On 11/28/18 5:22 PM, Peter Oskolkov wrote:
> diff --git a/net/core/filter.c b/net/core/filter.c
> index bd0df75dc7b6..17f3c37218e5 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -4793,6 +4793,60 @@ static int bpf_push_seg6_encap(struct sk_buff *skb,
> u32 type, void *hdr, u32 len
> }
> #endif /* CONFIG_IPV6_SEG6_BPF */
>
> +static int bpf_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len)
> +{
> + struct dst_entry *dst;
> + struct rtable *rt;
> + struct iphdr *iph;
> + struct net *net;
> + int err;
> +
> + if (skb->protocol != htons(ETH_P_IP))
> + return -EINVAL; /* ETH_P_IPV6 not yet supported */
> +
> + iph = (struct iphdr *)hdr;
> +
> + if (unlikely(len < sizeof(struct iphdr) || len >
> LWTUNNEL_MAX_ENCAP_HSIZE))
> + return -EINVAL;
> + if (unlikely(iph->version != 4 || iph->ihl * 4 > len))
> + return -EINVAL;
> +
> + if (skb->sk)
> + net = sock_net(skb->sk);
> + else {
> + net = dev_net(skb_dst(skb)->dev);
> + }
> + rt = ip_route_output(net, iph->daddr, 0, 0, 0);
That is a very limited use case. e.g., oif = 0 means you are not
considering any kind of policy routing (e.g., VRF).
