One of the pieces of feedback from recent review of BPF hooks for socket lookup [0] was that new program types should use bpf_link-based attachment. Unlike with cgroups-attached programs, there is no existing infrastructure for using bpf_links with network namespaces. It is also not as simple as updating a single bpf_prog pointer, like in case of direct program attachment. Due to that I've split out this work into its own series. Series is organized as so: Patches 1-4 prepare a space in struct net to keep state for attached BPF programs, and massage the code in flow_dissector to make it attach type agnostic to finally move under kernel/bpf/. Patch 5, the most important one, introduces new bpf_link link type for attaching to network namespace. As opposed to cgroups, we can't hold a ref count on struct net from a bpf_link, so we get by with just RCU protection. I'd be grateful if someone more experienced using RCU could give this patch a look. It is not exactly the textbook application of it. Patches 6-8 make libbpf and bpftool aware of the new link type and add tests to check that link create/update/query API works as intended. Thanks to Lorenz and Marek for early feedback & reviews. -jkbs Cc: Lorenz Bauer <lmb@xxxxxxxxxxxxxx> Cc: Marek Majkowski <marek@xxxxxxxxxxxxxx> Cc: Stanislav Fomichev <sdf@xxxxxxxxxx> [0] https://lore.kernel.org/bpf/20200511185218.1422406-1-jakub@xxxxxxxxxxxxxx/ Jakub Sitnicki (8): flow_dissector: Don't grab update-side lock on prog detach from pre_exit flow_dissector: Pull locking up from prog attach callback net: Introduce netns_bpf for BPF programs attached to netns flow_dissector: Move out netns_bpf prog callbacks bpf: Add link-based BPF program attachment to network namespace libbpf: Add support for bpf_link-based netns attachment bpftool: Support link show for netns-attached links selftests/bpf: Add tests for attaching bpf_link to netns include/linux/bpf-netns.h | 64 +++ include/linux/skbuff.h | 26 - include/net/flow_dissector.h | 6 + include/net/net_namespace.h | 4 +- include/net/netns/bpf.h | 18 + include/uapi/linux/bpf.h | 5 + kernel/bpf/Makefile | 1 + kernel/bpf/net_namespace.c | 387 ++++++++++++++ kernel/bpf/syscall.c | 10 +- net/core/filter.c | 1 + net/core/flow_dissector.c | 124 +---- tools/bpf/bpftool/link.c | 19 + tools/include/uapi/linux/bpf.h | 5 + tools/lib/bpf/libbpf.c | 20 +- tools/lib/bpf/libbpf.h | 2 + tools/lib/bpf/libbpf.map | 1 + .../bpf/prog_tests/flow_dissector_reattach.c | 500 +++++++++++++++++- 17 files changed, 1026 insertions(+), 167 deletions(-) create mode 100644 include/linux/bpf-netns.h create mode 100644 include/net/netns/bpf.h create mode 100644 kernel/bpf/net_namespace.c -- 2.25.4
