bpf: rename sk_actions to align with bpf infrastructure

Recent additions to support multiple programs in cgroups impose
a strict requirement, "all yes is yes, any no is no". To enforce
this the infrastructure requires the 'no' return code, SK_DROP in
this case, to be 0.

To apply these rules to SK_SKB program types the sk_actions return
codes need to be adjusted.

This fix adds SK_PASS and makes 'SK_DROP = 0'. Finally, remove
SK_ABORTED to remove any chance that the API may allow aborted
program flows to be passed up the stack. This would be incorrect
behavior and allow programs to break existing policies.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index f90860d1f8979e03b10063a04179bed44c137e5a..0d7948ce21282ad01e340d018f8dfcf811dca26b 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -575,7 +575,7 @@ union bpf_attr {
  *     @map: pointer to sockmap
  *     @key: key to lookup sock in map
  *     @flags: reserved for future use
- *     Return: SK_REDIRECT
+ *     Return: SK_PASS
  *
  * int bpf_sock_map_update(skops, map, key, flags)
  *     @skops: pointer to bpf_sock_ops
@@ -786,8 +786,8 @@ struct xdp_md {
 };
 
 enum sk_action {
-       SK_ABORTED = 0,
-       SK_DROP,
+       SK_DROP = 0,
+       SK_PASS,
        SK_REDIRECT,
 };
 

diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 6778fb77393406c5a2dac4397bc1bb341850f19f..66f00a2b27f44af12362ae3c8df2fbca4d82edce 100644 (file)
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -122,7 +122,8 @@ static int smap_verdict_func(struct smap_psock *psock, struct sk_buff *skb)
        preempt_enable();
        skb->sk = NULL;
 
-       return rc;
+       return rc == SK_PASS ?
+               (TCP_SKB_CB(skb)->bpf.map ? SK_REDIRECT : SK_PASS) : SK_DROP;
 }
 
 static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb)

diff --git a/net/core/filter.c b/net/core/filter.c
index 68eaa2f81a8ea9595627e3cd7bce5d42c1397dda..6ae94f825f72eb810b5252e10dd89cae66f8cbef 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1844,14 +1844,15 @@ BPF_CALL_4(bpf_sk_redirect_map, struct sk_buff *, skb,
 {
        struct tcp_skb_cb *tcb = TCP_SKB_CB(skb);
 
+       /* If user passes invalid input drop the packet. */
        if (unlikely(flags))
-               return SK_ABORTED;
+               return SK_DROP;
 
        tcb->bpf.key = key;
        tcb->bpf.flags = flags;
        tcb->bpf.map = map;
 
-       return SK_REDIRECT;
+       return SK_PASS;
 }
 
 struct sock *do_sk_redirect_map(struct sk_buff *skb)

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 24b35a1fd4d67eebf65e4dc83faaaacca9d2e1fb..c174971afbe657d2523503b94a3a2c960a6cf9e1 100644 (file)
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -787,8 +787,8 @@ struct xdp_md {
 };
 
 enum sk_action {
-       SK_ABORTED = 0,
-       SK_DROP,
+       SK_DROP = 0,
+       SK_PASS,
        SK_REDIRECT,
 };