From: Paolo Abeni <pabeni@redhat.com>
To: netdev@vger.kernel.org
Cc: Jamal Hadi Salim <jhs@mojatatu.com>,
Cong Wang <xiyou.wangcong@gmail.com>,
Jiri Pirko <jiri@resnulli.us>,
Daniel Borkmann <daniel@iogearbox.net>,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
Eyal Birger <eyal.birger@gmail.com>
Subject: [PATCH net-next 1/4] tc/act: user space can't use TC_ACT_REDIRECT directly
Date: Thu, 19 Jul 2018 15:02:26 +0200 [thread overview]
Message-ID: <a8bc79d0c3488143ca1e6f1f6fa24f86fd40e8b6.1531941678.git.pabeni@redhat.com> (raw)
In-Reply-To: <cover.1531941678.git.pabeni@redhat.com>
Only cls_bpf and act_bpf can safely use such value. If a generic
action is configured by user space to return TC_ACT_REDIRECT,
the usually visible behavior is passing the skb up the stack - as
for unknown action, but, with complex configuration, more random
results can be obtained.
This patch forcefully converts TC_ACT_REDIRECT to TC_ACT_LAST + 1
at action init time, making the kernel behavior more consistent.
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
include/uapi/linux/pkt_cls.h | 1 +
net/sched/act_api.c | 5 +++++
2 files changed, 6 insertions(+)
diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index c4262d911596..7cdd62b51106 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -45,6 +45,7 @@ enum {
* the skb and act like everything
* is alright.
*/
+#define TC_ACT_LAST TC_ACT_TRAP
/* There is a special kind of actions called "extended actions",
* which need a value parameter. These have a local opcode located in
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 148a89ab789b..f6438f246dab 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -895,6 +895,11 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
}
}
+ if (a->tcfa_action == TC_ACT_REDIRECT) {
+ net_warn_ratelimited("TC_ACT_REDIRECT can't be used directly");
+ a->tcfa_action = TC_ACT_LAST + 1;
+ }
+
return a;
err_mod:
--
2.17.1
next prev parent reply other threads:[~2018-07-19 13:46 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-19 13:02 [PATCH net-next 0/4] TC: refactor act_mirred packets re-injection Paolo Abeni
2018-07-19 13:02 ` Paolo Abeni [this message]
2018-07-19 13:02 ` [PATCH net-next 2/4] tc/act: remove unneeded RCU lock in action callback Paolo Abeni
2018-07-19 13:02 ` [PATCH net-next 3/4] net/tc: introduce TC_ACT_MIRRED Paolo Abeni
2018-07-19 18:07 ` Cong Wang
2018-07-20 9:54 ` Paolo Abeni
2018-07-23 21:12 ` Cong Wang
2018-07-24 6:48 ` Paolo Abeni
2018-07-19 18:56 ` Jiri Pirko
2018-07-19 13:02 ` [PATCH net-next 4/4] act_mirred: use ACT_MIRRED when possible Paolo Abeni
2018-07-21 23:29 ` David Miller
2018-07-22 14:32 ` Paolo Abeni
-- strict thread matches above, loose matches on Subject: below --
2018-07-13 9:54 [PATCH net-next 0/4] TC: refactor TC_ACT_REDIRECT action Paolo Abeni
2018-07-13 9:54 ` [PATCH net-next 1/4] tc/act: user space can't use TC_ACT_REDIRECT directly Paolo Abeni
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a8bc79d0c3488143ca1e6f1f6fa24f86fd40e8b6.1531941678.git.pabeni@redhat.com \
--to=pabeni@redhat.com \
--cc=daniel@iogearbox.net \
--cc=eyal.birger@gmail.com \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=marcelo.leitner@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.