diff --git a/bpf/progs/clatd.c b/bpf/progs/clatd.c index 84134856fd..a14807c2bf 100644 --- a/bpf/progs/clatd.c +++ b/bpf/progs/clatd.c @@ -247,29 +247,29 @@ static inline __always_inline int nat64(struct __sk_buff* skb, return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER("schedcls/ingress6_clat_ether$4_14", AID_ROOT, AID_SYSTEM, sched_cls_ingress6_clat_ether_4_14, KVER_4_14) +DEFINE_BPF_PROG_KVER(schedcls, "ingress6_clat_ether$4_14", AID_ROOT, AID_SYSTEM, sched_cls_ingress6_clat_ether_4_14, KVER_4_14) (struct __sk_buff* skb) { return nat64(skb, ETHER, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE("schedcls/ingress6_clat_ether$4_9", AID_ROOT, AID_SYSTEM, sched_cls_ingress6_clat_ether_4_9, KVER_NONE, KVER_4_14) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "ingress6_clat_ether$4_9", AID_ROOT, AID_SYSTEM, sched_cls_ingress6_clat_ether_4_9, KVER_NONE, KVER_4_14) (struct __sk_buff* skb) { return nat64(skb, ETHER, KVER_NONE); } -DEFINE_BPF_PROG_KVER("schedcls/ingress6_clat_rawip$4_14", AID_ROOT, AID_SYSTEM, sched_cls_ingress6_clat_rawip_4_14, KVER_4_14) +DEFINE_BPF_PROG_KVER(schedcls, "ingress6_clat_rawip$4_14", AID_ROOT, AID_SYSTEM, sched_cls_ingress6_clat_rawip_4_14, KVER_4_14) (struct __sk_buff* skb) { return nat64(skb, RAWIP, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE("schedcls/ingress6_clat_rawip$4_9", AID_ROOT, AID_SYSTEM, sched_cls_ingress6_clat_rawip_4_9, KVER_NONE, KVER_4_14) +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "ingress6_clat_rawip$4_9", AID_ROOT, AID_SYSTEM, sched_cls_ingress6_clat_rawip_4_9, KVER_NONE, KVER_4_14) (struct __sk_buff* skb) { return nat64(skb, RAWIP, KVER_NONE); } DEFINE_BPF_MAP_GRW(clat_egress4_map, HASH, ClatEgress4Key, ClatEgress4Value, 16, AID_SYSTEM) -DEFINE_BPF_PROG("schedcls/egress4_clat_rawip", AID_ROOT, AID_SYSTEM, sched_cls_egress4_clat_rawip) +DEFINE_BPF_PROG(schedcls, "egress4_clat_rawip", AID_ROOT, AID_SYSTEM, sched_cls_egress4_clat_rawip) (struct __sk_buff* skb) { // Must be meta-ethernet IPv4 frame if (skb->protocol != htons(ETH_P_IP)) return TC_ACT_PIPE; diff --git a/bpf/progs/dscpPolicy.c b/bpf/progs/dscpPolicy.c index 3305aadf36..47e13ffebb 100644 --- a/bpf/progs/dscpPolicy.c +++ b/bpf/progs/dscpPolicy.c @@ -264,7 +264,7 @@ static inline __always_inline void match_policy(struct __sk_buff* skb, const boo return; } -DEFINE_BPF_PROG_KVER("schedcls/set_dscp_ether", AID_ROOT, AID_SYSTEM, schedcls_set_dscp_ether, +DEFINE_BPF_PROG_KVER(schedcls, "set_dscp_ether", AID_ROOT, AID_SYSTEM, schedcls_set_dscp_ether, KVER_5_15) (struct __sk_buff* skb) { if (skb->pkt_type != PACKET_HOST) return TC_ACT_PIPE; diff --git a/bpf/progs/include/bpf_helpers.h b/bpf/progs/include/bpf_helpers.h index a0c12d01fc..922e927893 100644 --- a/bpf/progs/include/bpf_helpers.h +++ b/bpf/progs/include/bpf_helpers.h @@ -479,7 +479,7 @@ static int (*bpf_trace_printk)(const char* fmt, int fmt_size, ...) = (void*) BPF // Note: bpf only supports up to 3 arguments, log via: bpf_printf("msg %d %d %d", 1, 2, 3); // and read via the blocking: sudo cat /sys/kernel/debug/tracing/trace_pipe -#define DEFINE_BPF_PROG_EXT(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv, \ +#define DEFINE_BPF_PROG_EXT(TYPE, NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv, \ min_loader, max_loader, opt, selinux, pindir) \ VALIDATE_SELINUX_CONTEXT(min_loader, selinux); \ VALIDATE_PIN_DIR(min_loader, pindir); \ @@ -494,13 +494,13 @@ static int (*bpf_trace_printk)(const char* fmt, int fmt_size, ...) = (void*) BPF .create_location = CREATE_LOCATION(selinux), \ .pin_prefix = "/sys/fs/bpf/" pindir "/prog_" BPF_OBJ_NAME "_", \ }; \ - SECTION(SECTION_NAME) \ + SECTION(#TYPE "/" NAME) \ int the_prog -#define DEFINE_BPF_PROG_KVER_RANGE_OPT(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv, \ - opt) \ - DEFINE_BPF_PROG_EXT(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv, \ - BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, opt, \ +#define DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv, \ + opt) \ + DEFINE_BPF_PROG_EXT(TYPE, NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv, \ + BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, opt, \ DEFAULT_BPF_MAP_SELINUX_CONTEXT, DEFAULT_BPF_PIN_SUBDIR) // Programs (here used in the sense of functions/sections) marked optional are allowed to fail @@ -515,26 +515,26 @@ static int (*bpf_trace_printk)(const char* fmt, int fmt_size, ...) = (void*) BPF // ie. a non-optional program in a critical .o is mandatory for kernels matching the min/max kver. // programs requiring a kernel version >= min_kv && < max_kv -#define DEFINE_BPF_PROG_KVER_RANGE(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv, \ +#define DEFINE_BPF_PROG_KVER_RANGE(TYPE, NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv, \ MANDATORY) -#define DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv, \ - max_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv, \ +#define DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(TYPE, NAME, prog_uid, prog_gid, the_prog, min_kv, \ + max_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, prog_uid, prog_gid, the_prog, min_kv, max_kv, \ OPTIONAL) // programs requiring a kernel version >= min_kv -#define DEFINE_BPF_PROG_KVER(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv, KVER_INF, \ +#define DEFINE_BPF_PROG_KVER(TYPE, NAME, prog_uid, prog_gid, the_prog, min_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, prog_uid, prog_gid, the_prog, min_kv, KVER_INF, \ MANDATORY) -#define DEFINE_OPTIONAL_BPF_PROG_KVER(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv, KVER_INF, \ +#define DEFINE_OPTIONAL_BPF_PROG_KVER(TYPE, NAME, prog_uid, prog_gid, the_prog, min_kv) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, prog_uid, prog_gid, the_prog, min_kv, KVER_INF, \ OPTIONAL) // programs with no kernel version requirements -#define DEFINE_BPF_PROG(SECTION_NAME, prog_uid, prog_gid, the_prog) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(SECTION_NAME, prog_uid, prog_gid, the_prog, KVER_NONE, KVER_INF, \ +#define DEFINE_BPF_PROG(TYPE, NAME, prog_uid, prog_gid, the_prog) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, prog_uid, prog_gid, the_prog, KVER_NONE, KVER_INF, \ MANDATORY) -#define DEFINE_OPTIONAL_BPF_PROG(SECTION_NAME, prog_uid, prog_gid, the_prog) \ - DEFINE_BPF_PROG_KVER_RANGE_OPT(SECTION_NAME, prog_uid, prog_gid, the_prog, KVER_NONE, KVER_INF, \ +#define DEFINE_OPTIONAL_BPF_PROG(TYPE, NAME, prog_uid, prog_gid, the_prog) \ + DEFINE_BPF_PROG_KVER_RANGE_OPT(TYPE, NAME, prog_uid, prog_gid, the_prog, KVER_NONE, KVER_INF, \ OPTIONAL) diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c index 2e912521f0..55b5f145dd 100644 --- a/bpf/progs/netd.c +++ b/bpf/progs/netd.c @@ -113,34 +113,34 @@ DEFINE_BPF_MAP_EXT(local_net_blocked_uid_map, HASH, uint32_t, bool, -1000, // program (see XT_BPF_MODE_PATH_PINNED) and then the iptables binary (or rather // the kernel acting on behalf of it) must be able to retrieve the pinned program // for the reload to succeed -#define DEFINE_XTBPF_PROG(SECTION_NAME, the_prog) \ - DEFINE_BPF_PROG(SECTION_NAME, AID_ROOT, AID_NET_ADMIN, the_prog) +#define DEFINE_XTBPF_PROG(TYPE, NAME, the_prog) \ + DEFINE_BPF_PROG(TYPE, NAME, AID_ROOT, AID_NET_ADMIN, the_prog) // programs that need to be usable by netd, but not by netutils_wrappers // (this is because these are currently attached by the mainline provided libnetd_updatable .so // which is loaded into netd and thus runs as netd uid/gid/selinux context) -#define DEFINE_NETD_BPF_PROG_RANGES(SECTION_NAME, the_prog, minKV, maxKV, min_loader, max_loader) \ - DEFINE_BPF_PROG_EXT(SECTION_NAME, AID_ROOT, AID_ROOT, the_prog, \ - minKV, maxKV, min_loader, max_loader, MANDATORY, \ +#define DEFINE_NETD_BPF_PROG_RANGES(TYPE, NAME, the_prog, minKV, maxKV, min_loader, max_loader) \ + DEFINE_BPF_PROG_EXT(TYPE, NAME, AID_ROOT, AID_ROOT, the_prog, \ + minKV, maxKV, min_loader, max_loader, MANDATORY, \ "netd_readonly", DEFAULT_BPF_PIN_SUBDIR) -#define DEFINE_NETD_BPF_PROG_KVER_RANGE(SECTION_NAME, the_prog, minKV, maxKV) \ - DEFINE_NETD_BPF_PROG_RANGES(SECTION_NAME, the_prog, minKV, maxKV, BPFLOADER_MIN_VER, BPFLOADER_MAX_VER) +#define DEFINE_NETD_BPF_PROG_KVER_RANGE(TYPE, NAME, the_prog, minKV, maxKV) \ + DEFINE_NETD_BPF_PROG_RANGES(TYPE, NAME, the_prog, minKV, maxKV, BPFLOADER_MIN_VER, BPFLOADER_MAX_VER) -#define DEFINE_NETD_BPF_PROG_KVER(SECTION_NAME, the_prog, min_kv) \ - DEFINE_NETD_BPF_PROG_KVER_RANGE(SECTION_NAME, the_prog, min_kv, KVER_INF) +#define DEFINE_NETD_BPF_PROG_KVER(TYPE, NAME, the_prog, min_kv) \ + DEFINE_NETD_BPF_PROG_KVER_RANGE(TYPE, NAME, the_prog, min_kv, KVER_INF) -#define DEFINE_NETD_BPF_PROG(SECTION_NAME, the_prog) \ - DEFINE_NETD_BPF_PROG_KVER(SECTION_NAME, the_prog, KVER_NONE) +#define DEFINE_NETD_BPF_PROG(TYPE, NAME, the_prog) \ + DEFINE_NETD_BPF_PROG_KVER(TYPE, NAME, the_prog, KVER_NONE) -#define DEFINE_NETD_V_BPF_PROG_KVER(SECTION_NAME, the_prog, minKV) \ - DEFINE_BPF_PROG_EXT(SECTION_NAME, AID_ROOT, AID_ROOT, the_prog, minKV, \ +#define DEFINE_NETD_V_BPF_PROG_KVER(TYPE, NAME, the_prog, minKV) \ + DEFINE_BPF_PROG_EXT(TYPE, NAME, AID_ROOT, AID_ROOT, the_prog, minKV, \ KVER_INF, BPFLOADER_MAINLINE_V_VERSION, BPFLOADER_MAX_VER, MANDATORY, \ "netd_readonly", DEFAULT_BPF_PIN_SUBDIR) // programs that only need to be usable by the system server -#define DEFINE_SYS_BPF_PROG(SECTION_NAME, the_prog) \ - DEFINE_BPF_PROG_EXT(SECTION_NAME, AID_ROOT, AID_NET_ADMIN, the_prog, KVER_NONE, KVER_INF, \ +#define DEFINE_SYS_BPF_PROG(TYPE, NAME, the_prog) \ + DEFINE_BPF_PROG_EXT(TYPE, NAME, AID_ROOT, AID_NET_ADMIN, the_prog, KVER_NONE, KVER_INF, \ BPFLOADER_MIN_VER, BPFLOADER_MAX_VER, MANDATORY, \ "net_shared", DEFAULT_BPF_PIN_SUBDIR) @@ -608,7 +608,7 @@ static __always_inline inline int bpf_traffic_account(struct __sk_buff* skb, // ----- cgroupskb/ingress/stats ----- // Android 25Q2+ 5.10+ (localnet protection + tracing) -DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/ingress_stats$5_10_25q2", +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, "ingress_stats$5_10_25q2", bpf_cgroup_ingress_5_10_25q2, KVER_5_10, KVER_INF, BPFLOADER_MAINLINE_25Q2_VERSION, BPFLOADER_MAX_VER) (struct __sk_buff* skb) { @@ -616,7 +616,7 @@ DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/ingress_stats$5_10_25q2", } // Android 25Q2+ 5.4 (localnet protection) -DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/ingress_stats$5_4_25q2", +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, "ingress_stats$5_4_25q2", bpf_cgroup_ingress_5_4_25q2, KVER_5_4, KVER_5_10, BPFLOADER_MAINLINE_25Q2_VERSION, BPFLOADER_MAX_VER) (struct __sk_buff* skb) { @@ -624,7 +624,7 @@ DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/ingress_stats$5_4_25q2", } // Android U/V 5.10+ (tracing) -DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/ingress_stats$5_10_u", +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, "ingress_stats$5_10_u", bpf_cgroup_ingress_5_10_u, KVER_5_10, KVER_INF, BPFLOADER_MAINLINE_U_VERSION, BPFLOADER_MAINLINE_25Q2_VERSION) (struct __sk_buff* skb) { @@ -632,21 +632,21 @@ DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/ingress_stats$5_10_u", } // Android T/U/V/25Q2 5.4 & T 5.10/5.15 -DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/ingress_stats$5_4", +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, "ingress_stats$5_4", bpf_cgroup_ingress_5_4, KVER_5_4, KVER_INF) (struct __sk_buff* skb) { return bpf_traffic_account(skb, INGRESS, KVER_5_4, SDK_LEVEL_T); } // Android T/U/V 4.19 -DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/ingress_stats$4_19", +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, "ingress_stats$4_19", bpf_cgroup_ingress_4_19, KVER_4_19, KVER_5_4) (struct __sk_buff* skb) { return bpf_traffic_account(skb, INGRESS, KVER_4_19, SDK_LEVEL_T); } // Android T 4.9 & T/U 4.14 -DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/ingress_stats$4_9", +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, "ingress_stats$4_9", bpf_cgroup_ingress_4_9, KVER_NONE, KVER_4_19) (struct __sk_buff* skb) { return bpf_traffic_account(skb, INGRESS, KVER_NONE, SDK_LEVEL_T); @@ -655,7 +655,7 @@ DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/ingress_stats$4_9", // ----- cgroupskb/egress/stats ----- // Android 25Q2+ 5.10+ (localnet protection + tracing) -DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/egress_stats$5_10_25q2", +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, "egress_stats$5_10_25q2", bpf_cgroup_egress_5_10_25q2, KVER_5_10, KVER_INF, BPFLOADER_MAINLINE_25Q2_VERSION, BPFLOADER_MAX_VER) (struct __sk_buff* skb) { @@ -663,7 +663,7 @@ DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/egress_stats$5_10_25q2", } // Android 25Q2+ 5.4 (localnet protection) -DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/egress_stats$5_4_25q2", +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, "egress_stats$5_4_25q2", bpf_cgroup_egress_5_4_25q2, KVER_5_4, KVER_5_10, BPFLOADER_MAINLINE_25Q2_VERSION, BPFLOADER_MAX_VER) (struct __sk_buff* skb) { @@ -671,7 +671,7 @@ DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/egress_stats$5_4_25q2", } // Android U/V 5.10+ (tracing) -DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/egress_stats$5_10_u", +DEFINE_NETD_BPF_PROG_RANGES(cgroupskb, "egress_stats$5_10_u", bpf_cgroup_egress_5_10_u, KVER_5_10, KVER_INF, BPFLOADER_MAINLINE_U_VERSION, BPFLOADER_MAINLINE_25Q2_VERSION) (struct __sk_buff* skb) { @@ -679,21 +679,21 @@ DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/egress_stats$5_10_u", } // Android T/U/V/25Q2 5.4 & T 5.10/5.15 -DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/egress_stats$5_4", +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, "egress_stats$5_4", bpf_cgroup_egress_5_4, KVER_5_4, KVER_INF) (struct __sk_buff* skb) { return bpf_traffic_account(skb, EGRESS, KVER_5_4, SDK_LEVEL_T); } // Android T/U/V 4.19 -DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/egress_stats$4_19", +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, "egress_stats$4_19", bpf_cgroup_egress_4_19, KVER_4_19, KVER_5_4) (struct __sk_buff* skb) { return bpf_traffic_account(skb, EGRESS, KVER_4_19, SDK_LEVEL_T); } // Android T 4.9 & T/U 4.14 -DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/egress_stats$4_9", +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupskb, "egress_stats$4_9", bpf_cgroup_egress_4_9, KVER_NONE, KVER_4_19) (struct __sk_buff* skb) { return bpf_traffic_account(skb, EGRESS, KVER_NONE, SDK_LEVEL_T); @@ -702,7 +702,7 @@ DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/egress_stats$4_9", // ----- // WARNING: Android T's non-updatable netd depends on the name of this program. -DEFINE_XTBPF_PROG("skfilter/egress_xtbpf", xt_bpf_egress_prog) +DEFINE_XTBPF_PROG(skfilter, "egress_xtbpf", xt_bpf_egress_prog) (struct __sk_buff* skb) { // Clat daemon does not generate new traffic, all its traffic is accounted for already // on the v4-* interfaces (except for the 20 (or 28) extra bytes of IPv6 vs IPv4 overhead, @@ -721,7 +721,7 @@ DEFINE_XTBPF_PROG("skfilter/egress_xtbpf", xt_bpf_egress_prog) } // WARNING: Android T's non-updatable netd depends on the name of this program. -DEFINE_XTBPF_PROG("skfilter/ingress_xtbpf", xt_bpf_ingress_prog) +DEFINE_XTBPF_PROG(skfilter, "ingress_xtbpf", xt_bpf_ingress_prog) (struct __sk_buff* skb) { // Clat daemon traffic is not accounted by virtue of iptables raw prerouting drop rule // (in clat_raw_PREROUTING chain), which triggers before this (in bw_raw_PREROUTING chain). @@ -733,7 +733,7 @@ DEFINE_XTBPF_PROG("skfilter/ingress_xtbpf", xt_bpf_ingress_prog) return XTBPF_MATCH; } -DEFINE_SYS_BPF_PROG("schedact/ingress_account", +DEFINE_SYS_BPF_PROG(schedact, "ingress_account", tc_bpf_ingress_account_prog) (struct __sk_buff* skb) { if (is_received_skb(skb)) { @@ -745,7 +745,7 @@ DEFINE_SYS_BPF_PROG("schedact/ingress_account", } // WARNING: Android T's non-updatable netd depends on the name of this program. -DEFINE_XTBPF_PROG("skfilter/allowlist_xtbpf", xt_bpf_allowlist_prog) +DEFINE_XTBPF_PROG(skfilter, "allowlist_xtbpf", xt_bpf_allowlist_prog) (struct __sk_buff* skb) { uint32_t sock_uid = bpf_get_socket_uid(skb); if (is_system_uid(sock_uid)) return XTBPF_MATCH; @@ -764,7 +764,7 @@ DEFINE_XTBPF_PROG("skfilter/allowlist_xtbpf", xt_bpf_allowlist_prog) } // WARNING: Android T's non-updatable netd depends on the name of this program. -DEFINE_XTBPF_PROG("skfilter/denylist_xtbpf", xt_bpf_denylist_prog) +DEFINE_XTBPF_PROG(skfilter, "denylist_xtbpf", xt_bpf_denylist_prog) (struct __sk_buff* skb) { uint32_t sock_uid = bpf_get_socket_uid(skb); UidOwnerValue* denylistMatch = bpf_uid_owner_map_lookup_elem(&sock_uid); @@ -796,18 +796,18 @@ static __always_inline inline int inet_socket_create(struct bpf_sock* sk, return (get_app_permissions() & BPF_PERMISSION_INTERNET) ? BPF_ALLOW : BPF_DISALLOW; } -DEFINE_NETD_BPF_PROG_KVER("cgroupsock/inet_create$5_10", inet_socket_create_5_10, KVER_5_10) +DEFINE_NETD_BPF_PROG_KVER(cgroupsock, "inet_create$5_10", inet_socket_create_5_10, KVER_5_10) (struct bpf_sock* sk) { return inet_socket_create(sk, KVER_5_10); } -DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupsock/inet_create$4_14", +DEFINE_NETD_BPF_PROG_KVER_RANGE(cgroupsock, "inet_create$4_14", inet_socket_create_4_14, KVER_4_14, KVER_5_10) (struct bpf_sock* sk) { return inet_socket_create(sk, KVER_4_14); } -DEFINE_NETD_BPF_PROG_KVER("cgroupsockrelease/inet_release", inet_socket_release, KVER_5_10) +DEFINE_NETD_BPF_PROG_KVER(cgroupsockrelease, "inet_release", inet_socket_release, KVER_5_10) (struct bpf_sock* sk) { uint64_t cookie = bpf_get_sk_cookie(sk); if (cookie) bpf_cookie_tag_map_delete_elem(&cookie); @@ -860,47 +860,47 @@ static inline __always_inline int block_port(struct bpf_sock_addr *ctx) { return BPF_ALLOW; } -DEFINE_NETD_BPF_PROG_KVER("bind4/inet4_bind", inet4_bind, KVER_4_19) +DEFINE_NETD_BPF_PROG_KVER(bind4, "inet4_bind", inet4_bind, KVER_4_19) (struct bpf_sock_addr *ctx) { return block_port(ctx); } -DEFINE_NETD_BPF_PROG_KVER("bind6/inet6_bind", inet6_bind, KVER_4_19) +DEFINE_NETD_BPF_PROG_KVER(bind6, "inet6_bind", inet6_bind, KVER_4_19) (struct bpf_sock_addr *ctx) { return block_port(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER("connect4/inet4_connect", inet4_connect, KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(connect4, "inet4_connect", inet4_connect, KVER_4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER("connect6/inet6_connect", inet6_connect, KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(connect6, "inet6_connect", inet6_connect, KVER_4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER("recvmsg4/udp4_recvmsg", udp4_recvmsg, KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(recvmsg4, "udp4_recvmsg", udp4_recvmsg, KVER_4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER("recvmsg6/udp6_recvmsg", udp6_recvmsg, KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(recvmsg6, "udp6_recvmsg", udp6_recvmsg, KVER_4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER("sendmsg4/udp4_sendmsg", udp4_sendmsg, KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(sendmsg4, "udp4_sendmsg", udp4_sendmsg, KVER_4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER("sendmsg6/udp6_sendmsg", udp6_sendmsg, KVER_4_19) +DEFINE_NETD_V_BPF_PROG_KVER(sendmsg6, "udp6_sendmsg", udp6_sendmsg, KVER_4_19) (struct bpf_sock_addr *ctx) { return check_localhost(ctx); } -DEFINE_NETD_V_BPF_PROG_KVER("getsockopt/prog", getsockopt_prog, KVER_5_4) +DEFINE_NETD_V_BPF_PROG_KVER(getsockopt, "prog", getsockopt_prog, KVER_5_4) (struct bpf_sockopt *ctx) { // Tell kernel to return 'original' kernel reply (instead of the bpf modified buffer) // This is important if the answer is larger than PAGE_SIZE (max size this bpf hook can provide) @@ -908,7 +908,7 @@ DEFINE_NETD_V_BPF_PROG_KVER("getsockopt/prog", getsockopt_prog, KVER_5_4) return BPF_ALLOW; } -DEFINE_NETD_V_BPF_PROG_KVER("setsockopt/prog", setsockopt_prog, KVER_5_4) +DEFINE_NETD_V_BPF_PROG_KVER(setsockopt, "prog", setsockopt_prog, KVER_5_4) (struct bpf_sockopt *ctx) { // Tell kernel to use/process original buffer provided by userspace. // This is important if it is larger than PAGE_SIZE (max size this bpf hook can