{"id":2225112,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2225112/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260420105816.72168-4-mahe.tardy@gmail.com/","project":{"id":26,"url":"http://patchwork.ozlabs.org/api/1.1/projects/26/?format=json","name":"Netfilter Development","link_name":"netfilter-devel","list_id":"netfilter-devel.vger.kernel.org","list_email":"netfilter-devel@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null},"msgid":"<20260420105816.72168-4-mahe.tardy@gmail.com>","date":"2026-04-20T10:58:13","name":"[bpf-next,v4,3/6] bpf: add bpf_icmp_send_unreach kfunc","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"09e3ea205598758faadc4481ca93c5f7a9a98c5c","submitter":{"id":91349,"url":"http://patchwork.ozlabs.org/api/1.1/people/91349/?format=json","name":"Mahe Tardy","email":"mahe.tardy@gmail.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260420105816.72168-4-mahe.tardy@gmail.com/mbox/","series":[{"id":500597,"url":"http://patchwork.ozlabs.org/api/1.1/series/500597/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=500597","date":"2026-04-20T10:58:10","name":"bpf: add icmp_send_unreach kfunc","version":4,"mbox":"http://patchwork.ozlabs.org/series/500597/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2225112/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2225112/checks/","tags":{},"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=kuwejd4m;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12042-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=\"kuwejd4m\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=209.85.128.52","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=gmail.com"],"Received":["from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fzjCw3STwz1yGs\n\tfor ; Mon, 20 Apr 2026 20:59:08 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id 34B5C301977E\n\tfor ; Mon, 20 Apr 2026 10:58:50 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 280B839DBDA;\n\tMon, 20 Apr 2026 10:58:36 +0000 (UTC)","from mail-wm1-f52.google.com (mail-wm1-f52.google.com\n [209.85.128.52])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id A66BB39B976\n\tfor ; Mon, 20 Apr 2026 10:58:33 +0000 (UTC)","by mail-wm1-f52.google.com with SMTP id\n 5b1f17b1804b1-4891f625344so6812145e9.0\n for ;\n Mon, 20 Apr 2026 03:58:33 -0700 (PDT)","from mtardy-friendly-lvh-runner.local ([2600:1900:4010:1a8::])\n by smtp.googlemail.com with ESMTPSA id\n 5b1f17b1804b1-488fc1cfbf2sm290929495e9.15.2026.04.20.03.58.31\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Mon, 20 Apr 2026 03:58:31 -0700 (PDT)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776682715; cv=none;\n b=cTiOSa1Wvjs9/RkG5XlV2OzYJw5xvCzbnjuRV4e91hS/VKbMrq8SVeVQLhxcYvRtO1Cv2f9b1I9OkX9dZa2n9ldY0EWQvCjTUB5VJvLdI2L0V28Z24FdAyyATpKypaabFYjUhELwgWrdWXLbpMVfHIg5qNFFuAgtwRcSUBKDTs8=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776682715; c=relaxed/simple;\n\tbh=tGFWlJ9Emn6lMayfM7X7YT7f2+X67E/6qliDHAALv6U=;\n\th=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:\n\t MIME-Version;\n b=H1t9oJLPKpP6NfomjB106A3uX6FIio6kY19L/veT6EzJ9Vi0X3b/La4tNpnPr232vNFs/yPdW5L83ajQueELPdunbPLJdoKMbAwfPg+3QHRHw2g9X5vr7ltZiIzasFEifPBO4kH2OGTpJV32xw0MX1z99Inc2XxeZ0VL8GRfFyQ=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com;\n spf=pass smtp.mailfrom=gmail.com;\n dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=kuwejd4m; arc=none smtp.client-ip=209.85.128.52","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1776682712; x=1777287512;\n