461 534
9cc54544 535 zero(crt->ip_accounting_extra);
1988a9d1
DM		 536 }
537
538 return 0;
539}
540
541int bpf_firewall_compile(Unit *u) {
e0c694c7
JK		 542 const char *ingress_name = NULL, *egress_name = NULL;
543 bool ip_allow_any = false, ip_deny_any = false;
1988a9d1 544 CGroupContext *cc;
9cc54544 545 CGroupRuntime *crt;
acf7f253 546 int r, supported;
1988a9d1
DM		 547
548 assert(u);
549
51283461
LP		 550 cc = unit_get_cgroup_context(u);
551 if (!cc)
552 return -EINVAL;
553
9cc54544
LP		 554 crt = unit_setup_cgroup_runtime(u);
555 if (!crt)
556 return -ENOMEM;
557
acf7f253
LP		 558 supported = bpf_firewall_supported();
559 if (supported < 0)
560 return supported;
84d2744b
ZJS		 561 if (supported == BPF_FIREWALL_UNSUPPORTED)
562 return log_unit_debug_errno(u, SYNTHETIC_ERRNO(EOPNOTSUPP),
b1acbc08 563 "bpf-firewall: BPF firewalling not supported, proceeding without.");
84d2744b 564 if (supported != BPF_FIREWALL_SUPPORTED_WITH_MULTI && u->type == UNIT_SLICE)
acf7f253
LP		 565 /* If BPF_F_ALLOW_MULTI is not supported we don't support any BPF magic on inner nodes (i.e. on slice
566 * units), since that would mean leaf nodes couldn't do any BPF anymore at all. Under the assumption
567 * that BPF is more interesting on leaf nodes we hence avoid it on inner nodes in that case. This is
568 * consistent with old systemd behaviour from before v238, where BPF wasn't supported in inner nodes at
569 * all, either. */
84d2744b 570 return log_unit_debug_errno(u, SYNTHETIC_ERRNO(EOPNOTSUPP),
b1acbc08 571 "bpf-firewall: BPF_F_ALLOW_MULTI is not supported, not doing BPF firewall on slice units.");
1988a9d1 572
e0c694c7
JK		 573 /* If BPF_F_ALLOW_MULTI flag is supported program name is also supported (both were added to v4.15
574 * kernel). */
575 if (supported == BPF_FIREWALL_SUPPORTED_WITH_MULTI) {
576 ingress_name = "sd_fw_ingress";
577 egress_name = "sd_fw_egress";
578 }
579
1988a9d1 580 /* Note that when we compile a new firewall we first flush out the access maps and the BPF programs themselves,
37b22b3b 581 * but we reuse the accounting maps. That way the firewall in effect always maps to the actual
1988a9d1
DM		 582 * configuration, but we don't flush out the accounting unnecessarily */
583
9cc54544
LP		 584 crt->ip_bpf_ingress = bpf_program_free(crt->ip_bpf_ingress);
585 crt->ip_bpf_egress = bpf_program_free(crt->ip_bpf_egress);
1988a9d1 586
9cc54544
LP		 587 crt->ipv4_allow_map_fd = safe_close(crt->ipv4_allow_map_fd);
588 crt->ipv4_deny_map_fd = safe_close(crt->ipv4_deny_map_fd);
1988a9d1 589
9cc54544
LP		 590 crt->ipv6_allow_map_fd = safe_close(crt->ipv6_allow_map_fd);
591 crt->ipv6_deny_map_fd = safe_close(crt->ipv6_deny_map_fd);
1988a9d1 592
acf7f253
LP		 593 if (u->type != UNIT_SLICE) {
594 /* In inner nodes we only do accounting, we do not actually bother with access control. However, leaf
595 * nodes will incorporate all IP access rules set on all their parent nodes. This has the benefit that
596 * they can optionally cancel out system-wide rules. Since inner nodes can't contain processes this
