feat(net): implement BPF filter (SO_ATTACH_FILTER) for AF_PACKET (#2031) (#2110)

* feat(net): implement BPF filter support for AF_PACKET (#2031)

Extract cBPF interpreter from seccomp.rs to bpf/classic.rs as shared
infrastructure. Generalize to accept &[u8] input for packet filtering.

Support: BPF_W/BPF_H/BPF_B load widths, BPF_ABS/BPF_IND addressing,
BPF_MSH (IP header length extraction), full ALU/JMP/RET/MISC ops.

Security: validate_cbpf checks program bounds (<=4096 insns), last
insn is RET, checked_add on jump targets, static div/mod k!=0 reject,
ST/STX k<16, LD/LDX mode whitelist. Runtime: OOB reads return a=0,
div/mod by zero returns a=0, fall-through returns 0 (drop).

AF_PACKET: SO_ATTACH_FILTER/SO_DETACH_FILTER/SO_LOCK_FILTER via
PSOL::SOCKET dispatch. Filter stored in RcuArcSlot (lock-free read),
AtomicBool fast-path skip when no filter attached. Filter runs on
frame[start..] (RAW: full frame, DGRAM: L3 payload).

Seccomp: refactored to use bpf::classic, seccomp-specific validation
layered on top of validate_cbpf. Big-endian serialization preserves
existing behavior.

Refs: #2031, #691
Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com>

* test: update af_packet_sockopt dunitest for SO_ATTACH_FILTER

The test AttachFilterIsNotSilentlyAccepted expected ENOPROTOOPT (option
unimplemented). Now that SO_ATTACH_FILTER is implemented (PR #2110),
update to expect success. Add DetachFilterReturnsEnoentWhenNoFilter test.

Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com>

* fix: correct TestSockFprog casing in dunitest (FProg→Fprog)

Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com>

* fix: pass dummy value to SO_DETACH_FILTER in dunitest

sys_setsockopt with optlen=0 may short-circuit before calling
set_option. Pass a dummy int to ensure the kernel handler runs.

Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com>

* fix(net): align AF_PACKET classic BPF with Linux

Harden the shared classic BPF validator and interpreter with exact opcode validation, definite scratch-memory initialization, fail-closed packet loads, and fallible user-controlled allocations. Keep seccomp on its Linux-compatible instruction subset without serializing seccomp_data for every filter.

Use a zero-copy packet view for AF_PACKET filtering, propagate real ingress metadata, implement the Linux ancillary and payload-offset semantics, and apply filter snaplen consistently to queue accounting and recv behavior.

Linearize filter attach, detach, and lock operations around one control lock and an optional RCU publication point. Preserve Linux optlen, errno, lock ordering, and ENOMEM behavior.

Extend AF_PACKET, seccomp, and RCU dunitests to cover validator boundaries, runtime failures, snaplen, ancillary offsets, socket option ABI behavior, and optional RCU slot lifetimes.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(net): preserve outgoing inline VLAN filters

Keep inline 802.1Q and 802.1ad headers visible to AF_PACKET SOCK_RAW filters for PACKET_OUTGOING frames, matching Linux dev_queue_xmit_nit semantics.

Continue normalizing received VLAN headers into metadata, while deriving protocol, network-relative loads, RAW/DGRAM offsets, ancillary values, and queued bytes from the same packet view.

Add a deterministic veth regression that filters outgoing traffic by packet type and the inline VLAN EtherType.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(net): align classic filter socket option ABI

Signed-off-by: longjin <longjin@dragonos.org>

* fix(net): retain zero-length packet datagrams

Signed-off-by: longjin <longjin@dragonos.org>

* fix(net): harden socket filter option handling

Signed-off-by: longjin <longjin@dragonos.org>

* fix(rcu): harden arc slot lifetime handling

Avoid entering an RCU read-side section for empty optional slots while reloading and pinning non-empty snapshots under RCU protection. Make raw slot swaps unsafe so callers must preserve removed references through a grace period, and update packet filters and signal handlers to document that obligation.

Add bounded cross-task RCU lifecycle and overlap coverage plus AF_PACKET replacement state regression tests.

