Merge pull request #17655 from wat-ze-hex/bpf-build-rule

Introduce SocketBind{Allow|Deny}= properties powered by source compiled BPF

src/shared/bpf-link.c

@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: LGPL-2.1+ */
+
+#include "bpf-link.h"
+#include "serialize.h"
+
+bool can_link_bpf_program(struct bpf_program *prog) {
+        _cleanup_(bpf_link_freep) struct bpf_link *link = NULL;
+
+        assert(prog);
+
+        /* Pass invalid cgroup fd intentionally. */
+        link = bpf_program__attach_cgroup(prog, /*cgroup_fd=*/-1);
+
+        /* EBADF indicates that bpf_link is supported by kernel. */
+        return libbpf_get_error(link) == -EBADF;
+}
+
+int serialize_bpf_link(FILE *f, FDSet *fds, const char *key, struct bpf_link *link) {
+        int fd;
+
+        assert(key);
+
+        if (!link)
+                return -ENOENT;
+
+        if (libbpf_get_error(link) != 0)
+                return -EINVAL;
+
+        fd = bpf_link__fd(link);
+        return serialize_fd(f, fds, key, fd);
+}
+
+struct bpf_link *bpf_link_free(struct bpf_link *link) {
+        /* bpf_link__destroy handles link == NULL case */
+        (void) bpf_link__destroy(link);
+
+        return NULL;
+}

src/shared/bpf-link.h

@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: LGPL-2.1+ */
+
+#pragma once
+
+#include <bpf/libbpf.h>
+#include <stdio.h>
+
+#include "fdset.h"
+#include "macro.h"
+
+bool can_link_bpf_program(struct bpf_program *prog);
+
+int serialize_bpf_link(FILE *f, FDSet *fds, const char *key, struct bpf_link *link);
+
+struct bpf_link *bpf_link_free(struct bpf_link *p);
+DEFINE_TRIVIAL_CLEANUP_FUNC(struct bpf_link *, bpf_link_free);

src/shared/bus-unit-util.c

@@ -862,6 +862,57 @@ static int bus_append_cgroup_property(sd_bus_message *m, const char *field, cons
                 return 1;
         }
 
+        if (STR_IN_SET(field, "SocketBindAllow",
+                              "SocketBindDeny")) {
+                if (isempty(eq))
+                        r = sd_bus_message_append(m, "(sv)", field, "a(iqq)", 0);
+                else {
+                        const char *address_family, *user_port;
+                        _cleanup_free_ char *word = NULL;
+                        int family = AF_UNSPEC;
+
+                        r = extract_first_word(&eq, &word, ":", 0);
+                        if (r == -ENOMEM)
+                                return log_oom();
+                        if (r < 0)
+                                return log_error_errno(r, "Failed to parse %s: %m", field);
+
+                        address_family = eq ? word : NULL;
+                        if (address_family) {
+                                if (!STR_IN_SET(address_family, "IPv4", "IPv6"))
+                                        return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                                "Only IPv4 and IPv6 protocols are supported");
+
+                                if (streq(address_family, "IPv4"))
+                                        family = AF_INET;
+                                else
+                                        family = AF_INET6;
+                        }
+
+                        user_port = eq ? eq : word;
+                        if (streq(user_port, "any")) {
+                                r = sd_bus_message_append(m, "(sv)", field, "a(iqq)", 1, family, 0, 0);
+                                if (r < 0)
+                                        return bus_log_create_error(r);
+                        } else {
+                                uint16_t port_min, port_max;
+
+                                r = parse_ip_port_range(user_port, &port_min, &port_max);
+                                if (r == -ENOMEM)
+                                        return log_oom();
+                                if (r < 0)
+                                        return log_error_errno(r, "Invalid port or port range: %s", user_port);
+
+                                r = sd_bus_message_append(
+                                                m, "(sv)", field, "a(iqq)", 1, family, port_max - port_min + 1, port_min);
+                        }
+                }
+                if (r < 0)
+                        return bus_log_create_error(r);
+
+                return 1;
+        }
+
         return 0;
 }
 

src/shared/meson.build

@@ -319,6 +319,13 @@ if conf.get('HAVE_LIBIPTC') == 1
         shared_sources += files('firewall-util-iptables.c')
 endif
 
+if conf.get('HAVE_LIBBPF') == 1
+        shared_sources += files('''
+                bpf-link.c
+                bpf-link.h
+        '''.split())
+endif
+
 if conf.get('HAVE_KMOD') == 1
         shared_sources += files('module-util.c')
 endif
@@ -378,6 +385,7 @@ libshared_name = 'systemd-shared-@0@'.format(meson.project_version())
 libshared_deps = [threads,
                   libacl,
                   libblkid,
+                  libbpf,
                   libcap,
                   libcrypt,
                   libgcrypt,