597 * means that all configure IP access rules *will* take effect on processes, even though we never
598 * compile them for inner nodes. */
1988a9d1 599
9cc54544 600 r = bpf_firewall_prepare_access_maps(u, ACCESS_ALLOWED, &crt->ipv4_allow_map_fd, &crt->ipv6_allow_map_fd, &ip_allow_any);
acf7f253 601 if (r < 0)
b1acbc08 602 return log_unit_error_errno(u, r, "bpf-firewall: Preparation of BPF allow maps failed: %m");
acf7f253 603
9cc54544 604 r = bpf_firewall_prepare_access_maps(u, ACCESS_DENIED, &crt->ipv4_deny_map_fd, &crt->ipv6_deny_map_fd, &ip_deny_any);
acf7f253 605 if (r < 0)
b1acbc08 606 return log_unit_error_errno(u, r, "bpf-firewall: Preparation of BPF deny maps failed: %m");
acf7f253 607 }
1988a9d1 608
9cc54544 609 r = bpf_firewall_prepare_accounting_maps(u, cc->ip_accounting, crt);
1988a9d1 610 if (r < 0)
b1acbc08 611 return log_unit_error_errno(u, r, "bpf-firewall: Preparation of BPF accounting maps failed: %m");
1988a9d1 612
9cc54544 613 r = bpf_firewall_compile_bpf(u, ingress_name, true, &crt->ip_bpf_ingress, ip_allow_any, ip_deny_any);
1988a9d1 614 if (r < 0)
b1acbc08 615 return log_unit_error_errno(u, r, "bpf-firewall: Compilation of ingress BPF program failed: %m");
1988a9d1 616
9cc54544 617 r = bpf_firewall_compile_bpf(u, egress_name, false, &crt->ip_bpf_egress, ip_allow_any, ip_deny_any);
1988a9d1 618 if (r < 0)
b1acbc08 619 return log_unit_error_errno(u, r, "bpf-firewall: Compilation of egress BPF program failed: %m");
1988a9d1
DM		 620
621 return 0;
622}
623
fab34748 624static int load_bpf_progs_from_fs_to_set(Unit *u, char **filter_paths, Set **set) {
fab34748
KL		 625 set_clear(*set);
626
627 STRV_FOREACH(bpf_fs_path, filter_paths) {
76dc1725 628 _cleanup_(bpf_program_freep) BPFProgram *prog = NULL;
fab34748
KL		 629 int r;
630
8fe9dbb9 631 r = bpf_program_new(BPF_PROG_TYPE_CGROUP_SKB, NULL, &prog);
fab34748 632 if (r < 0)
b1acbc08 633 return log_unit_error_errno(u, r, "bpf-firewall: Allocation of SKB BPF program failed: %m");
fab34748
KL		 634
635 r = bpf_program_load_from_bpf_fs(prog, *bpf_fs_path);
636 if (r < 0)
b1acbc08 637 return log_unit_error_errno(u, r, "bpf-firewall: Loading of ingress BPF program %s failed: %m", *bpf_fs_path);
fab34748 638
7a7cf83d 639 r = set_ensure_consume(set, &bpf_program_hash_ops, TAKE_PTR(prog));
fab34748 640 if (r < 0)
b1acbc08 641 return log_oom();
fab34748
KL		 642 }
643
644 return 0;
645}
646
647int bpf_firewall_load_custom(Unit *u) {
648 CGroupContext *cc;
9cc54544 649 CGroupRuntime *crt;
fab34748
KL		 650 int r, supported;
651
652 assert(u);
653
654 cc = unit_get_cgroup_context(u);
655 if (!cc)
656 return 0;
9cc54544
LP		 657 crt = unit_get_cgroup_runtime(u);
658 if (!crt)
659 return 0;
fab34748
KL		 660
661 if (!(cc->ip_filters_ingress || cc->ip_filters_egress))
662 return 0;
663
664 supported = bpf_firewall_supported();
665 if (supported < 0)
666 return supported;
667
668 if (supported != BPF_FIREWALL_SUPPORTED_WITH_MULTI)
b1acbc08
ZJS		 669 return log_unit_debug_errno(u, SYNTHETIC_ERRNO(EOPNOTSUPP),
670 "bpf-firewall: BPF_F_ALLOW_MULTI not supported, cannot attach custom BPF programs.");
fab34748 671
