On Thu, Oct 10, 2019 at 08:17:49PM +0200, Jakub Sitnicki wrote:
> It is currently not possible to detach the flow dissector program and
> attach a new one in an atomic fashion, that is with a single syscall.
> Attempts to do so will be met with EEXIST error.
>
> This makes updates to flow dissector program hard. Traffic steering that
> relies on BPF-powered flow dissection gets disrupted while old program has
> been already detached but the new one has not been attached yet.
>
> There is also a window of opportunity to attach a flow dissector to a
> non-root namespace while updating the root flow dissector, thus blocking
> the update.
>
> Lastly, the behavior is inconsistent with cgroup BPF programs, which can be
> replaced with a single bpf(BPF_PROG_ATTACH, ...) syscall without any
> restrictions.
>
> Allow attaching a new flow dissector program when another one is already
> present with a restriction that it can't be the same program.
Acked-by: Martin KaFai Lau <[email protected]>
