Generating and retrieving socket cookies are a useful feature that is exposed to BPF for various program types through bpf_get_socket_cookie() helper. The fact that the cookie counter is per netns is quite a limitation for BPF in practice in particular for programs in host namespace that use socket cookies as part of a map lookup key since they will be causing socket cookie collisions e.g. when attached to BPF cgroup hooks or cls_bpf on tc egress in host namespace handling container traffic from veth or ipvlan devices with peer in different netns. Change the counter to be global instead. Socket cookie consumers must assume the value as opqaue in any case. Not every socket must have a cookie generated and knowledge of the counter value itself does not provide much value either way hence conversion to global is fine.
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -1466,8 +1466,8 @@ union bpf_attr { · 1465 unmodified lines | ||
| 1466 | 1466 | * If no cookie has been set yet, generate a new cookie. Once |
| 1467 | 1467 | * generated, the socket cookie remains stable for the life of the |
| 1468 | 1468 | * socket. This helper can be useful for monitoring per socket |
| 1469 | − * networking traffic statistics as it provides a unique socket | |
| 1470 | − * identifier per namespace. | |
| 1469 | + * networking traffic statistics as it provides a global socket | |
| 1470 | + * identifier that can be assumed unique. | |
| 1471 | 1471 | * Return |
| 1472 | 1472 | * A 8-byte long non-decreasing number on success, or 0 if the |
| 1473 | 1473 | * socket field is missing inside *skb*. |