9cc54544 672 r = load_bpf_progs_from_fs_to_set(u, cc->ip_filters_ingress, &crt->ip_bpf_custom_ingress);
fab34748
KL		 673 if (r < 0)
674 return r;
9cc54544 675 r = load_bpf_progs_from_fs_to_set(u, cc->ip_filters_egress, &crt->ip_bpf_custom_egress);
fab34748
KL		 676 if (r < 0)
677 return r;
678
679 return 0;
680}
681
682static int attach_custom_bpf_progs(Unit *u, const char *path, int attach_type, Set **set, Set **set_installed) {
683 BPFProgram *prog;
fab34748
KL		 684 int r;
685
686 assert(u);
687
688 set_clear(*set_installed);
f25e10b1
YW		 689 r = set_ensure_allocated(set_installed, &bpf_program_hash_ops);
690 if (r < 0)
691 return log_oom();
fab34748 692
76dc1725 693 SET_FOREACH_MOVE(prog, *set_installed, *set) {
fab34748
KL		 694 r = bpf_program_cgroup_attach(prog, attach_type, path, BPF_F_ALLOW_MULTI);
695 if (r < 0)
b1acbc08 696 return log_unit_error_errno(u, r, "bpf-firewall: Attaching custom egress BPF program to cgroup %s failed: %m", path);
fab34748 697 }
fab34748
KL		 698 return 0;
699}
700
1988a9d1 701int bpf_firewall_install(Unit *u) {
76dc1725 702 _cleanup_(bpf_program_freep) BPFProgram *ip_bpf_ingress_uninstall = NULL, *ip_bpf_egress_uninstall = NULL;
1988a9d1 703 _cleanup_free_ char *path = NULL;
9f2e6892 704 CGroupContext *cc;
9cc54544 705 CGroupRuntime *crt;
acf7f253 706 int r, supported;
aa2b6f1d 707 uint32_t flags;
1988a9d1
DM		 708
709 assert(u);
710
9f2e6892
LP		 711 cc = unit_get_cgroup_context(u);
712 if (!cc)
713 return -EINVAL;
9cc54544
LP		 714 crt = unit_get_cgroup_runtime(u);
715 if (!crt)
716 return -EINVAL;
717 if (!crt->cgroup_path)
aa2b6f1d 718 return -EINVAL;
9cc54544 719 if (!crt->cgroup_realized)
aa2b6f1d 720 return -EINVAL;
9f2e6892 721
acf7f253
LP		 722 supported = bpf_firewall_supported();
723 if (supported < 0)
724 return supported;
d85ff944 725 if (supported == BPF_FIREWALL_UNSUPPORTED)
b1acbc08
ZJS		 726 return log_unit_debug_errno(u, SYNTHETIC_ERRNO(EOPNOTSUPP),
727 "bpf-firewall: BPF firewalling not supported, proceeding without.");
d85ff944 728 if (supported != BPF_FIREWALL_SUPPORTED_WITH_MULTI && u->type == UNIT_SLICE)
b1acbc08
ZJS		 729 return log_unit_debug_errno(u, SYNTHETIC_ERRNO(EOPNOTSUPP),
730 "bpf-firewall: BPF_F_ALLOW_MULTI not supported, not doing BPF firewall on slice units.");
fab34748 731 if (supported != BPF_FIREWALL_SUPPORTED_WITH_MULTI &&
9cc54544 732 (!set_isempty(crt->ip_bpf_custom_ingress) || !set_isempty(crt->ip_bpf_custom_egress)))
b1acbc08
ZJS		 733 return log_unit_debug_errno(u, SYNTHETIC_ERRNO(EOPNOTSUPP),
734 "bpf-firewall: BPF_F_ALLOW_MULTI not supported, cannot attach custom BPF programs.");
1988a9d1 735
9cc54544 736 r = cg_get_path(SYSTEMD_CGROUP_CONTROLLER, crt->cgroup_path, NULL, &path);
1988a9d1 737 if (r < 0)
b1acbc08 738 return log_unit_error_errno(u, r, "bpf-firewall: Failed to determine cgroup path: %m");
1988a9d1 739
a442ccb4 740 flags = supported == BPF_FIREWALL_SUPPORTED_WITH_MULTI ? BPF_F_ALLOW_MULTI : 0;
acf7f253 741
dbef3d16
LP		 742 if (FLAGS_SET(flags, BPF_F_ALLOW_MULTI)) {
743 /* If we have BPF_F_ALLOW_MULTI, then let's clear the fields, but destroy the programs only
