Skip to content

Commit 0c057dc

Browse files
julianwiedmannjulianwiedmann
committed
bpf: endpoint: constify the endpoint map access
Protect against accidental writes to the map entry. Signed-off-by: Julian Wiedmann <jwi@isovalent.com>
1 parent e99b7c3 commit 0c057dc

9 files changed

Lines changed: 19 additions & 19 deletions

File tree

‎bpf/bpf_host.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ handle_ipv6_cont(struct __ctx_buff *ctx, __u32 secctx, const bool from_host,
259259
union v6addr *dst;
260260
int l3_off = ETH_HLEN;
261261
struct remote_endpoint_info *info = NULL;
262-
struct endpoint_info *ep;
262+
const struct endpoint_info *ep;
263263
int ret __maybe_unused;
264264
__u32 magic = MARK_MAGIC_IDENTITY;
265265
bool from_proxy = false;
@@ -684,7 +684,7 @@ handle_ipv4_cont(struct __ctx_buff *ctx, __u32 secctx, const bool from_host,
684684
void *data, *data_end;
685685
struct iphdr *ip4;
686686
struct remote_endpoint_info *info;
687-
struct endpoint_info *ep;
687+
const struct endpoint_info *ep;
688688
int ret __maybe_unused;
689689
__u32 magic = MARK_MAGIC_IDENTITY;
690690
bool from_proxy = false;

‎bpf/bpf_lxc.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -686,7 +686,7 @@ static __always_inline int handle_ipv6_from_lxc(struct __ctx_buff *ctx, __u32 *d
686686
#endif /* ENABLE_HOST_FIREWALL && !ENABLE_ROUTING */
687687

688688
if (is_defined(ENABLE_ROUTING) || hairpin_flow || is_defined(ENABLE_HOST_ROUTING)) {
689-
struct endpoint_info *ep;
689+
const struct endpoint_info *ep;
690690
union v6addr daddr;
691691

692692
ipv6_addr_copy(&daddr, (union v6addr *)&ip6->daddr);
@@ -1173,7 +1173,7 @@ static __always_inline int handle_ipv4_from_lxc(struct __ctx_buff *ctx, __u32 *d
11731173
if (is_defined(ENABLE_ROUTING) || hairpin_flow ||
11741174
is_defined(ENABLE_HOST_ROUTING)) {
11751175
__be32 daddr = ip4->daddr;
1176-
struct endpoint_info *ep;
1176+
const struct endpoint_info *ep;
11771177

11781178
/* Loopback replies are addressed to config service_loopback_ipv4,
11791179
* so an endpoint lookup with ip4->daddr won't work.

‎bpf/bpf_overlay.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ static __always_inline int handle_ipv6(struct __ctx_buff *ctx,
5656
int ret, l3_off = ETH_HLEN;
5757
void *data_end, *data;
5858
struct ipv6hdr *ip6;
59-
struct endpoint_info *ep;
59+
const struct endpoint_info *ep;
6060
bool __maybe_unused is_dsr = false;
6161
fraginfo_t fraginfo __maybe_unused;
6262

@@ -221,7 +221,7 @@ static __always_inline int handle_inter_cluster_revsnat(struct __ctx_buff *ctx,
221221
struct iphdr *ip4;
222222
__u32 cluster_id = 0;
223223
void *data_end, *data;
224-
struct endpoint_info *ep;
224+
const struct endpoint_info *ep;
225225
__u32 cluster_id_from_identity =
226226
extract_cluster_id_from_identity(src_sec_identity);
227227
const struct ipv4_nat_target target = {
@@ -289,7 +289,7 @@ static __always_inline int handle_ipv4(struct __ctx_buff *ctx,
289289
{
290290
void *data_end, *data;
291291
struct iphdr *ip4;
292-
struct endpoint_info *ep;
292+
const struct endpoint_info *ep;
293293
bool __maybe_unused is_dsr = false;
294294
fraginfo_t fraginfo __maybe_unused;
295295
int ret;

‎bpf/bpf_wireguard.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ handle_ipv6(struct __ctx_buff *ctx, __u32 identity, __s8 *ext_err __maybe_unused
6565
{
6666
void *data_end, *data;
6767
struct ipv6hdr *ip6;
68-
struct endpoint_info *ep;
68+
const struct endpoint_info *ep;
6969
fraginfo_t __maybe_unused fraginfo;
7070

7171
/* See the equivalent v4 path for comments */
@@ -163,7 +163,7 @@ handle_ipv4(struct __ctx_buff *ctx, __u32 identity, __s8 *ext_err __maybe_unused
163163
{
164164
void *data_end, *data;
165165
struct iphdr *ip4;
166-
struct endpoint_info *ep;
166+
const struct endpoint_info *ep;
167167
fraginfo_t __maybe_unused fraginfo;
168168

169169
if (!revalidate_data_pull(ctx, &data, &data_end, &ip4))

