a166151cbe
For the short-term solution, lets fix bpf helper functions to use skb->mac_header relative offsets instead of skb->data in order to get the same eBPF programs with cls_bpf and act_bpf work on ingress and egress qdisc path. We need to ensure that mac_header is set before calling into programs. This is effectively the first option from below referenced discussion. More long term solution for LD_ABS|LD_IND instructions will be more intrusive but also more beneficial than this, and implemented later as it's too risky at this point in time. I.e., we plan to look into the option of moving skb_pull() out of eth_type_trans() and into netif_receive_skb() as has been suggested as second option. Meanwhile, this solution ensures ingress can be used with eBPF, too, and that we won't run into ABI troubles later. For dealing with negative offsets inside eBPF helper functions, we've implemented bpf_skb_clone_unwritable() to test for unwriteable headers. Reference: http://thread.gmane.org/gmane.linux.network/359129/focus=359694 Fixes:608cd71a9c("tc: bpf: generalize pedit action") Fixes:91bc4822c3("tc: bpf: add checksum helpers") Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
90 lines
2.2 KiB
C
90 lines
2.2 KiB
C
/*
|
|
* Linux Socket Filter Data Structures
|
|
*/
|
|
|
|
#ifndef _UAPI__LINUX_FILTER_H__
|
|
#define _UAPI__LINUX_FILTER_H__
|
|
|
|
#include <linux/compiler.h>
|
|
#include <linux/types.h>
|
|
#include <linux/bpf_common.h>
|
|
|
|
/*
|
|
* Current version of the filter code architecture.
|
|
*/
|
|
#define BPF_MAJOR_VERSION 1
|
|
#define BPF_MINOR_VERSION 1
|
|
|
|
/*
|
|
* Try and keep these values and structures similar to BSD, especially
|
|
* the BPF code definitions which need to match so you can share filters
|
|
*/
|
|
|
|
struct sock_filter { /* Filter block */
|
|
__u16 code; /* Actual filter code */
|
|
__u8 jt; /* Jump true */
|
|
__u8 jf; /* Jump false */
|
|
__u32 k; /* Generic multiuse field */
|
|
};
|
|
|
|
struct sock_fprog { /* Required for SO_ATTACH_FILTER. */
|
|
unsigned short len; /* Number of filter blocks */
|
|
struct sock_filter __user *filter;
|
|
};
|
|
|
|
/* ret - BPF_K and BPF_X also apply */
|
|
#define BPF_RVAL(code) ((code) & 0x18)
|
|
#define BPF_A 0x10
|
|
|
|
/* misc */
|
|
#define BPF_MISCOP(code) ((code) & 0xf8)
|
|
#define BPF_TAX 0x00
|
|
#define BPF_TXA 0x80
|
|
|
|
/*
|
|
* Macros for filter block array initializers.
|
|
*/
|
|
#ifndef BPF_STMT
|
|
#define BPF_STMT(code, k) { (unsigned short)(code), 0, 0, k }
|
|
#endif
|
|
#ifndef BPF_JUMP
|
|
#define BPF_JUMP(code, k, jt, jf) { (unsigned short)(code), jt, jf, k }
|
|
#endif
|
|
|
|
/*
|
|
* Number of scratch memory words for: BPF_ST and BPF_STX
|
|
*/
|
|
#define BPF_MEMWORDS 16
|
|
|
|
/* RATIONALE. Negative offsets are invalid in BPF.
|
|
We use them to reference ancillary data.
|
|
Unlike introduction new instructions, it does not break
|
|
existing compilers/optimizers.
|
|
*/
|
|
#define SKF_AD_OFF (-0x1000)
|
|
#define SKF_AD_PROTOCOL 0
|
|
#define SKF_AD_PKTTYPE 4
|
|
#define SKF_AD_IFINDEX 8
|
|
#define SKF_AD_NLATTR 12
|
|
#define SKF_AD_NLATTR_NEST 16
|
|
#define SKF_AD_MARK 20
|
|
#define SKF_AD_QUEUE 24
|
|
#define SKF_AD_HATYPE 28
|
|
#define SKF_AD_RXHASH 32
|
|
#define SKF_AD_CPU 36
|
|
#define SKF_AD_ALU_XOR_X 40
|
|
#define SKF_AD_VLAN_TAG 44
|
|
#define SKF_AD_VLAN_TAG_PRESENT 48
|
|
#define SKF_AD_PAY_OFFSET 52
|
|
#define SKF_AD_RANDOM 56
|
|
#define SKF_AD_VLAN_TPID 60
|
|
#define SKF_AD_MAX 64
|
|
|
|
#define SKF_NET_OFF (-0x100000)
|
|
#define SKF_LL_OFF (-0x200000)
|
|
|
|
#define BPF_NET_OFF SKF_NET_OFF
|
|
#define BPF_LL_OFF SKF_LL_OFF
|
|
|
|
#endif /* _UAPI__LINUX_FILTER_H__ */
|