744 * after attaching the new programs, so that there's no time window where neither program is
745 * attached. (There will be a program where both are attached, but that's OK, since this is a
746 * security feature where we rather want to lock down too much than too little */
9cc54544
LP		 747 ip_bpf_egress_uninstall = TAKE_PTR(crt->ip_bpf_egress_installed);
748 ip_bpf_ingress_uninstall = TAKE_PTR(crt->ip_bpf_ingress_installed);
dbef3d16
LP		 749 } else {
750 /* If we don't have BPF_F_ALLOW_MULTI then unref the old BPF programs (which will implicitly
751 * detach them) right before attaching the new program, to minimize the time window when we
752 * don't account for IP traffic. */
9cc54544
LP		 753 crt->ip_bpf_egress_installed = bpf_program_free(crt->ip_bpf_egress_installed);
754 crt->ip_bpf_ingress_installed = bpf_program_free(crt->ip_bpf_ingress_installed);
dbef3d16 755 }
1988a9d1 756
9cc54544
LP		 757 if (crt->ip_bpf_egress) {
758 r = bpf_program_cgroup_attach(crt->ip_bpf_egress, BPF_CGROUP_INET_EGRESS, path, flags);
1988a9d1 759 if (r < 0)
b1acbc08
ZJS		 760 return log_unit_error_errno(u, r,
761 "bpf-firewall: Attaching egress BPF program to cgroup %s failed: %m", path);
aa2b6f1d
LP		 762
763 /* Remember that this BPF program is installed now. */
9cc54544 764 crt->ip_bpf_egress_installed = TAKE_PTR(crt->ip_bpf_egress);
1988a9d1
DM		 765 }
766
9cc54544
LP		 767 if (crt->ip_bpf_ingress) {
768 r = bpf_program_cgroup_attach(crt->ip_bpf_ingress, BPF_CGROUP_INET_INGRESS, path, flags);
1988a9d1 769 if (r < 0)
b1acbc08
ZJS		 770 return log_unit_error_errno(u, r,
771 "bpf-firewall: Attaching ingress BPF program to cgroup %s failed: %m", path);
aa2b6f1d 772
9cc54544 773 crt->ip_bpf_ingress_installed = TAKE_PTR(crt->ip_bpf_ingress);
1988a9d1
DM		 774 }
775
dbef3d16 776 /* And now, definitely get rid of the old programs, and detach them */
76dc1725 777 ip_bpf_egress_uninstall = bpf_program_free(ip_bpf_egress_uninstall);
778 ip_bpf_ingress_uninstall = bpf_program_free(ip_bpf_ingress_uninstall);
dbef3d16 779
9cc54544 780 r = attach_custom_bpf_progs(u, path, BPF_CGROUP_INET_EGRESS, &crt->ip_bpf_custom_egress, &crt->ip_bpf_custom_egress_installed);
fab34748
KL		 781 if (r < 0)
782 return r;
783
9cc54544 784 r = attach_custom_bpf_progs(u, path, BPF_CGROUP_INET_INGRESS, &crt->ip_bpf_custom_ingress, &crt->ip_bpf_custom_ingress_installed);
fab34748
KL		 785 if (r < 0)
786 return r;
787
1988a9d1
DM		 788 return 0;
789}
790
791int bpf_firewall_read_accounting(int map_fd, uint64_t *ret_bytes, uint64_t *ret_packets) {
792 uint64_t key, packets;
793 int r;
794
795 if (map_fd < 0)
796 return -EBADF;
797
798 if (ret_packets) {
799 key = MAP_KEY_PACKETS;
800 r = bpf_map_lookup_element(map_fd, &key, &packets);
801 if (r < 0)
802 return r;
803 }
804
805 if (ret_bytes) {
806 key = MAP_KEY_BYTES;
807 r = bpf_map_lookup_element(map_fd, &key, ret_bytes);
808 if (r < 0)
809 return r;
810 }
811
812 if (ret_packets)
813 *ret_packets = packets;
814
815 return 0;
816}
817
818int bpf_firewall_reset_accounting(int map_fd) {
819 uint64_t key, value = 0;
820 int r;
821
822 if (map_fd < 0)
