__cgroup_bpf_run_filter_skb(9)

📦 version 7.3.1, in nixpkgs unstable

💅 __cgroup_bpf_run_filter_skb — from the Kernel API Manual, bestie

Okay so picture this: you're deep in the kernel, packets are flying around, cgroups are cgrouping, and you need somebody to actually run a program on a packet. That's literally this function's whole job. It runs a program for packet filtering. No cap. 🎀

✨ SYNOPSIS ✨

int __cgroup_bpf_run_filter_skb (struct sock *sk , struct sk_buff *skb ,
enum cgroup_bpf_attach_type atype );

That's the whole vibe. Three args, one int coming back at you. 🫶

🌸 ARGUMENTS 🌸

  • sk — the socket that's doing the sending or the receiving, i.e. the main character of the traffic situation.
  • skb — the actual skb that's being sent or received. The packet itself. The moment. 💌
  • atype — the type of program you want executed. Pick your fighter.

🔥 DESCRIPTION 🔥

So here's the tea ☕ — if no socket is passed, or the socket isn't of type INET or INET6, this function genuinely does nothing and returns 0. It's giving "not my department, not my problem." And honestly? Respect. 💀

The program type you hand over via type must be suitable for network filtering. And here's the part where you have to be a responsible adult: no further check is performed to assert that. So like... the function trusts you. Completely. Please don't make it regret that. 🙈

💜 For egress packets

This function can return:

  • NET_XMIT_SUCCESS (0) — continue with packet output. Slay, we move. ✨
  • NET_XMIT_DROP (1) — drop the packet and notify TCP to call cwr. Bye bestie 👋
  • NET_XMIT_CN (2) — continue with packet output and notify TCP to call cwr. Both? Both. 🦋
  • -err — drop the packet. That's it, that's the outcome. 😭

💖 For ingress packets

The vibe shifts: this function will return -EPERM if any attached program was found and it returned != 1 during execution. Otherwise you get 0 back. Simple as that. 🌈

Quick reality check: these return values are not decorative. Returning the wrong thing on egress means packets living their best life when they should've been dropped (or vice versa), so keep your program's contract tight, okay? ⭐

🦋 SEE ALSO 🦋

Kernel file ./kernel/bpf/cgroup.c, plus the whole friend group:

Go read them, they're iconic too, iykyk. 👑

💖 that's the whole page bestie 💖 sourced from ./kernel/bpf, dated October 2026, signed off with a __cgroup_bpf_run_filter_skb(9) and a little kiss 🎀 go run your filters, you've got this 🫶

📦 where this page comes from