Keeping in mind that this kfunc is not a necessity for other prog types which can already overwrite packets, like TC. > If restriction is necessary then I guess we can live with extra > bpf_kfunc_set_icmp_send_unreach, though it's odd to create a set > just for one kfunc. > Either way don't change the last 'return ...' line in this file. > Add 'ret = ret ?: register...' instead to reduce churn. > > Also cc netdev and netfilter maintainers in v2. Yes to both. Aside, could I have your opinion on this part of the cover letter before I proceed to fix these patches: > Other design ideas (to prevent above issues) could be: > * Extend the return codes for the cgroup_skb program to trigger the > reject after completion (SK_REJECT). > * Adding a kfunc to set the kernel to send an ICMP_HOST_UNREACH control > message with appropriate code when the cgroup_skb program eventually > terminates with SK_DROP. > > We should bear in mind that we want to extend this with TCP reset next. > Please tell me what's your opinion on above ideas: if adding new return > codes could be considered and/or the other alternatives would be better > than this patch series and thus proposed instead. These two ideas would make it more natural for cgroup_skb progs but would prevent someone to extend it to more prog types in the future.