823 return -EBADF;
824
825 key = MAP_KEY_PACKETS;
826 r = bpf_map_update_element(map_fd, &key, &value);
827 if (r < 0)
828 return r;
829
830 key = MAP_KEY_BYTES;
831 return bpf_map_update_element(map_fd, &key, &value);
832}
833
f140ed02
ZJS		 834static int bpf_firewall_unsupported_reason = 0;
835
1988a9d1 836int bpf_firewall_supported(void) {
2899aac4 837 const struct bpf_insn trivial[] = {
93e93da5
LP		 838 BPF_MOV64_IMM(BPF_REG_0, 1),
839 BPF_EXIT_INSN()
840 };
841
76dc1725 842 _cleanup_(bpf_program_freep) BPFProgram *program = NULL;
1988a9d1 843 static int supported = -1;
e583759b 844 union bpf_attr attr;
4c1567f2 845 int r;
1988a9d1 846
4c1567f2 847 /* Checks whether BPF firewalling is supported. For this, we check the following things:
1988a9d1 848 *
4c1567f2
AZ		 849 * - whether the unified hierarchy is being used
850 * - the BPF implementation in the kernel supports BPF_PROG_TYPE_CGROUP_SKB programs, which we require
851 * - the BPF implementation in the kernel supports the BPF_PROG_DETACH call, which we require
1988a9d1 852 */
1988a9d1
DM		 853 if (supported >= 0)
854 return supported;
855
1988a9d1
DM		 856 r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER);
857 if (r < 0)
b1acbc08 858 return log_error_errno(r, "bpf-firewall: Can't determine whether the unified hierarchy is used: %m");
e583759b 859 if (r == 0) {
f140ed02
ZJS		 860 bpf_firewall_unsupported_reason =
861 log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN),
b1acbc08 862 "bpf-firewall: Not running with unified cgroup hierarchy, BPF firewalling is not supported.");
2ae7ee58 863 return supported = BPF_FIREWALL_UNSUPPORTED;
e583759b 864 }
1988a9d1 865
e0c694c7 866 /* prog_name is NULL since it is supported only starting from v4.15 kernel. */
8fe9dbb9 867 r = bpf_program_new(BPF_PROG_TYPE_CGROUP_SKB, NULL, &program);
4355f1c9 868 if (r < 0) {
f140ed02 869 bpf_firewall_unsupported_reason =
b1acbc08 870 log_debug_errno(r, "bpf-firewall: Can't allocate CGROUP SKB BPF program, BPF firewalling is not supported: %m");
2ae7ee58 871 return supported = BPF_FIREWALL_UNSUPPORTED;
93e93da5
LP		 872 }
873
874 r = bpf_program_add_instructions(program, trivial, ELEMENTSOF(trivial));
875 if (r < 0) {
f140ed02 876 bpf_firewall_unsupported_reason =
b1acbc08 877 log_debug_errno(r, "bpf-firewall: Can't add trivial instructions to CGROUP SKB BPF program, BPF firewalling is not supported: %m");
2ae7ee58 878 return supported = BPF_FIREWALL_UNSUPPORTED;
93e93da5
LP		 879 }
880
881 r = bpf_program_load_kernel(program, NULL, 0);
882 if (r < 0) {
f140ed02 883 bpf_firewall_unsupported_reason =
b1acbc08 884 log_debug_errno(r, "bpf-firewall: Can't load kernel CGROUP SKB BPF program, BPF firewalling is not supported: %m");
2ae7ee58 885 return supported = BPF_FIREWALL_UNSUPPORTED;
93e93da5
LP		 886 }
887
e583759b
LP		 888 /* Unfortunately the kernel allows us to create BPF_PROG_TYPE_CGROUP_SKB programs even when CONFIG_CGROUP_BPF
889 * is turned off at kernel compilation time. This sucks of course: why does it allow us to create a cgroup BPF
890 * program if we can't do a thing with it later?
