[PATCH bpf-next v2 0/2] bpf: Allow bpf_get_netns_cookie in BPF_PROG_TYPE_SOCK_OPS

---
 .../selftests/bpf/prog_tests/netns_cookie.c   | 61 +++++++++++++++++++
 .../selftests/bpf/progs/netns_cookie_prog.c   | 39 ++++++++++++
 2 files changed, 100 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/netns_cookie.c
 create mode 100644 tools/testing/selftests/bpf/progs/netns_cookie_prog.c

diff --git a/tools/testing/selftests/bpf/prog_tests/netns_cookie.c b/tools/testing/selftests/bpf/prog_tests/netns_cookie.c
new file mode 100644
index 000000000000..6f3cd472fb65
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/netns_cookie.c

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <test_progs.h>
+#include "netns_cookie_prog.skel.h"
+#include "network_helpers.h"
+
+#ifndef SO_NETNS_COOKIE
+#define SO_NETNS_COOKIE 71
+#endif
+
+static int duration;
+
+void test_netns_cookie(void)
+{
+       int server_fd = 0, client_fd = 0, cgroup_fd = 0, err = 0, val = 0;
+       struct netns_cookie_prog *skel;
+       uint64_t cookie_expected_value;
+       socklen_t vallen = sizeof(cookie_expected_value);
+
+       skel = netns_cookie_prog__open_and_load();
+       if (!ASSERT_OK_PTR(skel, "skel_open"))
+               return;
+
+       cgroup_fd = test__join_cgroup("/netns_cookie");
+       if (CHECK(cgroup_fd < 0, "join_cgroup", "cgroup creation failed\n"))
+               goto out;
+
+       skel->links.get_netns_cookie_sockops = bpf_program__attach_cgroup(
+               skel->progs.get_netns_cookie_sockops, cgroup_fd);
+       if (!ASSERT_OK_PTR(skel->links.get_netns_cookie_sockops, "prog_attach"))
+               goto close_cgroup_fd;
+
+       server_fd = start_server(AF_INET6, SOCK_STREAM, "::1", 0, 0);
+       if (CHECK(server_fd < 0, "start_server", "errno %d\n", errno))
+               goto close_cgroup_fd;
+
+       client_fd = connect_to_fd(server_fd, 0);
+       if (CHECK(client_fd < 0, "connect_to_fd", "errno %d\n", errno))
+               goto close_server_fd;
+
+       err = bpf_map_lookup_elem(bpf_map__fd(skel->maps.netns_cookies),
+                               &client_fd, &val);
+       if (!ASSERT_OK(err, "map_lookup(socket_cookies)"))
+               goto close_client_fd;
+
+       err = getsockopt(client_fd, SOL_SOCKET, SO_NETNS_COOKIE,
+                               &cookie_expected_value, &vallen);
+       if (!ASSERT_OK(err, "getsockopt)"))
+               goto close_client_fd;
+
+       ASSERT_EQ(val, cookie_expected_value, "cookie_value");
+
+close_client_fd:
+       close(client_fd);
+close_server_fd:
+       close(server_fd);
+close_cgroup_fd:
+       close(cgroup_fd);
+out:
+       netns_cookie_prog__destroy(skel);
+}

diff --git a/tools/testing/selftests/bpf/progs/netns_cookie_prog.c b/tools/testing/selftests/bpf/progs/netns_cookie_prog.c
new file mode 100644
index 000000000000..4ed8d75aa299
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/netns_cookie_prog.c

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include "vmlinux.h"
+
+#include <bpf/bpf_helpers.h>
+
+#define AF_INET6 10
+
+struct {
+       __uint(type, BPF_MAP_TYPE_SK_STORAGE);
+       __uint(map_flags, BPF_F_NO_PREALLOC);
+       __type(key, int);
+       __type(value, int);
+} netns_cookies SEC(".maps");
+
+SEC("sockops")
+int get_netns_cookie_sockops(struct bpf_sock_ops *ctx)
+{
+       struct bpf_sock *sk = ctx->sk;
+       int *cookie;
+
+       if (ctx->family != AF_INET6)
+               return 1;
+
+       if (ctx->op != BPF_SOCK_OPS_TCP_CONNECT_CB)
+               return 1;
+
+       if (!sk)
+               return 1;
+
+       cookie = bpf_sk_storage_get(&netns_cookies, sk, 0,
+                               BPF_SK_STORAGE_GET_F_CREATE);
+       if (!cookie)
+               return 1;
+
+       *cookie = bpf_get_netns_cookie(ctx);
+
+       return 1;
+}
--

2.28.0

---
 net/core/filter.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index d70187ce851b..34938a537931 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c

@@ -4664,6 +4664,18 @@ static const struct bpf_func_proto bpf_get_netns_cookie_sock_addr_proto = {
        .arg1_type      = ARG_PTR_TO_CTX_OR_NULL,
 };

+BPF_CALL_1(bpf_get_netns_cookie_sock_ops, struct bpf_sock_ops_kern *, ctx)
+{
+       return __bpf_get_netns_cookie(ctx ? ctx->sk : NULL);
+}
+
+static const struct bpf_func_proto bpf_get_netns_cookie_sock_ops_proto = {
+       .func           = bpf_get_netns_cookie_sock_ops,
+       .gpl_only       = false,
+       .ret_type       = RET_INTEGER,
+       .arg1_type      = ARG_PTR_TO_CTX_OR_NULL,
+};
+
 BPF_CALL_1(bpf_get_socket_uid, struct sk_buff *, skb)
 {
        struct sock *sk = sk_to_full_sk(skb->sk);

@@ -7445,6 +7457,8 @@ sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
                return &bpf_sk_storage_get_proto;
        case BPF_FUNC_sk_storage_delete:
                return &bpf_sk_storage_delete_proto;
+       case BPF_FUNC_get_netns_cookie:
+               return &bpf_get_netns_cookie_sock_ops_proto;
 #ifdef CONFIG_INET
        case BPF_FUNC_load_hdr_opt:
                return &bpf_sock_ops_load_hdr_opt_proto;
--

2.28.0