summaryrefslogtreecommitdiff
path: root/net/netfilter
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2023-04-21 19:02:57 +0200
committerAlexei Starovoitov <ast@kernel.org>2023-04-21 11:34:14 -0700
commit0bdc6da88f5bac0f3f272cb6f545c2cc70e8c66a (patch)
treef6ac7401b8177e3287940b58f46f005d9203bed9 /net/netfilter
parent506a74db7e019a277e987fa65654bdd953859d5b (diff)
downloadlwn-0bdc6da88f5bac0f3f272cb6f545c2cc70e8c66a.tar.gz
lwn-0bdc6da88f5bac0f3f272cb6f545c2cc70e8c66a.zip
netfilter: disallow bpf hook attachment at same priority
This is just to avoid ordering issues between multiple bpf programs, this could be removed later in case it turns out to be too cautious. bpf prog could still be shared with non-bpf hook, otherwise we'd have to make conntrack hook registration fail just because a bpf program has same priority. Signed-off-by: Florian Westphal <fw@strlen.de> Link: https://lore.kernel.org/r/20230421170300.24115-5-fw@strlen.de Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'net/netfilter')
-rw-r--r--net/netfilter/core.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 358220b58521..f0783e42108b 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -119,6 +119,18 @@ nf_hook_entries_grow(const struct nf_hook_entries *old,
for (i = 0; i < old_entries; i++) {
if (orig_ops[i] != &dummy_ops)
alloc_entries++;
+
+ /* Restrict BPF hook type to force a unique priority, not
+ * shared at attach time.
+ *
+ * This is mainly to avoid ordering issues between two
+ * different bpf programs, this doesn't prevent a normal
+ * hook at same priority as a bpf one (we don't want to
+ * prevent defrag, conntrack, iptables etc from attaching).
+ */
+ if (reg->priority == orig_ops[i]->priority &&
+ reg->hook_ops_type == NF_HOOK_OP_BPF)
+ return ERR_PTR(-EBUSY);
}
}