Commit e7a3160d authored by brakmo's avatar brakmo Committed by Alexei Starovoitov
Browse files

bpf: Update __cgroup_bpf_run_filter_skb with cn 



For egress packets, __cgroup_bpf_fun_filter_skb() will now call
BPF_PROG_CGROUP_INET_EGRESS_RUN_ARRAY() instead of PROG_CGROUP_RUN_ARRAY()
in order to propagate congestion notifications (cn) requests to TCP
callers.

For egress packets, this function can return:
   NET_XMIT_SUCCESS    (0)    - continue with packet output
   NET_XMIT_DROP       (1)    - drop packet and notify TCP to call cwr
   NET_XMIT_CN         (2)    - continue with packet output and notify TCP
                                to call cwr
   -EPERM                     - drop packet

For ingress packets, this function will return -EPERM if any attached
program was found and if it returned != 1 during execution. Otherwise 0
is returned.

Signed-off-by: default avatarLawrence Brakmo <brakmo@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 5cf1e914

kernel/bpf/cgroup.c

+20 −5
Original line number Diff line number Diff line
@@ -587,8 +587,16 @@ int cgroup_bpf_prog_query(const union bpf_attr *attr, 
 * The program type passed in via @type must be suitable for network

 * filtering. No further check is performed to assert that.

 *

 * This function will return %-EPERM if any if an attached program was found

 * and if it returned != 1 during execution. In all other cases, 0 is returned.

 * For egress packets, this function can return:

 *   NET_XMIT_SUCCESS    (0)	- continue with packet output

 *   NET_XMIT_DROP       (1)	- drop packet and notify TCP to call cwr

 *   NET_XMIT_CN         (2)	- continue with packet output and notify TCP

 *				  to call cwr

 *   -EPERM			- drop packet

 *

 * For ingress packets, this function will return -EPERM if any

 * attached program was found and if it returned != 1 during execution.

 * Otherwise 0 is returned.

 */

int __cgroup_bpf_run_filter_skb(struct sock *sk,

				struct sk_buff *skb,
@@ -614,12 +622,19 @@ int __cgroup_bpf_run_filter_skb(struct sock *sk, 
	/* compute pointers for the bpf prog */

	bpf_compute_and_save_data_end(skb, &saved_data_end);



	if (type == BPF_CGROUP_INET_EGRESS) {

		ret = BPF_PROG_CGROUP_INET_EGRESS_RUN_ARRAY(

			cgrp->bpf.effective[type], skb, __bpf_prog_run_save_cb);

	} else {

		ret = BPF_PROG_RUN_ARRAY(cgrp->bpf.effective[type], skb,

					  __bpf_prog_run_save_cb);

		ret = (ret == 1 ? 0 : -EPERM);

	}

	bpf_restore_data_end(skb, saved_data_end);

	__skb_pull(skb, offset);

	skb->sk = save_sk;

	return ret == 1 ? 0 : -EPERM;



	return ret;

}

EXPORT_SYMBOL(__cgroup_bpf_run_filter_skb);

CRA Git | Maintained and supported by SUSTech CRA and CCSE