891 *
047de7e1 892 * We detect this case by issuing the BPF_PROG_DETACH bpf() call with invalid file descriptors: if
e583759b
LP		 893 * CONFIG_CGROUP_BPF is turned off, then the call will fail early with EINVAL. If it is turned on the
894 * parameters are validated however, and that'll fail with EBADF then. */
895
9ca600e2
LB		 896 // FIXME: Clang doesn't 0-pad with structured initialization, causing
897 // the kernel to reject the bpf_attr as invalid. See:
898 // https://github.com/torvalds/linux/blob/v5.9/kernel/bpf/syscall.c#L65
899 // Ideally it should behave like GCC, so that we can remove these workarounds.
900 zero(attr);
901 attr.attach_type = BPF_CGROUP_INET_EGRESS;
254d1313
ZJS		 902 attr.target_fd = -EBADF;
903 attr.attach_bpf_fd = -EBADF;
e583759b 904
047de7e1 905 if (bpf(BPF_PROG_DETACH, &attr, sizeof(attr)) < 0) {
2ae7ee58 906 if (errno != EBADF) {
f140ed02 907 bpf_firewall_unsupported_reason =
b1acbc08 908 log_debug_errno(errno, "bpf-firewall: Didn't get EBADF from BPF_PROG_DETACH, BPF firewalling is not supported: %m");
2ae7ee58
LP		 909 return supported = BPF_FIREWALL_UNSUPPORTED;
910 }
911
912 /* YAY! */
913 } else {
8751bb6f
YW		 914 bpf_firewall_unsupported_reason =
915 log_debug_errno(SYNTHETIC_ERRNO(EBADE),
b1acbc08 916 "bpf-firewall: Wut? Kernel accepted our invalid BPF_PROG_DETACH call? "
8751bb6f 917 "Something is weird, assuming BPF firewalling is broken and hence not supported.");
2ae7ee58
LP		 918 return supported = BPF_FIREWALL_UNSUPPORTED;
919 }
e583759b 920
2ae7ee58 921 /* So now we know that the BPF program is generally available, let's see if BPF_F_ALLOW_MULTI is also supported
047de7e1
AF		 922 * (which was added in kernel 4.15). We use a similar logic as before, but this time we use the BPF_PROG_ATTACH
923 * bpf() call and the BPF_F_ALLOW_MULTI flags value. Since the flags are checked early in the system call we'll
e0c694c7
JK		 924 * get EINVAL if it's not supported, and EBADF as before if it is available.
