Often cls_bpf classifier is used with single action drop attached. Optimize this use case and let cls_bpf return both classid and action. For backwards compatibility reasons enable this feature under TCA_BPF_FLAG_ACT_DIRECT flag. Then more interesting programs like the following are easier to write: int cls_bpf_prog(struct __sk_buff *skb) { /* classify arp, ip, ipv6 into different traffic classes * and drop all other packets */ switch (skb->protocol) { case htons(ETH_P_ARP): skb->tc_classid = 1; break; case htons(ETH_P_IP): skb->tc_classid = 2; break; case htons(ETH_P_IPV6): skb->tc_classid = 3; break; default: return TC_ACT_SHOT; } return TC_ACT_OK; } Joint work with Daniel Borkmann.
Showing the changes to include/uapi (2 of 5 files). Show all
Unified · Split
| @@ -293,6 +293,7 @@ struct __sk_buff { · 292 unmodified lines | |||
| 293 | __u32 tc_index; | 293 | __u32 tc_index; |
| 294 | __u32 cb[5]; | 294 | __u32 cb[5]; |
| 295 | __u32 hash; | 295 | __u32 hash; |
| 296 | __u32 tc_classid; | ||
| 296 | }; | 297 | }; |
| 297 | 298 | ||
| 298 | struct bpf_tunnel_key { | 299 | struct bpf_tunnel_key { |
| @@ -373,6 +373,8 @@ enum { · 372 unmodified lines | |||
| 373 | 373 | ||
| 374 | /* BPF classifier */ | 374 | /* BPF classifier */ |
| 375 | 375 | ||
| 376 | #define TCA_BPF_FLAG_ACT_DIRECT (1 << 0) | ||
| 377 | |||
| 376 | enum { | 378 | enum { |
| 377 | TCA_BPF_UNSPEC, | 379 | TCA_BPF_UNSPEC, |
| 378 | TCA_BPF_ACT, | 380 | TCA_BPF_ACT, |
| @@ -382,6 +384,7 @@ enum { · 3 unmodified lines | |||
| 382 | TCA_BPF_OPS, | 384 | TCA_BPF_OPS, |
| 383 | TCA_BPF_FD, | 385 | TCA_BPF_FD, |
| 384 | TCA_BPF_NAME, | 386 | TCA_BPF_NAME, |
| 387 | TCA_BPF_FLAGS, | ||
| 385 | __TCA_BPF_MAX, | 388 | __TCA_BPF_MAX, |
| 386 | }; | 389 | }; |
| 387 | 390 | ||