handle). diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c index 0401d704b0..92bb3f3a7b 100644 --- a/bpf/progs/offload.c +++ b/bpf/progs/offload.c @@ -257,26 +257,26 @@ static inline __always_inline int do_forward6(struct __sk_buff* skb, } // implementation for 5.4+ (can use skb->gso_{segs,size}) -DEFINE_BPF_PROG_KVER("schedcls/tether_downstream6_ether$5_4", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER(schedcls, "tether_downstream6_ether$5_4", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream6_ether_5_4, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, ETHER, DOWNSTREAM, KVER_5_4); } -DEFINE_BPF_PROG_KVER("schedcls/tether_upstream6_ether$5_4", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER(schedcls, "tether_upstream6_ether$5_4", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream6_ether_5_4, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, ETHER, UPSTREAM, KVER_5_4); } // implementation for 4.9/4.14/4.19 -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_downstream6_ether", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream6_ether", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream6_ether, KVER_NONE, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, ETHER, DOWNSTREAM, KVER_NONE); } -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream6_ether", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream6_ether", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream6_ether, KVER_NONE, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, ETHER, UPSTREAM, KVER_NONE); @@ -296,39 +296,39 @@ DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream6_ether", AID_ROOT, AID_NETW // and in system/netd/tests/binder_test.cpp NetdBinderTest TetherOffloadForwarding. // // Hence, these mandatory (must load successfully) implementations for 5.4+ kernels: -DEFINE_BPF_PROG_KVER("schedcls/tether_downstream6_rawip$5_4", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER(schedcls, "tether_downstream6_rawip$5_4", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream6_rawip_5_4, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, DOWNSTREAM, KVER_5_4); } -DEFINE_BPF_PROG_KVER("schedcls/tether_upstream6_rawip$5_4", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER(schedcls, "tether_upstream6_rawip$5_4", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream6_rawip_5_4, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, UPSTREAM, KVER_5_4); } // and for 4.14/4.19 kernels -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_downstream6_rawip$4_14", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream6_rawip$4_14", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream6_rawip_4_14, KVER_4_14, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, DOWNSTREAM, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream6_rawip$4_14", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream6_rawip$4_14", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream6_rawip_4_14, KVER_4_14, KVER_5_4) (struct __sk_buff* skb) { return do_forward6(skb, RAWIP, UPSTREAM, KVER_4_14); } // and define no-op stubs for pre-4.14 kernels. -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_downstream6_rawip$stub", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream6_rawip$stub", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream6_rawip_stub, KVER_NONE, KVER_4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream6_rawip$stub", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream6_rawip$stub", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream6_rawip_stub, KVER_NONE, KVER_4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; @@ -644,25 +644,25 @@ static inline __always_inline int do_forward4(struct __sk_buff* skb, // Full featured (required) implementations for 5.10+ kernels (these are S+ by