Signed-off-by: longjin <longjin@dragonos.org>

---------

Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com>
Signed-off-by: longjin <longjin@dragonos.org>
Co-authored-by: longjin <longjin@dragonos.org>

Author: sparkzky

kernel/src/bpf/classic.rs

@@ -1,3 +1,4 @@
+pub mod classic;
 pub mod helper;
 pub mod map;
 pub mod prog;

kernel/src/bpf/mod.rs

@@ -90,9 +90,7 @@ impl phy::RxToken for E1000ERxToken {
         // 向注册的 packet socket 分发数据包
         if let Some(iface) = self.driver.iface() {
             let pkt_type = crate::net::socket::packet::classify_packet(packet, &iface);
-            if let Some(netns) = iface.net_namespace() {
-                netns.deliver_to_packet_sockets(iface.nic_id() as u32, packet, pkt_type);
-            }
+            crate::net::socket::packet::deliver_to_packet_sockets(&iface, packet, pkt_type);
         }
 
         let result = f(packet);
@@ -313,7 +311,7 @@ impl E1000EInterface {
             driver,
             common: IfaceCommon::new(
                 iface_id,
-                crate::driver::net::types::InterfaceType::EETHER,
+                crate::driver::net::types::InterfaceType::ETHER,
                 name,
                 mtu,
                 flags,

kernel/src/driver/net/e1000e/e1000e_driver.rs

@@ -301,9 +301,7 @@ impl RxToken for VethRxToken {
         // 向注册的 packet socket 分发数据包
         if let Some(iface) = self.driver.iface() {
             let pkt_type = crate::net::socket::packet::classify_packet(packet, &iface);
-            if let Some(netns) = iface.net_namespace() {
-                netns.deliver_to_packet_sockets(iface.nic_id() as u32, packet, pkt_type);
-            }
+            crate::net::socket::packet::deliver_to_packet_sockets(&iface, packet, pkt_type);
         }
 
         f(packet)
@@ -405,7 +403,7 @@ impl VethInterface {
             driver: driver.clone(),
             common: IfaceCommon::new(
                 iface_id,
-                super::types::InterfaceType::EETHER,
+                super::types::InterfaceType::ETHER,
                 driver.name(),
                 mtu,
                 flags,

kernel/src/driver/net/veth.rs

@@ -444,7 +444,7 @@ impl VirtioInterface {
             locked_kobj_state: LockedKObjectState::default(),
             iface_common: super::IfaceCommon::new(
                 iface_id,
-                crate::driver::net::types::InterfaceType::EETHER,
+                crate::driver::net::types::InterfaceType::ETHER,
                 iface_name,
                 mtu,
                 flags,
@@ -742,9 +742,7 @@ impl phy::RxToken for VirtioNetToken {
         // 向注册的 packet socket 分发数据包
         if let Some(iface) = self.driver.iface() {
             let pkt_type = crate::net::socket::packet::classify_packet(packet, &iface);
-            if let Some(netns) = iface.net_namespace() {
-                netns.deliver_to_packet_sockets(iface.nic_id() as u32, packet, pkt_type);
-            }
+            crate::net::socket::packet::deliver_to_packet_sockets(&iface, packet, pkt_type);
         }
 
         let result = f(packet);

kernel/src/driver/net/virtio_net.rs

@@ -6,7 +6,7 @@ use crate::driver::net::Iface;
 use crate::filesystem::epoll::EPollEventType;
 use crate::net::socket::endpoint::{Endpoint, LinkLayerEndpoint};
 
-use super::{PacketSocket, PacketType};
+use super::{PacketIngressMetadata, PacketSocket};
 
 /// Lock-free, coherent `(ifindex, protocol)` receive-filter snapshot.
 #[derive(Debug)]
@@ -91,7 +91,7 @@ impl PacketSocket {
         ll.protocol = protocol;
         if let Some(iface) = self.bound_iface.read().as_ref() {
             ll.addr[..6].copy_from_slice(iface.mac().as_bytes());
-            ll.hatype = 1;
+            ll.hatype = iface.type_() as u16;
             ll.halen = 6;
         }
         Ok(Endpoint::LinkLayer(ll))
@@ -108,7 +108,7 @@ impl PacketSocket {
     }
 
