[0/2] Refactor Logging Infrastructure by yaakov-stein · Pull Request #485 · facebook/bpfilter

yaakov-stein · 2026-03-20T22:12:50Z

Stack:

Summary

This sets the stage for adding logging support for CGROUP_SOCK_ADDR. The first step is renaming the logging infrastructure in a way that isn't packet-specific (or making it clear that certain parts are packet-specific and naming accordingly), and adding a union that allows us to add the necessary fields to bf_log to support this change.

No functional change (besides the bf_log_type enum helper methods).

github-actions · 2026-03-20T22:12:59Z

Claude review of PR #485 (`12b8bcf`)

Clean refactoring that renames bf_pkthdr to bf_log_opt, restructures bf_log as a tagged union, and renames the log ELF stub. The rename is applied consistently across all 15 changed files. Previous review comments about missing assert(str), include ordering, and silent early return remain open — see existing inline comments.

Must fix

Stale BF_PKTHDR_LINK in benchmarks — tools/benchmarks/main.cpp:244,422 — BF_PKTHDR_LINK was not renamed to BF_LOG_OPT_LINK, causing a build failure when benchmarks are enabled

Suggestions

Struct naming convention — src/libbpfilter/include/bpfilter/runtime.h:97 — struct _bf_log_pkt and struct _bf_log_sock_addr use _bf_ prefix which has no precedent for struct types in this codebase; all existing structs use bf_ prefix

Nits

Missing "Can't be NULL" for str param — src/libbpfilter/include/bpfilter/rule.h:32 — Doxygen for bf_log_type_from_str and bf_log_opt_from_str documents "Can't be NULL" for the output param but not for str, unlike other _from_str declarations
Union missing Doxygen — src/libbpfilter/include/bpfilter/runtime.h:175 — Anonymous union in struct bf_log is the only field without a Doxygen comment
Doxygen multi-line format on union comment — src/libbpfilter/include/bpfilter/runtime.h:170 — Multi-line Doxygen comment has text on first and last lines; style guide requires empty first/last lines for Doxygen
Copyright year dropped — src/libbpfilter/bpf/pkt_log.bpf.c:3 — Year was removed from the copyright notice during the file rename; all other .bpf.c files retain their year

Workflow run

src/libbpfilter/include/bpfilter/runtime.h

src/bfcli/print.c

src/libbpfilter/rule.c

src/libbpfilter/include/bpfilter/runtime.h

yaakov-stein · 2026-03-27T17:58:39Z

src/libbpfilter/include/bpfilter/runtime.h

+            /** Destination address (4 bytes for IPv4, 16 for IPv6). */
+            bf_aligned(8) __u8 daddr[sizeof(struct in6_addr)];
+        } sock_addr;
+    } payload;


I'd ideally have left this unnamed as there isn't much of a benefit of naming it and it now requires ->payload.pkt/sock_addr, but doxygen requires unions to be named :(

Leave it unnamed, we'll find a way to deal with the Doxygen issue differently.

src/libbpfilter/include/bpfilter/runtime.h

tests/unit/libbpfilter/rule.c

src/libbpfilter/rule.c

src/libbpfilter/include/bpfilter/runtime.h

src/libbpfilter/include/bpfilter/rule.h

src/libbpfilter/include/bpfilter/runtime.h

yaakov-stein · 2026-03-29T19:59:03Z

src/libbpfilter/include/bpfilter/runtime.h

+/**
+ * @brief Packet log payload fields (XDP, TC, NF, cgroup_skb).
+ */
+struct _bf_log_pkt


This are only necessary internally but live in a public header file... I went with the approach of using the _bf prefix, but there weren't any examples to follow. Let me know if there's a better appraoch (maybe defining the structs directly inside the union?).

Why is it only internal? This file can be included by clients reading from the ring buffer. I would suggest removing the _ prefix, as it's reserved in C. It's fine to use it in our own translation unit, as we control includes and naming, but it's not for public headers.

Rename the packet logging ELF stub from `log` to `pkt_log` to establish naming symmetry with the upcoming `sock_log` stub for socket-based hooks.

