Often cls_bpf classifier is used with single action drop attached. Optimize this use case and let cls_bpf return both classid and action. For backwards compatibility reasons enable this feature under TCA_BPF_FLAG_ACT_DIRECT flag. Then more interesting programs like the following are easier to write: int cls_bpf_prog(struct __sk_buff *skb) { /* classify arp, ip, ipv6 into different traffic classes * and drop all other packets */ switch (skb->protocol) { case htons(ETH_P_ARP): skb->tc_classid = 1; break; case htons(ETH_P_IP): skb->tc_classid = 2; break; case htons(ETH_P_IPV6): skb->tc_classid = 3; break; default: return TC_ACT_SHOT; } return TC_ACT_OK; } Joint work with Daniel Borkmann.
Showing the changes to include/uapi (2 of 5 files). Show all
Unified · Split
| @@ -293,6 +293,7 @@ struct __sk_buff { · 292 unmodified lines | ||
| 293 | 293 | __u32 tc_index; |
| 294 | 294 | __u32 cb[5]; |
| 295 | 295 | __u32 hash; |
| 296 | + __u32 tc_classid; | |
| 296 | 297 | }; |
| 297 | 298 | |
| 298 | 299 | struct bpf_tunnel_key { |
| @@ -373,6 +373,8 @@ enum { · 372 unmodified lines | ||
| 373 | 373 | |
| 374 | 374 | /* BPF classifier */ |
| 375 | 375 | |
| 376 | +#define TCA_BPF_FLAG_ACT_DIRECT (1 << 0) | |
| 377 | + | |
| 376 | 378 | enum { |
| 377 | 379 | TCA_BPF_UNSPEC, |
| 378 | 380 | TCA_BPF_ACT, |
| @@ -382,6 +384,7 @@ enum { · 3 unmodified lines | ||
| 382 | 384 | TCA_BPF_OPS, |
| 383 | 385 | TCA_BPF_FD, |
| 384 | 386 | TCA_BPF_NAME, |
| 387 | + TCA_BPF_FLAGS, | |
| 385 | 388 | __TCA_BPF_MAX, |
| 386 | 389 | }; |
| 387 | 390 | |