Commit 822fe617 authored by Stanislav Fomichev's avatar Stanislav Fomichev Committed by Daniel Borkmann
Browse files

net/flow_dissector: pass flow_keys->n_proto to BPF programs 



This is a preparation for the next commit that would prohibit access to
the most fields of __sk_buff from the BPF programs.

Instead of requiring BPF flow dissector programs to look into skb,
pass all input data in the flow_keys.

Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 2c3af7d9

net/core/flow_dissector.c

+1 −0
Original line number Diff line number Diff line
@@ -707,6 +707,7 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog, 
	/* Pass parameters to the BPF program */

	memset(flow_keys, 0, sizeof(*flow_keys));

	cb->qdisc_cb.flow_keys = flow_keys;

	flow_keys->n_proto = skb->protocol;

	flow_keys->nhoff = skb_network_offset(skb);

	flow_keys->thoff = flow_keys->nhoff;

tools/testing/selftests/bpf/progs/bpf_flow.c

+4 −2
Original line number Diff line number Diff line
@@ -92,7 +92,6 @@ static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto) 
{

	struct bpf_flow_keys *keys = skb->flow_keys;



	keys->n_proto = proto;

	switch (proto) {

	case bpf_htons(ETH_P_IP):

		bpf_tail_call(skb, &jmp_table, IP);
@@ -119,7 +118,9 @@ static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto) 
SEC("flow_dissector")

int _dissect(struct __sk_buff *skb)

{

	return parse_eth_proto(skb, skb->protocol);

	struct bpf_flow_keys *keys = skb->flow_keys;



	return parse_eth_proto(skb, keys->n_proto);

}



/* Parses on IPPROTO_* */
@@ -358,6 +359,7 @@ PROG(VLAN)(struct __sk_buff *skb) 
	    vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q))

		return BPF_DROP;



	keys->n_proto = vlan->h_vlan_encapsulated_proto;

	return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto);

}