aya-ebpf: TcContext, SkBuff: add set_tc_classid#1595
Open
ramos-99 wants to merge 1 commit into
Open
Conversation
Expose set_tc_classid on TcContext and SkBuff so TC classifier programs can set the skb TC class identifier, enabling packet steering to HTB/CBQ traffic-control classes. set_tc_classid is write-only by design: the BPF verifier rejects reads of __sk_buff::tc_classid for sched_cls and sched_act program types, so no getter is provided. The method is not added to SkBuffContext because the BPF verifier rejects writes to tc_classid from cgroup_skb, socket_filter and sk_skb program types. The integration test loads a classifier that calls set_tc_classid and runs it via BPF_PROG_TEST_RUN to confirm the BPF verifier accepts the write. Verifying the written value through ctx_out is not possible for sched_cls programs: the kernel does not populate ctx_out for that program type (ctx_size_out is always 0). Refs: aya-rs#886 Co-authored-by: Afonso Quintas <afonso.quintas@tecnico.ulisboa.pt>
✅ Deploy Preview for aya-rs-docs ready!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1571, which added
classidtoSchedClassifiernetlinkattach, setting
TCA_BPF_CLASSID(the upper 16 bits of the class adirect-action program routes to). The lower 16 bits are written by the
program into
__sk_buff::tc_classid, but there was no safe way to writethat field from aya-ebpf, so a classifier had to go through a raw pointer
to the skb. This adds
set_tc_classidonTcContextandSkBuff.The field is write-only and only available on
TcContext. The verifiermarks
__sk_buff::tc_classidwrite-only forsched_cls/sched_act, soa getter can't load, and it rejects writes from the program types behind
SkBuffContext(cgroup_skb,socket_filter,sk_skb), so the setterwould compile but fail to load there.
The integration test runs a classifier through
BPF_PROG_TEST_RUNtoconfirm the verifier accepts the write. It can't check routing: the
kernel leaves
ctx_size_outat0forsched_cls, same astest_classifier_test_run. That part was verified manually by attachinga classifier on
lounder an HTB qdisc and confirming packets are routedto the class the program writes.
Refs: #886
Added/updated tests?
Checklist
cargo +nightly fmt.cargo test.cargo xtask public-api --bless.This change is