Hi Florian,
On Thu, 13 Apr 2023 at 14:36, Florian Westphal <fw@xxxxxxxxx> wrote:
>
> Dump protocol family, hook and priority value:
> $ bpftool link
> 2: type 10 prog 20
Could you please update link_type_name in libbpf (libbpf.c) so that we
display "netfilter" here instead of "type 10"?
> pf: 2, hook 1, prio -128
>
> Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
> ---
> tools/bpf/bpftool/link.c | 24 ++++++++++++++++++++++++
> tools/include/uapi/linux/bpf.h | 15 +++++++++++++++
> tools/lib/bpf/libbpf.c | 1 +
> 3 files changed, 40 insertions(+)
>
> diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
> index f985b79cca27..a2ea85d1ebbf 100644
> --- a/tools/bpf/bpftool/link.c
> +++ b/tools/bpf/bpftool/link.c
> @@ -135,6 +135,18 @@ static void show_iter_json(struct bpf_link_info *info, json_writer_t *wtr)
> }
> }
>
> +static void show_netfilter_json(const struct bpf_link_info *info, json_writer_t *wtr)
> +{
> + jsonw_uint_field(json_wtr, "pf",
> + info->netfilter.pf);
> + jsonw_uint_field(json_wtr, "hook",
> + info->netfilter.hooknum);
> + jsonw_int_field(json_wtr, "prio",
> + info->netfilter.priority);
> + jsonw_uint_field(json_wtr, "flags",
> + info->netfilter.flags);
> +}
> +
> static int get_prog_info(int prog_id, struct bpf_prog_info *info)
> {
> __u32 len = sizeof(*info);
> @@ -195,6 +207,10 @@ static int show_link_close_json(int fd, struct bpf_link_info *info)
> info->netns.netns_ino);
> show_link_attach_type_json(info->netns.attach_type, json_wtr);
> break;
> + case BPF_LINK_TYPE_NETFILTER:
> + show_netfilter_json(info, json_wtr);
> + break;
> +
> default:
> break;
> }
> @@ -301,6 +317,14 @@ static int show_link_close_plain(int fd, struct bpf_link_info *info)
> printf("\n\tnetns_ino %u ", info->netns.netns_ino);
> show_link_attach_type_plain(info->netns.attach_type);
> break;
> + case BPF_LINK_TYPE_NETFILTER:
> + printf("\n\tpf: %d, hook %u, prio %d",
> + info->netfilter.pf,
> + info->netfilter.hooknum,
> + info->netfilter.priority);
> + if (info->netfilter.flags)
> + printf(" flags 0x%x", info->netfilter.flags);
> + break;
> default:
> break;
> }
> diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
> index 3823100b7934..c93febc4c75f 100644
> --- a/tools/include/uapi/linux/bpf.h
> +++ b/tools/include/uapi/linux/bpf.h
> @@ -986,6 +986,7 @@ enum bpf_prog_type {
> BPF_PROG_TYPE_LSM,
> BPF_PROG_TYPE_SK_LOOKUP,
> BPF_PROG_TYPE_SYSCALL, /* a program that can execute syscalls */
> + BPF_PROG_TYPE_NETFILTER,
If netfilter programs could be loaded with bpftool, we'd need to
update bpftool's docs. But I don't think this is the case, right? We
don't currently have a way to pass the pf, hooknum, priority and flags
necessary to load the program with "bpftool prog load" so it would
fail?
Have you considered listing netfilter programs in the output of
"bpftool net" as well? Given that they're related to networking, it
would maybe make sense to have them listed alongside XDP, TC, and flow
dissector programs?
The patch looks good to me otherwise.
Thanks,
Quentin