Add a bf_log_type discriminator and restructure bf_log as a tagged union with packet and socket variants. Packet-specific fields (pkt_size, headers, l2hdr/l3hdr/l4hdr) move into the pkt variant. The sock variant (pid, comm) is defined but not yet populated. The struct sizes to the larger packet variant, so total size is unchanged for ring buffer reservations.

src/libbpfilter/bpf/pkt_log.bpf.c

src/libbpfilter/include/bpfilter/runtime.h

qdeslandes · 2026-03-30T09:25:12Z

src/libbpfilter/include/bpfilter/runtime.h

+            /** Destination address (4 bytes for IPv4, 16 for IPv6). */
+            bf_aligned(8) __u8 daddr[sizeof(struct in6_addr)];
+        } sock_addr;
+    } payload;


Leave it unnamed, we'll find a way to deal with the Doxygen issue differently.

qdeslandes · 2026-03-30T09:26:57Z

src/libbpfilter/include/bpfilter/runtime.h

+/**
+ * @brief Packet log payload fields (XDP, TC, NF, cgroup_skb).
+ */
+struct _bf_log_pkt


Why is it only internal? This file can be included by clients reading from the ring buffer. I would suggest removing the _ prefix, as it's reserved in C. It's fine to use it in our own translation unit, as we control includes and naming, but it's not for public headers.

qdeslandes · 2026-03-30T09:28:53Z

src/libbpfilter/include/bpfilter/runtime.h

+    /** User-requested headers, as defined in the rule. */
+    __u8 req_headers;
+
+    /** Logged headers, as not all hooks can access all headers. */
+    __u8 headers;


Why did you remove the :4 bitfield?

qdeslandes · 2026-03-30T09:39:15Z

src/libbpfilter/rule.c

+
+    for (int i = 0; i < _BF_LOG_OPT_MAX; ++i) {
+        if (bf_streq_i(str, _bf_log_opt_strs[i])) {
+            *opt = (enum bf_log_opt)i;


I don't think we need sock_addr logging to be configurable, there isn't that much data to log, and the only helper we'll use do current->tgid << 32 | current->pid. Hence, we can keep bf_pkthdr for packet logging options.

qdeslandes · 2026-03-30T09:43:26Z

src/libbpfilter/rule.c

+static const char *_bf_log_type_strs[] = {
+    [BF_LOG_TYPE_PACKET] = "packet",
+    [BF_LOG_TYPE_SOCK_ADDR] = "sock_addr",
 };
-static_assert_enum_mapping(_bf_pkthdr_strs, _BF_PKTHDR_MAX);
+static_assert_enum_mapping(_bf_log_type_strs, _BF_LOG_TYPE_MAX);

-const char *bf_pkthdr_to_str(enum bf_pkthdr hdr)
+const char *bf_log_type_to_str(enum bf_log_type log_type)
 {
-    if (hdr < 0 || hdr >= _BF_PKTHDR_MAX)
-        return "<bf_pkthdr unknown>";
+    if (log_type < 0 || log_type >= _BF_LOG_TYPE_MAX)
+        return "<bf_log_type unknown>";

-    return _bf_pkthdr_strs[hdr];
+    return _bf_log_type_strs[log_type];
 }

-int bf_pkthdr_from_str(const char *str, enum bf_pkthdr *hdr)
+int bf_log_type_from_str(const char *str, enum bf_log_type *log_type)
 {
-    assert(hdr);
+    assert(log_type);

-    for (int i = 0; i < _BF_PKTHDR_MAX; ++i) {
-        if (bf_streq_i(str, _bf_pkthdr_strs[i])) {
-            *hdr = (enum bf_pkthdr)i;
+    for (int i = 0; i < _BF_LOG_TYPE_MAX; ++i) {
+        if (bf_streq_i(str, _bf_log_type_strs[i])) {
+            *log_type = (enum bf_log_type)i;
+            return 0;
+        }
+    }
+
+    return -EINVAL;
+}


We don't need this as we don't use it.

meta-cla bot added the cla signed label Mar 20, 2026

yaakov-stein changed the title ~~[0/2] Refactor Log Infrastructure~~ [0/2][CGROUP_SOCK_ADDR Logging] Refactor Log Infrastructure Mar 20, 2026

github-actions bot reviewed Mar 20, 2026

View reviewed changes

src/libbpfilter/include/bpfilter/runtime.h Outdated Show resolved Hide resolved

github-actions bot reviewed Mar 20, 2026

View reviewed changes

src/bfcli/print.c Show resolved Hide resolved

github-actions bot reviewed Mar 20, 2026

View reviewed changes

src/libbpfilter/rule.c Show resolved Hide resolved

yaakov-stein mentioned this pull request Mar 20, 2026

[1/2] Add flavor-specific log codegen callback #486

Open

yaakov-stein force-pushed the refactor-log-infrastructure branch from 2bb9a67 to c911410 Compare March 27, 2026 14:59

