From: brakmo <brakmo@fb.com>
To: netdev <netdev@vger.kernel.org>
Cc: Martin Lau <kafai@fb.com>, Alexei Starovoitov <ast@fb.com>,
Daniel Borkmann <daniel@iogearbox.net>,
Eric Dumazet <eric.dumazet@gmail.com>,
Kernel Team <Kernel-team@fb.com>
Subject: [PATCH bpf-next 4/7] bpf: Update BPF_CGROUP_RUN_PROG_INET_EGRESS calls
Date: Sat, 23 Mar 2019 01:05:39 -0700 [thread overview]
Message-ID: <20190323080542.173569-5-brakmo@fb.com> (raw)
In-Reply-To: <20190323080542.173569-1-brakmo@fb.com>
Update BPF_CGROUP_RUN_PROG_INET_EGRESS() callers to support returning
congestion notifications.
If BPF_CGROUP_RUN_PROG_INET_EGRESS() returns a value other than
NET_XMIT_SUCCESS or NET_XMIT_CN, the skb is dropped and the value
is returned to the caller.
Else, if the return of the output function is not NET_XMIT_SUCCESS,
return it, otherwise return the return value of the call to
BPF_CGROUP_RUN_PROG_INET_EGRESS().
Otherwise, return the return value of the output function.
Signed-off-by: Lawrence Brakmo <brakmo@fb.com>
---
net/ipv4/ip_output.c | 39 ++++++++++++++++++++++-----------------
net/ipv6/ip6_output.c | 22 +++++++++++++---------
2 files changed, 35 insertions(+), 26 deletions(-)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index c80188875f39..efa0b9a195b4 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -292,43 +292,48 @@ static int ip_finish_output_gso(struct net *net, struct sock *sk,
static int ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
unsigned int mtu;
+ int ret_bpf;
int ret;
- ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
- if (ret) {
+ ret_bpf = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
+ if (ret_bpf != NET_XMIT_SUCCESS && ret_bpf != NET_XMIT_CN) {
kfree_skb(skb);
- return ret;
+ return ret_bpf;
}
#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
/* Policy lookup after SNAT yielded a new policy */
if (skb_dst(skb)->xfrm) {
IPCB(skb)->flags |= IPSKB_REROUTED;
- return dst_output(net, sk, skb);
- }
+ ret = dst_output(net, sk, skb);
+ } else
#endif
- mtu = ip_skb_dst_mtu(sk, skb);
- if (skb_is_gso(skb))
- return ip_finish_output_gso(net, sk, skb, mtu);
-
- if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU))
- return ip_fragment(net, sk, skb, mtu, ip_finish_output2);
-
- return ip_finish_output2(net, sk, skb);
+ {
+ mtu = ip_skb_dst_mtu(sk, skb);
+ if (skb_is_gso(skb))
+ ret = ip_finish_output_gso(net, sk, skb, mtu);
+ else if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU))
+ ret = ip_fragment(net, sk, skb, mtu, ip_finish_output2);
+ else
+ ret = ip_finish_output2(net, sk, skb);
+ }
+ return ret ? : ret_bpf;
}
static int ip_mc_finish_output(struct net *net, struct sock *sk,
struct sk_buff *skb)
{
+ int ret_bpf;
int ret;
- ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
- if (ret) {
+ ret_bpf = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
+ if (ret_bpf != NET_XMIT_SUCCESS && ret_bpf != NET_XMIT_CN) {
kfree_skb(skb);
- return ret;
+ return ret_bpf;
}
- return dev_loopback_xmit(net, sk, skb);
+ ret = dev_loopback_xmit(net, sk, skb);
+ return ret ? : ret_bpf;
}
int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index edbd12067170..53a838d82a21 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -130,28 +130,32 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
+ int ret_bpf;
int ret;
- ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
- if (ret) {
+ ret_bpf = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
+ if (ret_bpf != NET_XMIT_SUCCESS && ret_bpf != NET_XMIT_CN) {
kfree_skb(skb);
- return ret;
+ return ret_bpf;
}
#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
/* Policy lookup after SNAT yielded a new policy */
if (skb_dst(skb)->xfrm) {
IPCB(skb)->flags |= IPSKB_REROUTED;
- return dst_output(net, sk, skb);
- }
+ ret = dst_output(net, sk, skb);
+ } else
#endif
if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
dst_allfrag(skb_dst(skb)) ||
- (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
- return ip6_fragment(net, sk, skb, ip6_finish_output2);
- else
- return ip6_finish_output2(net, sk, skb);
+ (IP6CB(skb)->frag_max_size && skb->len >
+ IP6CB(skb)->frag_max_size)) {
+ ret = ip6_fragment(net, sk, skb, ip6_finish_output2);
+ } else {
+ ret = ip6_finish_output2(net, sk, skb);
+ }
+ return ret ? : ret_bpf;
}
int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
--
2.17.1
next prev parent reply other threads:[~2019-03-23 8:07 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-23 8:05 [PATCH bpf-next 0/7] bpf: Propagate cn to TCP brakmo
2019-03-23 8:05 ` [PATCH bpf-next 1/7] bpf: Create BPF_PROG_CGROUP_INET_EGRESS_RUN_ARRAY brakmo
2019-03-23 8:05 ` [PATCH bpf-next 2/7] bpf: cgroup inet skb programs can return 0 to 3 brakmo
2019-03-23 8:05 ` [PATCH bpf-next 3/7] bpf: Update __cgroup_bpf_run_filter_skb with cn brakmo
2019-03-23 8:05 ` brakmo [this message]
2019-03-23 8:05 ` [PATCH bpf-next 5/7] bpf: sysctl for probe_on_drop brakmo
2019-03-23 8:05 ` [PATCH bpf-next 6/7] bpf: Add cn support to hbm_out_kern.c brakmo
2019-03-23 8:05 ` [PATCH bpf-next 7/7] bpf: Add more stats to HBM brakmo
2019-03-23 9:12 ` [PATCH bpf-next 0/7] bpf: Propagate cn to TCP Eric Dumazet
2019-03-23 15:41 ` Alexei Starovoitov
2019-03-24 5:36 ` Eric Dumazet
2019-03-24 16:19 ` Alexei Starovoitov
2019-03-25 8:33 ` Eric Dumazet
2019-03-25 8:48 ` Eric Dumazet
2019-03-26 4:27 ` Alexei Starovoitov
2019-03-26 8:06 ` Eric Dumazet
2019-03-26 15:07 ` Alexei Starovoitov
2019-03-26 15:43 ` Eric Dumazet
2019-03-26 17:01 ` Alexei Starovoitov
2019-03-26 18:07 ` Eric Dumazet
2019-03-26 8:13 ` Eric Dumazet
2019-03-24 5:48 ` Eric Dumazet
2019-03-24 1:14 ` Lawrence Brakmo
2019-03-24 5:58 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190323080542.173569-5-brakmo@fb.com \
--to=brakmo@fb.com \
--cc=Kernel-team@fb.com \
--cc=ast@fb.com \
--cc=daniel@iogearbox.net \
--cc=eric.dumazet@gmail.com \
--cc=kafai@fb.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.