darn=vger.kernel.org;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=Xo1ra+dvGbFs6OJejHFLsiY9EUjfbBrgYOeoScEsTuc=;\n b=kuwejd4m+mq5a0aewiDuTaXsOZPk0oZtw4A9PqEl9cdOeyrCJulozNifgRHjgsakvg\n CZGT+PgRajEUScOTjIOmPqvTI1JSscnGehNWVDRog2tPhK+q9O+7Ybe9XOLneMZ9k4AQ\n oLyan1IdB6e6f4AYH1xLaFO6082Ts4FzhyyNaq7QgkH1TdtkKkbB3/IXVwHVdP/CWDVO\n rsb5tpeLWk+sYMEnorzbNNB56vyv+vDQfj76Q/AuWSx+9WnR5fYJowZryjZdCS+2CgVY\n huyGvi7YJlHxWHOMdv+TTs1tcHo/WZ2ZYGL3kKVRcEPF5l8dibk3daJXrBW+zD4bykei\n zt1Q==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776682712; x=1777287512;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=Xo1ra+dvGbFs6OJejHFLsiY9EUjfbBrgYOeoScEsTuc=;\n b=ZoNHuerj1y31Cce/08RmiD5vuJ4n63+UEAXpLxROs/osQiT7RtWEzV0eJdNnq0q3vZ\n 9ShAxmsLtGIwWeEcltjwjXPufftbSFEUomhmdFRcMjN+n/sPO3/P5s8+UE1qqrcna4zV\n FaqcVlEC8PflYqXUzDEbhUx2GiUjvuzSdfHprJv4w3RKMoANw333flANETT72rHZexQz\n I6l4hOIagpAYoY4k9ckwoHaH+TtOAN3vjggYnveY7sOJqaS9s2GxBKQIfdc8I/kHz771\n Ww3I+sikrElkPESIXMMkPmqi8pLoOsPK7JP+s1P61O4jhpmT2+BOTBRhGYw06f4NPfQ9\n oo8Q==","X-Forwarded-Encrypted":"i=1;\n AFNElJ+q6n/ECCRV69dWjc9rPlL3ivOmYMdycl0niubTQu7vCASU6QqVc1FsEUhoE0FIxhVgU++VaWdP4OZOnnBUngs=@vger.kernel.org","X-Gm-Message-State":"AOJu0YwRLCG+v4KmXzZSNSbRZjH/OSZEVDwI2raw5Q9qkRCpUb5YzQ5D\n\tM43dK7UhkKiE2QbAI16XL3Ux7dq+PO2rH+4RLTyDS2AMFSUHUj4KEu9D","X-Gm-Gg":"AeBDietBRrQI5KC7M1qju2mzwHwQDlIlrvpPDYncTWMc9d21aJN0EL1wGybD3TC7Ycu\n\t9ca9SbzLWA4GK3Y3PMg3OCCT3N4hkBI1/KvGst0GijmKuujKBu4LzNjcRywD0H3rKKHKvUpe53I\n\tkdhdHOxAQwJDz7gTo0AYd/jtlVn5anyjZpDOPrjFQa6l6Eir8wwuuckdR8b+Ta+sgGjLUiBGNex\n\tEH30NUlE1la945JTc49rThvFUS6GbjziJ5SXrerSfeN/UhvIWo0eZP2/OWvsRrRV+yt6ZttCQkq\n\tBVZ4XNvV2ZFMz5aYSIQcC5xP4WOgR2hY3/7WZAnvSCegDhUrjgd/hcPURq8TagTEpIf7W1D9NSb\n\tzxzG9l7WayI6i03PtKxx3ho7aobXa/WPGeFncu0XSdF/+WV7ttGZjni9maikBNWbGAd3rW0WW3l\n\ti6/uidddHGTEA4pUjpFW2CgDF3xH5Wf6vW26l1lg==","X-Received":"by 2002:a05:600c:870e:b0:488:aa33:dc8f with SMTP id\n 5b1f17b1804b1-488fb84ffb8mr180290575e9.0.1776682711829;\n Mon, 20 Apr 2026 03:58:31 -0700 (PDT)","From":"Mahe Tardy ","To":"mahe.tardy@gmail.com","Cc":"alexei.starovoitov@gmail.com,\n\tandrii@kernel.org,\n\tast@kernel.org,\n\tbpf@vger.kernel.org,\n\tcoreteam@netfilter.org,\n\tdaniel@iogearbox.net,\n\tfw@strlen.de,\n\tjohn.fastabend@gmail.com,\n\tlkp@intel.com,\n\tmartin.lau@linux.dev,\n\tnetdev@vger.kernel.org,\n\tnetfilter-devel@vger.kernel.org,\n\toe-kbuild-all@lists.linux.dev,\n\tpablo@netfilter.org","Subject":"[PATCH bpf-next v4 3/6] bpf: add bpf_icmp_send_unreach kfunc","Date":"Mon, 20 Apr 2026 10:58:13 +0000","Message-Id":"<20260420105816.72168-4-mahe.tardy@gmail.com>","X-Mailer":"git-send-email 2.34.1","In-Reply-To":"<20260420105816.72168-1-mahe.tardy@gmail.com>","References":"\n <20260420105816.72168-1-mahe.tardy@gmail.com>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit"},"content":"This is needed in the context of Tetragon to provide improved feedback\n(in contrast to just dropping packets) to east-west traffic when blocked\nby policies using cgroup_skb programs.\n\nThis reuse concepts from netfilter reject target codepath with the\ndifferences that:\n* Packets are cloned since the BPF user can still let the packet pass\n (SK_PASS from the cgroup_skb progs for example) and the current skb\n need to stay untouched (cgroup_skb hooks only allow read-only skb\n payload). The kfunc set the dst of the cloned skb by using the saddr\n as the daddr and routing it.