[PATCH iproute2-next 0/3] ip: netns: report the network namespace cookie

[Ido Schimmel <idosch@nvidia.com>]

The kernel identifies a network namespace by a 64-bit cookie that is
assigned when the namespace is created and never changes.

The cookie is reported by a growing number of trace events such as the
TCP-MD5 and TCP-AO events and the net device events (e.g.,
net:net_dev_xmit). This allows filtering events that occur in a specific
network namespace, for example:

 # perf record -a -e net:net_dev_xmit --filter 'net_cookie == 12'

It is also available to tracing BPF programs that can access
'net_cookie' in 'struct net'.

However, no utility currently reports the cookie of a given network
namespace, so mapping a cookie in a trace to a namespace requires a
custom program that calls getsockopt(SO_NETNS_COOKIE) from within the
namespace.

Since Linux 6.18, the cookie is also the generic namespace ID and can be
retrieved via the NS_GET_ID ioctl on a network namespace file
descriptor. Unlike SO_NETNS_COOKIE, this does not require entering the
namespace, so the cookie of any namespace whose file can be opened can
be retrieved without privileges. A kernel selftest [1] ensures that both
interfaces report the same value for a given network namespace.

This patchset extends ip-netns to display the network namespace cookie.

Patch #1 imports the nsfs.h header that defines the NS_GET_ID ioctl.

Patch #2 reports the cookie in "ip netns list". It is always reported in
JSON mode and only reported with "-d" in plain text mode to avoid
breaking scripts that rely on the current output format.

Patch #3 adds "ip netns cookie [ NETNSNAME | PID ]" to report the cookie
of a single network namespace, including namespaces that are not bind
mounted under /var/run/netns, such as those created by container
runtimes.

[1] nsid_netns_basic in tools/testing/selftests/namespaces/nsid_test.c

Ido Schimmel (3):
  uapi: import nsfs.h from last sync point
  ip: netns: report the network namespace cookie
  ip: netns: add "ip netns cookie" command

 include/uapi/linux/nsfs.h | 122 ++++++++++++++++++++++++++++++++++++++
 ip/ipnetns.c              |  71 ++++++++++++++++++++++
 man/man8/ip-netns.8.in    |  30 +++++++++-
 3 files changed, 222 insertions(+), 1 deletion(-)
 create mode 100644 include/uapi/linux/nsfs.h

-- 
2.55.0