definition) -DEFINE_BPF_PROG_KVER("schedcls/tether_downstream4_rawip$5_10", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER(schedcls, "tether_downstream4_rawip$5_10", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream4_rawip_5_10, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_5_10); } -DEFINE_BPF_PROG_KVER("schedcls/tether_upstream4_rawip$5_10", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER(schedcls, "tether_upstream4_rawip$5_10", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream4_rawip_5_10, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_5_10); } -DEFINE_BPF_PROG_KVER("schedcls/tether_downstream4_ether$5_10", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER(schedcls, "tether_downstream4_ether$5_10", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream4_ether_5_10, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_5_10); } -DEFINE_BPF_PROG_KVER("schedcls/tether_upstream4_ether$5_10", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER(schedcls, "tether_upstream4_ether$5_10", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream4_ether_5_10, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, UPSTREAM, UPDATETIME, KVER_5_10); @@ -671,7 +671,7 @@ DEFINE_BPF_PROG_KVER("schedcls/tether_upstream4_ether$5_10", AID_ROOT, AID_NETWO // Full featured (optional) implementations for 5.4-S kernels // (optional, because we need to be able to fallback for 5.4 pre-S kernels) -DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_rawip$opt54", +DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream4_rawip$opt54", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream4_rawip_opt54, KVER_5_4, KVER_5_10) @@ -679,7 +679,7 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_rawip$opt54", return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_5_4); } -DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$opt54", +DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream4_rawip$opt54", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream4_rawip_opt54, KVER_5_4, KVER_5_10) @@ -687,7 +687,7 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$opt54", return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_5_4); } -DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_ether$opt54", +DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream4_ether$opt54", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream4_ether_opt54, KVER_5_4, KVER_5_10) @@ -695,7 +695,7 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_ether$opt54", return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_5_4); } -DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_ether$opt54", +DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream4_ether$opt54", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream4_ether_opt54, KVER_5_4, KVER_5_10) @@ -706,7 +706,7 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_ether$opt54", // Full featured (optional) implementations for 4.14-S & 4.19-S kernels // (optional, because we need to be able to fallback for 4.14/4.19 pre-S kernels) -DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_rawip$opt", +DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream4_rawip$opt", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream4_rawip_opt, KVER_4_14, KVER_5_4) @@ -714,7 +714,7 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_rawip$opt", return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_4_14); } -DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$opt", +DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream4_rawip$opt", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream4_rawip_opt, KVER_4_14, KVER_5_4) @@ -722,7 +722,7 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$opt", return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_4_14); } -DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_ether$opt", +DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream4_ether$opt", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream4_ether_opt, KVER_4_14, KVER_5_4) @@ -730,7 +730,7 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_ether$opt", return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_4_14); } -DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_ether$opt", +DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream4_ether$opt", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream4_ether_opt, KVER_4_14, KVER_5_4) @@ -752,13 +752,13 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_ether$opt", // RAWIP: Required for 5.4-R kernels -- which always support bpf_skb_change_head(). -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_rawip$5_4", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream4_rawip$5_4", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream4_rawip_5_4, KVER_5_4, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, DOWNSTREAM, NO_UPDATETIME, KVER_5_4); } -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$5_4", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream4_rawip$5_4", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream4_rawip_5_4, KVER_5_4, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, RAWIP, UPSTREAM, NO_UPDATETIME, KVER_5_4); @@ -767,7 +767,7 @@ DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$5_4", AID_ROOT, AID_ // RAWIP: Optional for 4.14/4.19 (R) kernels -- which support bpf_skb_change_head(). // [Note: fallback for 4.14/4.19 (P/Q) kernels is below in stub section] -DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_rawip$4_14", +DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream4_rawip$4_14", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream4_rawip_4_14, KVER_4_14, KVER_5_4) @@ -775,7 +775,7 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_rawip$4_14", return do_forward4(skb, RAWIP, DOWNSTREAM, NO_UPDATETIME, KVER_4_14); } -DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$4_14", +DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream4_rawip$4_14", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream4_rawip_4_14, KVER_4_14, KVER_5_4) @@ -785,13 +785,13 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$4_14", // ETHER: Required for 4.14-Q/R, 4.19-Q/R & 5.4-R kernels. -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_ether$4_14", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream4_ether$4_14", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream4_ether_4_14, KVER_4_14, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, DOWNSTREAM, NO_UPDATETIME, KVER_4_14); } -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_ether$4_14", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream4_ether$4_14", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream4_ether_4_14, KVER_4_14, KVER_5_10) (struct __sk_buff* skb) { return do_forward4(skb, ETHER, UPSTREAM, NO_UPDATETIME, KVER_4_14); @@ -801,13 +801,13 @@ DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_ether$4_14", AID_ROOT, AID // RAWIP: 4.9-P/Q, 4.14-P/Q & 4.19-Q kernels -- without bpf_skb_change_head() for tc programs -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_rawip$stub", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream4_rawip$stub", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream4_rawip_stub, KVER_NONE, KVER_5_4) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$stub", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream4_rawip$stub", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream4_rawip_stub, KVER_NONE, KVER_5_4) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; @@ -815,13 +815,13 @@ DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$stub", AID_ROOT, AID // ETHER: 4.9-P/Q kernel -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_ether$stub", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_downstream4_ether$stub", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_downstream4_ether_stub, KVER_NONE, KVER_4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE; } -DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_ether$stub", AID_ROOT, AID_NETWORK_STACK, +DEFINE_BPF_PROG_KVER_RANGE(schedcls, "tether_upstream4_ether$stub", AID_ROOT, AID_NETWORK_STACK, sched_cls_tether_upstream4_ether_stub, KVER_NONE, KVER_4_14) (__unused struct __sk_buff* skb) { return TC_ACT_PIPE;