diff options
| author | David S. Miller <davem@davemloft.net> | 2017-10-20 14:01:30 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-10-20 14:01:30 +0200 |
| commit | e95c6cf447ecac5ab5bc38600e1d2ac7b3d54aae (patch) | |
| tree | 52d1bcf9c1257a973d3a78cdf54d0d6f005df705 /include | |
| parent | sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect (diff) | |
| parent | bpf: require CAP_NET_ADMIN when using devmap (diff) | |
| download | linux-e95c6cf447ecac5ab5bc38600e1d2ac7b3d54aae.tar.xz linux-e95c6cf447ecac5ab5bc38600e1d2ac7b3d54aae.zip | |
Merge branch 'sockmap-fixes'
John Fastabend says:
====================
sockmap fixes for net
The following implements a set of fixes for sockmap and changes the
API slightly in a few places to reduce preempt_disable/enable scope.
We do this here in net because it requires an API change and this
avoids getting stuck with legacy API going forward.
The short description:
Access to skb mark is removed, it is problematic when we add
features in the future because mark is a union and used by the
TCP/socket code internally. We don't want to expose this to the
BPF programs or let programs change the values.
The other change is caching metadata in the skb itself between
when the BPF program returns a redirect code and the core code
implements the redirect. This avoids having per cpu metadata.
Finally, tighten restriction on using sockmap to CAP_NET_ADMIN and
only SOCK_STREAM sockets.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/filter.h | 2 | ||||
| -rw-r--r-- | include/net/tcp.h | 5 |
2 files changed, 6 insertions, 1 deletions
diff --git a/include/linux/filter.h b/include/linux/filter.h index d29e58fde364..818a0b26249e 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -728,7 +728,7 @@ void xdp_do_flush_map(void); void bpf_warn_invalid_xdp_action(u32 act); void bpf_warn_invalid_xdp_redirect(u32 ifindex); -struct sock *do_sk_redirect_map(void); +struct sock *do_sk_redirect_map(struct sk_buff *skb); #ifdef CONFIG_BPF_JIT extern int bpf_jit_enable; diff --git a/include/net/tcp.h b/include/net/tcp.h index 89974c5286d8..b1ef98ebce53 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -840,6 +840,11 @@ struct tcp_skb_cb { struct inet6_skb_parm h6; #endif } header; /* For incoming skbs */ + struct { + __u32 key; + __u32 flags; + struct bpf_map *map; + } bpf; }; }; |