如何列出所有已加载到内核的bpf程序？ （例如tc-bpf）

Question

I know that bpf program can be load into kernel in different ways, tc/kprobe/socket ...

And I want to know is there a interface or something, through which I can get all the bpf program I loaded? If no such thing, is it dangerous that if I left some bpf program alone which may change my network data?

Anothing small question, How to unload tc-bpf program, do I really have to remove the qdisc everytime?

Answer 1

In order to list all BPF programs on your system, and since Linux kernel 4.13, you can use the bpf() system call, with its BPF_PROG_GET_NEXT_ID command, to get the id of a first program, and then repeateadly call it again to obtain the following ids, until you have the list of the ids of all BPF programs loaded on your system. Then you can use the same system call with its BPF_PROG_GET_FD_BY_ID command to retrieve a file descriptor to each program, and a third time with the BPF_OBJ_GET_INFO_BY_FD to get information (such as program type) for a given program. I would usually redirect you to the bpf(2) manual page , but right now it is seriously out of date and does not describe those commands on my system.

In practise, all of this has already been implemented. You should search for the bpftool program: running sudo bpftool prog will list all programs on your system.

bpftool sources are within the Linux kernel tree and can be easily compiled. It is packaged for Fedora 28, but not for Debian/Ubuntu or other distributions as of this writing. (You could also get a Debian .deb package with a statically linked binary from this page . It also has a guide with detailed instructions for building bpftool, among other things. Disclaimer: I work for that company.)

As for removing a program attached as a tc filter, you can simply remove the filter, not necessarily the entire qdisc, like this:

tc filter del dev eth0 ingress