925 * Use probe result as the indicator that program name is also supported since they both were
926 * added in kernel 4.15. */
e583759b 927
9ca600e2
LB		 928 zero(attr);
929 attr.attach_type = BPF_CGROUP_INET_EGRESS;
254d1313
ZJS		 930 attr.target_fd = -EBADF;
931 attr.attach_bpf_fd = -EBADF;
9ca600e2 932 attr.attach_flags = BPF_F_ALLOW_MULTI;
2ae7ee58 933
b1c05b98 934 if (bpf(BPF_PROG_ATTACH, &attr, sizeof(attr)) < 0) {
2ae7ee58 935 if (errno == EBADF) {
b1acbc08 936 log_debug_errno(errno, "bpf-firewall: Got EBADF when using BPF_F_ALLOW_MULTI, which indicates it is supported. Yay!");
2ae7ee58
LP		 937 return supported = BPF_FIREWALL_SUPPORTED_WITH_MULTI;
938 }
939
940 if (errno == EINVAL)
b1acbc08 941 log_debug_errno(errno, "bpf-firewall: Got EINVAL error when using BPF_F_ALLOW_MULTI, which indicates it's not supported.");
2ae7ee58 942 else
b1acbc08 943 log_debug_errno(errno, "bpf-firewall: Got unexpected error when using BPF_F_ALLOW_MULTI, assuming it's not supported: %m");
2ae7ee58
LP		 944
945 return supported = BPF_FIREWALL_SUPPORTED;
946 } else {
8751bb6f
YW		 947 bpf_firewall_unsupported_reason =
948 log_debug_errno(SYNTHETIC_ERRNO(EBADE),
b1acbc08 949 "bpf-firewall: Wut? Kernel accepted our invalid BPF_PROG_ATTACH+BPF_F_ALLOW_MULTI call? "
8751bb6f 950 "Something is weird, assuming BPF firewalling is broken and hence not supported.");
2ae7ee58
LP		 951 return supported = BPF_FIREWALL_UNSUPPORTED;
952 }
1988a9d1 953}
84d2744b
ZJS		 954
955void emit_bpf_firewall_warning(Unit *u) {
956 static bool warned = false;
957
a42232a1
LB		 958 assert(u);
959 assert(u->manager);
960
d0113312
LP		 961 if (warned || MANAGER_IS_TEST_RUN(u->manager))
962 return;
963
964 bool quiet = ERRNO_IS_PRIVILEGE(bpf_firewall_unsupported_reason) && detect_container() > 0;
965
966 log_unit_full_errno(u, quiet ? LOG_DEBUG : LOG_WARNING, bpf_firewall_unsupported_reason,
967 "unit configures an IP firewall, but %s.\n"
968 "(This warning is only shown for the first unit using IP firewalling.)",
969 getuid() != 0 ? "not running as root" :
970 "the local system does not support BPF/cgroup firewalling");
971 warned = true;
84d2744b 972}
0fd9c28c
LP		 973
974void bpf_firewall_close(Unit *u) {
975 assert(u);
976
9cc54544
LP		 977 CGroupRuntime *crt = unit_get_cgroup_runtime(u);
978 if (!crt)
979 return;
980
981 crt->ip_accounting_ingress_map_fd = safe_close(crt->ip_accounting_ingress_map_fd);
982 crt->ip_accounting_egress_map_fd = safe_close(crt->ip_accounting_egress_map_fd);
0fd9c28c 983
9cc54544
LP		 984 crt->ipv4_allow_map_fd = safe_close(crt->ipv4_allow_map_fd);
985 crt->ipv6_allow_map_fd = safe_close(crt->ipv6_allow_map_fd);
986 crt->ipv4_deny_map_fd = safe_close(crt->ipv4_deny_map_fd);
987 crt->ipv6_deny_map_fd = safe_close(crt->ipv6_deny_map_fd);
0fd9c28c 988
9cc54544
LP		 989 crt->ip_bpf_ingress = bpf_program_free(crt->ip_bpf_ingress);
990 crt->ip_bpf_ingress_installed = bpf_program_free(crt->ip_bpf_ingress_installed);
991 crt->ip_bpf_egress = bpf_program_free(crt->ip_bpf_egress);
992 crt->ip_bpf_egress_installed = bpf_program_free(crt->ip_bpf_egress_installed);
0fd9c28c 993
9cc54544
LP		 994 crt->ip_bpf_custom_ingress = set_free(crt->ip_bpf_custom_ingress);
995 crt->ip_bpf_custom_egress = set_free(crt->ip_bpf_custom_egress);
996 crt->ip_bpf_custom_ingress_installed = set_free(crt->ip_bpf_custom_ingress_installed);
997 crt->ip_bpf_custom_egress_installed = set_free(crt->ip_bpf_custom_egress_installed);
0fd9c28c 998}
Unnamed repository; edit this file 'description' to name the repository.