close bpf firewall reload gap #19851
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
yuwata
reviewed
Jun 8, 2021
da61ed5 to
f7e8e80
Compare
yuwata
requested changes
Jun 8, 2021
These are so many runtime objects, let's add a bpf_firewall_close() helper that destroys them all, and call that from unit_free(), simply as an excercise of encapsulating more BPF code in bpf-firewall.c. This also brings the destruction order and variable declaration order in struct Unit into the same systematic order. No change in behaviour just some minor refactoring.
Mostly logging related: let's downgrade logging in dlopen_bpf() for example, and remove duplicate logging at various places. Add %m to log messages and so on.
The other BPF infra has a file name prefix of "bpf-" hence do so here too.
we generally do this for all bpf functions, do so here too.
If we have BPF_F_ALLOW_MULTI support we can install the new program before we drop the old (because we can install two program at the same time). Let's do that, and thus fully close the firewall gap.
f7e8e80 to
dbef3d1
Compare
Member
|
LGTM. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR is an alternative to @cdown's #17495 which stalled. The basic idea is the same: serialize the attached BPF program fd across reloads/reexecs so that we can close them only after installing the new BPF programs.
Contains a multitude of other BPF clean-ups.