diff options
| author | John Fastabend <john.fastabend@gmail.com> | 2017-10-27 09:45:53 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-10-29 11:18:48 +0900 |
| commit | bfa640757e9378c2f26867e723f1287e94f5a7ad (patch) | |
| tree | 927d92a4bf5018b3f82f4943fd9ee6a657c3a4e9 /include | |
| parent | 8108a77515126f6db4374e8593956e20430307c0 (diff) | |
| download | linux-bfa640757e9378c2f26867e723f1287e94f5a7ad.tar.gz linux-bfa640757e9378c2f26867e723f1287e94f5a7ad.tar.bz2 linux-bfa640757e9378c2f26867e723f1287e94f5a7ad.zip | |
bpf: rename sk_actions to align with bpf infrastructure
Recent additions to support multiple programs in cgroups impose
a strict requirement, "all yes is yes, any no is no". To enforce
this the infrastructure requires the 'no' return code, SK_DROP in
this case, to be 0.
To apply these rules to SK_SKB program types the sk_actions return
codes need to be adjusted.
This fix adds SK_PASS and makes 'SK_DROP = 0'. Finally, remove
SK_ABORTED to remove any chance that the API may allow aborted
program flows to be passed up the stack. This would be incorrect
behavior and allow programs to break existing policies.
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
| -rw-r--r-- | include/uapi/linux/bpf.h | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index f90860d1f897..0d7948ce2128 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -575,7 +575,7 @@ union bpf_attr { * @map: pointer to sockmap * @key: key to lookup sock in map * @flags: reserved for future use - * Return: SK_REDIRECT + * Return: SK_PASS * * int bpf_sock_map_update(skops, map, key, flags) * @skops: pointer to bpf_sock_ops @@ -786,8 +786,8 @@ struct xdp_md { }; enum sk_action { - SK_ABORTED = 0, - SK_DROP, + SK_DROP = 0, + SK_PASS, SK_REDIRECT, }; |