From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 02614C10F05 for ; Sat, 23 Mar 2019 08:07:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B934521019 for ; Sat, 23 Mar 2019 08:07:10 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=fb.com header.i=@fb.com header.b="OLumyg6i" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727137AbfCWIHJ (ORCPT ); Sat, 23 Mar 2019 04:07:09 -0400 Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:45740 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725909AbfCWIHH (ORCPT ); Sat, 23 Mar 2019 04:07:07 -0400 Received: from pps.filterd (m0044012.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x2N84w5e029437 for ; Sat, 23 Mar 2019 01:07:06 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-type; s=facebook; bh=EP023ThzqoAhn1uAZuU0/VcLgE43m3NGGBt5f0qWo1I=; b=OLumyg6imS31cQ48sq9LMCFe2of9Xgm54LKRzy/EgYovFt8dxuGF3ppU49sju2uRakg2 0mCGhSa9Aw2TE/BdXp8/11Lr+nK/46bs2UssB/XJKDDU5/zbu9SIQkDJpMRwde+c3W59 B1s9Ks8XsO6G4p8DeohfNII/CtB0l7K0esk= Received: from mail.thefacebook.com ([199.201.64.23]) by mx0a-00082601.pphosted.com with ESMTP id 2rddkgrfk9-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Sat, 23 Mar 2019 01:07:06 -0700 Received: from mx-out.facebook.com (2620:10d:c081:10::13) by mail.thefacebook.com (2620:10d:c081:35::129) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) id 15.1.1713.5; Sat, 23 Mar 2019 01:07:05 -0700 Received: by devbig009.ftw2.facebook.com (Postfix, from userid 10340) id EEB335AE24E3; Sat, 23 Mar 2019 01:07:04 -0700 (PDT) Smtp-Origin-Hostprefix: devbig From: brakmo Smtp-Origin-Hostname: devbig009.ftw2.facebook.com To: netdev CC: Martin Lau , Alexei Starovoitov , Daniel Borkmann , Eric Dumazet , Kernel Team Smtp-Origin-Cluster: ftw2c04 Subject: [PATCH bpf-next 4/7] bpf: Update BPF_CGROUP_RUN_PROG_INET_EGRESS calls Date: Sat, 23 Mar 2019 01:05:39 -0700 Message-ID: <20190323080542.173569-5-brakmo@fb.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190323080542.173569-1-brakmo@fb.com> References: <20190323080542.173569-1-brakmo@fb.com> X-FB-Internal: Safe MIME-Version: 1.0 Content-Type: text/plain X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2019-03-23_05:,, signatures=0 X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Update BPF_CGROUP_RUN_PROG_INET_EGRESS() callers to support returning congestion notifications. If BPF_CGROUP_RUN_PROG_INET_EGRESS() returns a value other than NET_XMIT_SUCCESS or NET_XMIT_CN, the skb is dropped and the value is returned to the caller. Else, if the return of the output function is not NET_XMIT_SUCCESS, return it, otherwise return the return value of the call to BPF_CGROUP_RUN_PROG_INET_EGRESS(). Otherwise, return the return value of the output function. Signed-off-by: Lawrence Brakmo --- net/ipv4/ip_output.c | 39 ++++++++++++++++++++++----------------- net/ipv6/ip6_output.c | 22 +++++++++++++--------- 2 files changed, 35 insertions(+), 26 deletions(-) diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index c80188875f39..efa0b9a195b4 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -292,43 +292,48 @@ static int ip_finish_output_gso(struct net *net, struct sock *sk, static int ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb) { unsigned int mtu; + int ret_bpf; int ret; - ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb); - if (ret) { + ret_bpf = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb); + if (ret_bpf != NET_XMIT_SUCCESS && ret_bpf != NET_XMIT_CN) { kfree_skb(skb); - return ret; + return ret_bpf; } #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM) /* Policy lookup after SNAT yielded a new policy */ if (skb_dst(skb)->xfrm) { IPCB(skb)->flags |= IPSKB_REROUTED; - return dst_output(net, sk, skb); - } + ret = dst_output(net, sk, skb); + } else #endif - mtu = ip_skb_dst_mtu(sk, skb); - if (skb_is_gso(skb)) - return ip_finish_output_gso(net, sk, skb, mtu); - - if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU)) - return ip_fragment(net, sk, skb, mtu, ip_finish_output2); - - return ip_finish_output2(net, sk, skb); + { + mtu = ip_skb_dst_mtu(sk, skb); + if (skb_is_gso(skb)) + ret = ip_finish_output_gso(net, sk, skb, mtu); + else if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU)) + ret = ip_fragment(net, sk, skb, mtu, ip_finish_output2); + else + ret = ip_finish_output2(net, sk, skb); + } + return ret ? : ret_bpf; } static int ip_mc_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb) { + int ret_bpf; int ret; - ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb); - if (ret) { + ret_bpf = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb); + if (ret_bpf != NET_XMIT_SUCCESS && ret_bpf != NET_XMIT_CN) { kfree_skb(skb); - return ret; + return ret_bpf; } - return dev_loopback_xmit(net, sk, skb); + ret = dev_loopback_xmit(net, sk, skb); + return ret ? : ret_bpf; } int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index edbd12067170..53a838d82a21 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -130,28 +130,32 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb) { + int ret_bpf; int ret; - ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb); - if (ret) { + ret_bpf = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb); + if (ret_bpf != NET_XMIT_SUCCESS && ret_bpf != NET_XMIT_CN) { kfree_skb(skb); - return ret; + return ret_bpf; } #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM) /* Policy lookup after SNAT yielded a new policy */ if (skb_dst(skb)->xfrm) { IPCB(skb)->flags |= IPSKB_REROUTED; - return dst_output(net, sk, skb); - } + ret = dst_output(net, sk, skb); + } else #endif if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) || dst_allfrag(skb_dst(skb)) || - (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size)) - return ip6_fragment(net, sk, skb, ip6_finish_output2); - else - return ip6_finish_output2(net, sk, skb); + (IP6CB(skb)->frag_max_size && skb->len > + IP6CB(skb)->frag_max_size)) { + ret = ip6_fragment(net, sk, skb, ip6_finish_output2); + } else { + ret = ip6_finish_output2(net, sk, skb); + } + return ret ? : ret_bpf; } int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb) -- 2.17.1