github-actions bot reviewed Mar 27, 2026

View reviewed changes

src/libbpfilter/include/bpfilter/runtime.h Show resolved Hide resolved

github-actions bot reviewed Mar 27, 2026

View reviewed changes

src/libbpfilter/include/bpfilter/runtime.h Show resolved Hide resolved

github-actions bot reviewed Mar 27, 2026

View reviewed changes

src/libbpfilter/include/bpfilter/runtime.h Outdated Show resolved Hide resolved

yaakov-stein force-pushed the refactor-log-infrastructure branch from c911410 to 7aeeab0 Compare March 27, 2026 17:06

github-actions bot reviewed Mar 27, 2026

View reviewed changes

src/libbpfilter/include/bpfilter/runtime.h Outdated Show resolved Hide resolved

yaakov-stein commented Mar 27, 2026

View reviewed changes

yaakov-stein marked this pull request as ready for review March 27, 2026 19:07

yaakov-stein requested a review from qdeslandes as a code owner March 27, 2026 19:07

yaakov-stein force-pushed the refactor-log-infrastructure branch from 7aeeab0 to 4a18e6d Compare March 27, 2026 19:45

github-actions bot reviewed Mar 27, 2026

View reviewed changes

src/libbpfilter/include/bpfilter/runtime.h Show resolved Hide resolved

github-actions bot reviewed Mar 27, 2026

View reviewed changes

src/libbpfilter/include/bpfilter/runtime.h Show resolved Hide resolved

yaakov-stein force-pushed the refactor-log-infrastructure branch from 4a18e6d to 4c82f48 Compare March 27, 2026 20:26

github-actions bot reviewed Mar 27, 2026

View reviewed changes

tests/unit/libbpfilter/rule.c Show resolved Hide resolved

github-actions bot reviewed Mar 27, 2026

View reviewed changes

src/libbpfilter/rule.c Show resolved Hide resolved

yaakov-stein force-pushed the refactor-log-infrastructure branch from 4c82f48 to fe77c33 Compare March 27, 2026 20:59

yaakov-stein marked this pull request as draft March 29, 2026 03:53

yaakov-stein force-pushed the refactor-log-infrastructure branch 2 times, most recently from 5c7c805 to 61e87f4 Compare March 29, 2026 19:25

github-actions bot reviewed Mar 29, 2026

View reviewed changes

src/libbpfilter/include/bpfilter/runtime.h Show resolved Hide resolved

github-actions bot reviewed Mar 29, 2026

View reviewed changes

src/libbpfilter/include/bpfilter/rule.h Show resolved Hide resolved

github-actions bot reviewed Mar 29, 2026

View reviewed changes

src/libbpfilter/include/bpfilter/runtime.h Show resolved Hide resolved

yaakov-stein force-pushed the refactor-log-infrastructure branch from 61e87f4 to 3634fd4 Compare March 29, 2026 19:46

yaakov-stein commented Mar 29, 2026

View reviewed changes

yaakov-stein marked this pull request as ready for review March 29, 2026 20:01

yaakov-stein mentioned this pull request Mar 29, 2026

[2/2] Add CGROUP_SOCK_ADDR Logging Infrastructure #491

Open

yaakov-stein changed the title ~~[0/2][CGROUP_SOCK_ADDR Logging] Refactor Log Infrastructure~~ [0/2] Refactor Logging Infrastructure Mar 29, 2026

yaakov-stein added 3 commits March 29, 2026 15:01

lib: cgen: rename log elfstub to pkt_log

083aa27

Rename the packet logging ELF stub from `log` to `pkt_log` to establish naming symmetry with the upcoming `sock_log` stub for socket-based hooks.

lib: rename bf_pkthdr to bf_log_opt

12b8bcf

yaakov-stein force-pushed the refactor-log-infrastructure branch from 3634fd4 to 12b8bcf Compare March 29, 2026 22:05

github-actions bot reviewed Mar 29, 2026

View reviewed changes

src/libbpfilter/bpf/pkt_log.bpf.c Show resolved Hide resolved

github-actions bot reviewed Mar 29, 2026

View reviewed changes

src/libbpfilter/include/bpfilter/runtime.h Show resolved Hide resolved

qdeslandes requested changes Mar 30, 2026

View reviewed changes

Conversation

yaakov-stein commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

github-actions bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Claude review of PR #485 (12b8bcf)

Must fix

Suggestions

Nits

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yaakov-stein Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

yaakov-stein commented Mar 20, 2026 •

edited

Loading

github-actions bot commented Mar 20, 2026 •

edited

Loading

Claude review of PR #485 (`12b8bcf`)

yaakov-stein Mar 29, 2026 •

edited

Loading