‎bpf/lib/egress_gateway.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -433,7 +433,7 @@ int egress_gw_handle_request(struct __ctx_buff *ctx, __be16 proto,
433433
struct trace_ctx *trace)
434434
{
435435
struct remote_endpoint_info fake_info = {0};
436-
struct endpoint_info *gateway_node_ep;
436+
const struct endpoint_info *gateway_node_ep;
437437
__be32 gateway_ip = 0;
438438
void *data, *data_end;
439439
struct iphdr *ip4;
@@ -442,7 +442,7 @@ int egress_gw_handle_request(struct __ctx_buff *ctx, __be16 proto,
442442
struct ipv6_ct_tuple __maybe_unused tuple6 = {};
443443
int l4_off;
444444
struct remote_endpoint_info *info;
445-
struct endpoint_info *src_ep;
445+
const struct endpoint_info *src_ep;
446446
bool is_reply;
447447
fraginfo_t fraginfo;
448448
int ret;

‎bpf/lib/eps.h‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ struct {
1717
__uint(map_flags, CONDITIONAL_PREALLOC);
1818
} cilium_lxc __section_maps_btf;
1919

20-
static __always_inline __maybe_unused struct endpoint_info *
20+
static __always_inline __maybe_unused const struct endpoint_info *
2121
__lookup_ip6_endpoint(const union v6addr *ip6)
2222
{
2323
struct endpoint_key key = {};
@@ -28,13 +28,13 @@ __lookup_ip6_endpoint(const union v6addr *ip6)
2828
return map_lookup_elem(&cilium_lxc, &key);
2929
}
3030

31-
static __always_inline __maybe_unused struct endpoint_info *
31+
static __always_inline __maybe_unused const struct endpoint_info *
3232
lookup_ip6_endpoint(const struct ipv6hdr *ip6)
3333
{
3434
return __lookup_ip6_endpoint((union v6addr *)&ip6->daddr);
3535
}
3636

37-
static __always_inline __maybe_unused struct endpoint_info *
37+
static __always_inline __maybe_unused const struct endpoint_info *
3838
__lookup_ip4_endpoint(__u32 ip)
3939
{
4040
struct endpoint_key key = {};
@@ -45,7 +45,7 @@ __lookup_ip4_endpoint(__u32 ip)
4545
return map_lookup_elem(&cilium_lxc, &key);
4646
}
4747

48-
static __always_inline __maybe_unused struct endpoint_info *
48+
static __always_inline __maybe_unused const struct endpoint_info *
4949
lookup_ip4_endpoint(const struct iphdr *ip4)
5050
{
5151
return __lookup_ip4_endpoint(ip4->daddr);

‎bpf/lib/icmp6.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -346,7 +346,7 @@ static __always_inline int icmp6_send_time_exceeded(struct __ctx_buff *ctx,
346346
static __always_inline int __icmp6_handle_ns(struct __ctx_buff *ctx, int nh_off)
347347
{
348348
union v6addr target, router = CONFIG(router_ipv6);
349-
struct endpoint_info *ep;
349+
const struct endpoint_info *ep;
350350
union macaddr router_mac = CONFIG(interface_mac);
351351

352352
if (ctx_load_bytes(ctx, nh_off + ICMP6_ND_TARGET_OFFSET, target.addr,

‎bpf/lib/nat.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -608,7 +608,7 @@ snat_v4_needs_masquerade(struct __ctx_buff *ctx __maybe_unused,
608608
int l4_off __maybe_unused,
609609
struct ipv4_nat_target *target __maybe_unused)
610610
{
611-
struct endpoint_info *local_ep __maybe_unused;
611+
const struct endpoint_info *local_ep __maybe_unused;
612612
struct remote_endpoint_info *remote_ep __maybe_unused;
613613
int ret;
614614

@@ -1669,7 +1669,7 @@ snat_v6_needs_masquerade(struct __ctx_buff *ctx __maybe_unused,
16691669
{
16701670
union v6addr masq_addr __maybe_unused = CONFIG(nat_ipv6_masquerade);
16711671
struct remote_endpoint_info *remote_ep __maybe_unused;
1672-
struct endpoint_info *local_ep __maybe_unused;
1672+
const struct endpoint_info *local_ep __maybe_unused;
16731673

16741674
/* See comments in snat_v4_needs_masquerade(). */
16751675
#if defined(ENABLE_MASQUERADE_IPV6) && defined(IS_BPF_HOST)

‎bpf/lib/nodeport_egress.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -340,7 +340,7 @@ static __always_inline int nodeport_snat_fwd_ipv4(struct __ctx_buff *ctx,
340340
l4_off = ETH_HLEN + ipv4_hdrlen(ip4);
341341

342342
if (is_defined(IS_BPF_HOST) && is_defined(ENABLE_MASQUERADE_IPV4)) {
343-
struct endpoint_info *ep;
343+
const struct endpoint_info *ep;
344344

345345
ep = __lookup_ip4_endpoint(ip4->saddr);
346346
if (ep && ep->parent_ifindex && ep->parent_ifindex != CONFIG(interface_ifindex)) {

0 commit comments

Comments
 (0)