\n* Checksums are not computed or verified and IPv4 fragmentation is not\n checked early (icmp_send will check).\n* We protect against recursion since the kfunc, by generating an ICMP\n error message could retrigger the BPF prog that invoked it.\n\nSigned-off-by: Mahe Tardy \n---\n net/core/filter.c | 85 +++++++++++++++++++++++++++++++++++++++++++++++\n 1 file changed, 85 insertions(+)\n\n--\n2.34.1","diff":"diff --git a/net/core/filter.c b/net/core/filter.c\nindex fcfcb72663ca..a6c3b9145c93 100644\n--- a/net/core/filter.c\n+++ b/net/core/filter.c\n@@ -84,6 +84,10 @@\n #include \n #include \n #include \n+#include \n+#include \n+#include \n+#include \n\n #include \"dev.h\"\n\n@@ -12423,6 +12427,86 @@ __bpf_kfunc int bpf_xdp_pull_data(struct xdp_md *x, u32 len)\n \treturn 0;\n }\n\n+static DEFINE_PER_CPU(bool, bpf_icmp_send_in_progress);\n+\n+/**\n+ * bpf_icmp_send_unreach - Send ICMP destination unreachable error\n+ * @skb: Packet that triggered the error\n+ * @code: ICMP unreachable code (0-15 for IPv4, 0-6 for IPv6)\n+ *\n+ * Sends an ICMP destination unreachable message in response to the\n+ * packet. The original packet is cloned before sending the ICMP error,\n+ * so the BPF program can still let the packet pass if desired.\n+ *\n+ * Recursion protection: If called from a context that would trigger\n+ * recursion (e.g., root cgroup processing its own ICMP packets),\n+ * returns -EBUSY on re-entry.\n+ *\n+ * Return: 0 on success, negative error code on failure:\n+ * -EINVAL: Invalid code parameter\n+ * -ENOMEM: Memory allocation failed\n+ * -EHOSTUNREACH: Routing lookup failed\n+ * -EBUSY: Recursion detected\n+ * -EPROTONOSUPPORT: Non-IP protocol\n+ */\n+__bpf_kfunc int bpf_icmp_send_unreach(struct __sk_buff *__skb, int code)\n+{\n+\tstruct sk_buff *skb = (struct sk_buff *)__skb;\n+\tstruct sk_buff *nskb;\n+\tbool *in_progress;\n+\n+\tin_progress = this_cpu_ptr(&bpf_icmp_send_in_progress);\n+\tif (*in_progress)\n+\t\treturn -EBUSY;\n+\n+\tswitch (skb->protocol) {\n+#if IS_ENABLED(CONFIG_INET)\n+\tcase htons(ETH_P_IP):\n+\t\tif (code < 0 || code > NR_ICMP_UNREACH)\n+\t\t\treturn -EINVAL;\n+\n+\t\tnskb = skb_clone(skb, GFP_ATOMIC);\n+\t\tif (!nskb)\n+\t\t\treturn -ENOMEM;\n+\n+\t\tif (!skb_dst(nskb) && ip_route_reply_fetch_dst(nskb) < 0) {\n+\t\t\tkfree_skb(nskb);\n+\t\t\treturn -EHOSTUNREACH;\n+\t\t}\n+\n+\t\t*in_progress = true;\n+\t\ticmp_send(nskb, ICMP_DEST_UNREACH, code, 0);\n+\t\t*in_progress = false;\n+\t\tkfree_skb(nskb);\n+\t\tbreak;\n+#endif\n+#if IS_ENABLED(CONFIG_IPV6)\n+\tcase htons(ETH_P_IPV6):\n+\t\tif (code < 0 || code > ICMPV6_REJECT_ROUTE)\n+\t\t\treturn -EINVAL;\n+\n+\t\tnskb = skb_clone(skb, GFP_ATOMIC);\n+\t\tif (!nskb)\n+\t\t\treturn -ENOMEM;\n+\n+\t\tif (!skb_dst(nskb) && ip6_route_reply_fetch_dst(nskb) < 0) {\n+\t\t\tkfree_skb(nskb);\n+\t\t\treturn -EHOSTUNREACH;\n+\t\t}\n+\n+\t\t*in_progress = true;\n+\t\ticmpv6_send(nskb, ICMPV6_DEST_UNREACH, code, 0);\n+\t\t*in_progress = false;\n+\t\tkfree_skb(nskb);\n+\t\tbreak;\n+#endif\n+\tdefault:\n+\t\treturn -EPROTONOSUPPORT;\n+\t}\n+\n+\treturn 0;\n+}\n+\n __bpf_kfunc_end_defs();\n\n int bpf_dynptr_from_skb_rdonly(struct __sk_buff *skb, u64 flags,\n@@ -12442,6 +12526,7 @@ int bpf_dynptr_from_skb_rdonly(struct __sk_buff *skb, u64 flags,\n\n BTF_KFUNCS_START(bpf_kfunc_check_set_skb)\n BTF_ID_FLAGS(func, bpf_dynptr_from_skb)\n+BTF_ID_FLAGS(func, bpf_icmp_send_unreach)\n BTF_KFUNCS_END(bpf_kfunc_check_set_skb)\n\n BTF_KFUNCS_START(bpf_kfunc_check_set_skb_meta)\n","prefixes":["bpf-next","v4","3/6"]}