skb: make drop reason booleanable

We have a number of cases where function returns drop/no drop
decision as a boolean. Now that we want to report the reason
code as well we have to pass extra output arguments.

We can make the reason code evaluate correctly as bool.

I believe we're good to reorder the reasons as they are
reported to user space as strings.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 34f572271c0c6ea6275b8f3083cf576c8a4cbefd..26538ceb4b01ed61bf5be57f302ce03b4453998e 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -314,6 +314,7 @@ struct sk_buff;
  * used to translate the reason to string.
  */
 enum skb_drop_reason {
+       SKB_NOT_DROPPED_YET = 0,
        SKB_DROP_REASON_NOT_SPECIFIED,  /* drop reason is not specified */
        SKB_DROP_REASON_NO_SOCKET,      /* socket not found */
        SKB_DROP_REASON_PKT_TOO_SMALL,  /* packet size is too small */

diff --git a/include/net/tcp.h b/include/net/tcp.h
index d486d7b6112dcce4596babb67090f7dc05183cb1..ee8237b58e1d370310f598c7fd0f6b1a8965931c 100644 (file)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1674,10 +1674,11 @@ tcp_md5_do_lookup(const struct sock *sk, int l3index,
                return NULL;
        return __tcp_md5_do_lookup(sk, l3index, addr, family);
 }
-bool tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
-                         enum skb_drop_reason *reason,
-                         const void *saddr, const void *daddr,
-                         int family, int dif, int sdif);
+
+enum skb_drop_reason
+tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
+                    const void *saddr, const void *daddr,
+                    int family, int dif, int sdif);
 
 
 #define tcp_twsk_md5_key(twsk) ((twsk)->tw_md5_key)
@@ -1688,13 +1689,13 @@ tcp_md5_do_lookup(const struct sock *sk, int l3index,
 {
        return NULL;
 }
-static inline bool tcp_inbound_md5_hash(const struct sock *sk,
-                                       const struct sk_buff *skb,
-                                       enum skb_drop_reason *reason,
-                                       const void *saddr, const void *daddr,
-                                       int family, int dif, int sdif)
+
+static inline enum skb_drop_reason
+tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
+                    const void *saddr, const void *daddr,
+                    int family, int dif, int sdif);
 {
-       return false;
+       return SKB_NOT_DROPPED_YET;
 }
 #define tcp_twsk_md5_key(twsk) NULL
 #endif

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 33f20134e3f19c1cd8a4046a2f88533693a9a912..b5f032958b2cc42e87c8290facba3f9d08d53db0 100644 (file)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -4434,10 +4434,10 @@ int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *ke
 EXPORT_SYMBOL(tcp_md5_hash_key);
 
 /* Called with rcu_read_lock() */
-bool tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
-                         enum skb_drop_reason *reason,
-                         const void *saddr, const void *daddr,
-                         int family, int dif, int sdif)
+enum skb_drop_reason
+tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
+                    const void *saddr, const void *daddr,
+                    int family, int dif, int sdif)
 {
        /*
         * This gets called for each TCP segment that arrives
@@ -4464,18 +4464,16 @@ bool tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
 
        /* We've parsed the options - do we have a hash? */
        if (!hash_expected && !hash_location)
-               return false;
+               return SKB_NOT_DROPPED_YET;
 
        if (hash_expected && !hash_location) {
-               *reason = SKB_DROP_REASON_TCP_MD5NOTFOUND;
                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
-               return true;
+               return SKB_DROP_REASON_TCP_MD5NOTFOUND;
        }
 
        if (!hash_expected && hash_location) {
-               *reason = SKB_DROP_REASON_TCP_MD5UNEXPECTED;
                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
-               return true;
+               return SKB_DROP_REASON_TCP_MD5UNEXPECTED;
        }
 
        /* check the signature */
@@ -4483,7 +4481,6 @@ bool tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
                                                 NULL, skb);
 
        if (genhash || memcmp(hash_location, newhash, 16) != 0) {
-               *reason = SKB_DROP_REASON_TCP_MD5FAILURE;
                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
                if (family == AF_INET) {
                        net_info_ratelimited("MD5 Hash failed for (%pI4, %d)->(%pI4, %d)%s L3 index %d\n",
@@ -4497,9 +4494,9 @@ bool tcp_inbound_md5_hash(const struct sock *sk, const struct sk_buff *skb,
                                        saddr, ntohs(th->source),
                                        daddr, ntohs(th->dest), l3index);
                }
-               return true;
+               return SKB_DROP_REASON_TCP_MD5FAILURE;
        }
-       return false;
+       return SKB_NOT_DROPPED_YET;
 }
 EXPORT_SYMBOL(tcp_inbound_md5_hash);
 

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 411357ad9757585ccdd20a1a4756eff057795644..81694a354110640fb6c4013bd45d01bef623a8ab 100644 (file)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1965,9 +1965,10 @@ process:
                struct sock *nsk;
 
                sk = req->rsk_listener;
-               if (unlikely(tcp_inbound_md5_hash(sk, skb, &drop_reason,
-                                                 &iph->saddr, &iph->daddr,
-                                                 AF_INET, dif, sdif))) {
+               drop_reason = tcp_inbound_md5_hash(sk, skb,
+                                                  &iph->saddr, &iph->daddr,
+                                                  AF_INET, dif, sdif);
+               if (unlikely(drop_reason)) {
                        sk_drops_add(sk, skb);
                        reqsk_put(req);
                        goto discard_it;
@@ -2041,8 +2042,9 @@ process:
                goto discard_and_relse;
        }
 
-       if (tcp_inbound_md5_hash(sk, skb, &drop_reason, &iph->saddr,
-                                &iph->daddr, AF_INET, dif, sdif))
+       drop_reason = tcp_inbound_md5_hash(sk, skb, &iph->saddr,
+                                          &iph->daddr, AF_INET, dif, sdif);
+       if (drop_reason)
                goto discard_and_relse;
 
        nf_reset_ct(skb);

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index cb2bb7d2e9078c8a7463c00d70aa833eeaab25d3..13678d3908fac9990e5b0c0df87fa4cca685baaf 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1632,8 +1632,10 @@ process:
                struct sock *nsk;
 
                sk = req->rsk_listener;
-               if (tcp_inbound_md5_hash(sk, skb, &drop_reason, &hdr->saddr,
-                                        &hdr->daddr, AF_INET6, dif, sdif)) {
+               drop_reason = tcp_inbound_md5_hash(sk, skb,
+                                                  &hdr->saddr, &hdr->daddr,
+                                                  AF_INET6, dif, sdif);
+               if (drop_reason) {
                        sk_drops_add(sk, skb);
                        reqsk_put(req);
                        goto discard_it;
@@ -1704,8 +1706,9 @@ process:
                goto discard_and_relse;
        }
 
-       if (tcp_inbound_md5_hash(sk, skb, &drop_reason, &hdr->saddr,
-                                &hdr->daddr, AF_INET6, dif, sdif))
+       drop_reason = tcp_inbound_md5_hash(sk, skb, &hdr->saddr, &hdr->daddr,
+                                          AF_INET6, dif, sdif);
+       if (drop_reason)
                goto discard_and_relse;
 
        if (tcp_filter(sk, skb)) {