openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

bpf: rename sk_actions to align with bpf infrastructure 

Recent additions to support multiple programs in cgroups impose
a strict requirement, "all yes is yes, any no is no". To enforce
this the infrastructure requires the 'no' return code, SK_DROP in
this case, to be 0.

To apply these rules to SK_SKB program types the sk_actions return
codes need to be adjusted.

This fix adds SK_PASS and makes 'SK_DROP = 0'. Finally, remove
SK_ABORTED to remove any chance that the API may allow aborted
program flows to be passed up the stack. This would be incorrect
behavior and allow programs to break existing policies.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
John Fastabend 2017-10-27 09:45:53 -07:00 committed by David S. Miller
parent 8108a77515
commit bfa640757e
4 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/uapi/linux/bpf.h
View File

@ -575,7 +575,7 @@ union bpf_attr {
* @map: pointer to sockmap * @map: pointer to sockmap
* @key: key to lookup sock in map * @key: key to lookup sock in map
* @flags: reserved for future use * @flags: reserved for future use
* Return: SK_REDIRECT * Return: SK_PASS
* *
* int bpf_sock_map_update(skops, map, key, flags) * int bpf_sock_map_update(skops, map, key, flags)
* @skops: pointer to bpf_sock_ops * @skops: pointer to bpf_sock_ops
@ -786,8 +786,8 @@ struct xdp_md {
}; };
enum sk_action { enum sk_action {
SK_ABORTED = 0, SK_DROP = 0,
SK_DROP, SK_PASS,
SK_REDIRECT, SK_REDIRECT,
}; };

3
kernel/bpf/sockmap.c
View File

@ -122,7 +122,8 @@ static int smap_verdict_func(struct smap_psock *psock, struct sk_buff *skb)
preempt_enable(); preempt_enable();
skb->sk = NULL; skb->sk = NULL;
return rc; return rc == SK_PASS ?
(TCP_SKB_CB(skb)->bpf.map ? SK_REDIRECT : SK_PASS) : SK_DROP;
} }
static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb) static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb)

5
net/core/filter.c
View File

@ -1844,14 +1844,15 @@ BPF_CALL_4(bpf_sk_redirect_map, struct sk_buff *, skb,
{ {
struct tcp_skb_cb *tcb = TCP_SKB_CB(skb); struct tcp_skb_cb *tcb = TCP_SKB_CB(skb);
/* If user passes invalid input drop the packet. */
if (unlikely(flags)) if (unlikely(flags))
return SK_ABORTED; return SK_DROP;
tcb->bpf.key = key; tcb->bpf.key = key;
tcb->bpf.flags = flags; tcb->bpf.flags = flags;
tcb->bpf.map = map; tcb->bpf.map = map;
return SK_REDIRECT; return SK_PASS;
} }
struct sock *do_sk_redirect_map(struct sk_buff *skb) struct sock *do_sk_redirect_map(struct sk_buff *skb)

4
tools/include/uapi/linux/bpf.h
View File

@ -787,8 +787,8 @@ struct xdp_md {
}; };
enum sk_action { enum sk_action {
SK_ABORTED = 0, SK_DROP = 0,
SK_DROP, SK_PASS,
SK_REDIRECT, SK_REDIRECT,
}; };