     /// Registry delivery entry: the ingress interface is authoritative metadata.
-    pub(crate) fn deliver(&self, ingress_ifindex: u32, frame: &[u8], pkt_type: PacketType) {
-        self.deliver_from_iface(ingress_ifindex, frame, pkt_type);
+    pub(crate) fn deliver(&self, ingress: PacketIngressMetadata, frame: &[u8]) {
+        self.deliver_from_iface(ingress, frame);
     }
 }

kernel/src/net/socket/packet/binding.rs

@@ -12,6 +12,7 @@ use alloc::vec::Vec;
 use core::sync::atomic::{AtomicBool, AtomicU32, AtomicU64, AtomicUsize, Ordering};
 use system_error::SystemError;
 
+use crate::bpf::classic::SockFilter;
 use crate::driver::net::Iface;
 use crate::filesystem::epoll::EPollEventType;
 use crate::filesystem::vfs::{fasync::FAsyncItems, vcore::generate_inode_id, InodeId};
@@ -22,6 +23,7 @@ use crate::net::socket::{Socket, PMSG, PSOCK, PSOL};
 use crate::process::cred::CAPFlags;
 use crate::process::namespace::net_namespace::NetNamespace;
 use crate::process::ProcessManager;
+use crate::rcu::RcuOptionArcSlot;
 
 #[allow(unused_imports)]
 pub use uapi::{
@@ -39,13 +41,35 @@ pub enum PacketSocketType {
     Dgram,
 }
 
+/// Metadata captured at the packet-tap boundary. Keeping this structure
+/// `Copy` lets the NAPI receive path pass device information to every packet
+/// socket without consulting the sleepable netdevice registry.
+#[derive(Debug, Clone, Copy)]
+pub(crate) struct PacketIngressMetadata {
+    pub ifindex: u32,
+    pub hatype: u16,
+    pub pkt_type: PacketType,
+}
+
+impl PacketIngressMetadata {
+    #[inline]
+    fn from_iface(iface: &Arc<dyn Iface>, pkt_type: PacketType) -> Self {
+        Self {
+            ifindex: iface.nic_id() as u32,
+            hatype: iface.type_() as u16,
+            pkt_type,
+        }
+    }
+}
+
 #[derive(Debug, Clone, Default)]
 pub struct PacketMetadata {
     pub src_mac: [u8; 6],
     #[allow(dead_code)]
     pub dst_mac: [u8; 6],
     pub protocol: u16,
     pub ifindex: u32,
+    pub hatype: u16,
     pub pkt_type: PacketType,
     pub wire_len: usize,
     #[allow(dead_code)]
@@ -89,6 +113,10 @@ pub struct PacketSocket {
     open_files: AtomicUsize,
     pub(super) self_ref: Weak<Self>,
     pub(super) netns: Arc<NetNamespace>,
+    /// cBPF filter 程序；空指针是“未安装”的唯一事实来源。
+    pub(super) filter: RcuOptionArcSlot<Vec<SockFilter>>,
+    /// 串行化 SO_ATTACH_FILTER、SO_DETACH_FILTER 与 SO_LOCK_FILTER。
+    pub(super) filter_locked: Mutex<bool>,
     epoll_items: EPollItems,
     fasync_items: FAsyncItems,
 }
@@ -128,6 +156,8 @@ impl PacketSocket {
             self_ref: me.clone(),
             netns,
             epoll_items: EPollItems::default(),
+            filter: RcuOptionArcSlot::new_none(),
+            filter_locked: Mutex::new(false),
             fasync_items: FAsyncItems::default(),
         });
         socket.netns.register_packet_socket(socket.self_ref.clone());
@@ -173,7 +203,7 @@ pub fn classify_packet(frame: &[u8], iface: &Arc<dyn Iface>) -> PacketType {
 /// Common AF_PACKET tap for Ethernet netdevices.
 pub fn deliver_to_packet_sockets(iface: &Arc<dyn Iface>, frame: &[u8], pkt_type: PacketType) {
     if let Some(netns) = iface.net_namespace() {
-        netns.deliver_to_packet_sockets(iface.nic_id() as u32, frame, pkt_type);
+        netns.deliver_to_packet_sockets(PacketIngressMetadata::from_iface(iface, pkt_type), frame);
     }
 }