Messages in this thread |  | | From | Alexei Starovoitov <> | Date | Tue, 16 Apr 2019 19:59:49 -0700 | Subject | Re: [PATCH bpf-next v1 1/2] bpf: sock ops: add netns in bpf context |
| |
On Fri, Apr 12, 2019 at 3:01 AM Alban Crequy <alban.crequy@gmail.com> wrote: > > From: Alban Crequy <alban@kinvolk.io> > > sockops programs can now access the network namespace inode via > (struct bpf_sock_ops)->netns. This can be useful to apply different > policies on different network namespaces. > > In the unlikely case where network namespaces are not compiled in > (CONFIG_NET_NS=n), the verifier will not allow access to ->netns. > > Signed-off-by: Alban Crequy <alban@kinvolk.io> > --- > include/uapi/linux/bpf.h | 1 + > net/core/filter.c | 40 ++++++++++++++++++++++++++++++++++++++++ > 2 files changed, 41 insertions(+) > > diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h > index 31a27dd337dc..5afaab25f205 100644 > --- a/include/uapi/linux/bpf.h > +++ b/include/uapi/linux/bpf.h > @@ -3069,6 +3069,7 @@ struct bpf_sock_ops { > __u32 sk_txhash; > __u64 bytes_received; > __u64 bytes_acked; > + __u64 netns; > };
stat /proc/self/ns/net returns inode and device. inum only is not enough to identify netns. Both need to be exposed. See netns_dev/netns_ino in bpf.h
|  |