// plugins/cilium-cni/cilium-cni.go

func cmdAdd(args *skel.CmdArgs) (err error) {
    n = types.LoadNetConf(args.StdinData)
    cniTypes.LoadArgs(args.Args, &cniArgs)
    netns.RemoveIfFromNetNSIfExists(netNs, args.IfName)

    ep := &models.EndpointChangeRequest{
        ContainerID:  args.ContainerID,
        Labels:       addLabels,
        State:        models.EndpointStateWaitingForIdentity,
        K8sPodName:   string(cniArgs.K8S_POD_NAME),
        K8sNamespace: string(cniArgs.K8S_POD_NAMESPACE),
    }

    switch conf.DatapathMode {
    case DatapathModeVeth:
        veth, peer, tmpIfName = connector.SetupVeth(ep.ContainerID, DeviceMTU, ep)
        netlink.LinkSetNsFd(*peer, int(netNs.Fd()))
        connector.SetupVethRemoteNs(netNs, tmpIfName, args.IfName)
    case DatapathModeIpvlan: ...
    }

    podName := cniArgs.K8S_POD_NAMESPACE + "/" + cniArgs.K8S_POD_NAME
    ipam = c.IPAMAllocate("", podName, true) // c: cilium client

    if ipv4IsEnabled(ipam) {
        ep.Addressing.IPV4 = ipam.Address.IPV4
        ipConfig, routes = prepareIP(ep.Addressing.IPV4, ...)
        res.IPs = append(res.IPs, ipConfig)
        res.Routes = append(res.Routes, routes...)
    }

    macAddrStr = configureIface(ipam, args.IfName, &state)

    c.EndpointCreate(ep)
    return cniTypes.PrintResult(res, n.CNIVersion)
}

// CmdArgs captures all the arguments passed in to the plugin via both env vars and stdin
type CmdArgs struct {
        ContainerID string // container ID
        Netns       string // container netns
        IfName      string // desired interface name for container, e.g. `eth0`
        Args        string // Platform-specific parameters of the container, e.g.
                           // `K8S_POD_NAMESPACE=xx;K8S_POD_NAME=xx;K8S_POD_INFRA_CONTAINER_ID=xx`
        Path        string // Path for locating CNI plugin binary, e.g. `/opt/cni/bin`
        StdinData   []byte // Network configurations
}

type netConf struct {
    cniTypes.NetConf
    MTU  int  `json:"mtu"`
    Args Args `json:"args"`
}

// github.com/containernetworking/cni/pkg/types/types.go

// NetConf describes a network.
type NetConf struct {
    CNIVersion string `json:"cniVersion,omitempty"`

    Name         string          `json:"name,omitempty"`
    Type         string          `json:"type,omitempty"`
    Capabilities map[string]bool `json:"capabilities,omitempty"`
    IPAM         IPAM            `json:"ipam,omitempty"`
    DNS          DNS             `json:"dns"`

    RawPrevResult map[string]interface{} `json:"prevResult,omitempty"`
    PrevResult    Result                 `json:"-"`
}

    veth, peer, tmpIfName := connector.SetupVeth(ep.ContainerID, DeviceMTU, ep)

    netlink.LinkSetNsFd(*peer, int(netNs.Fd()))

    connector.SetupVethRemoteNs(netNs, tmpIfName, args.IfName)

    ipam := c.IPAMAllocate("")

    podName := cniArgs.K8S_POD_NAMESPACE + "/" + cniArgs.K8S_POD_NAME
    ipam := c.IPAMAllocate("", podName) // c: cilium client.

// pkt/client/ipam.go

// IPAMAllocate allocates an IP address out of address family specific pool.
func (c *Client) IPAMAllocate(family, owner string) (*models.IPAMResponse, error) {
    params := ipam.NewPostIPAMParams().WithTimeout(api.ClientTimeout)

    if family != ""
        params.SetFamily(&family)
    if owner != ""
        params.SetOwner(&owner)

    resp, err := c.IPAM.PostIPAM(params)
    return resp.Payload, nil
}

type Client struct {
    clientapi.Cilium
}

// clientapi
type Cilium struct {
    Daemon *daemon.Client

    Endpoint *endpoint.Client
    IPAM *ipam.Client              // implemented in "api/v1/client/ipam"
    Metrics *metrics.Client
    Policy *policy.Client
    Prefilter *prefilter.Client
    Service *service.Client
    Transport runtime.ClientTransport
}

func (a *Client) PostIPAM(params *PostIPAMParams) (*PostIPAMCreated, error) {
    result := a.transport.Submit(&runtime.ClientOperation{
        ID:                 "PostIPAM",
        Method:             "POST",
        PathPattern:        "/ipam",
        Params:             params,
    })
    return result.(*PostIPAMCreated), nil
}

func (o *PostIPAM) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
    route, rCtx, _ := o.Context.RouteInfo(r)
    var Params = NewPostIPAMParams()

    if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
        o.Context.Respond(rw, r, route.Produces, route, err)
        return
    }

    res := o.Handler.Handle(Params) // actually handle the request
    o.Context.Respond(rw, r, route.Produces, route, res)
}

// daemon/cmd/ipam.go

// Handle incoming requests address allocation requests for the daemon.
func (h *postIPAM) Handle(params ipamapi.PostIPAMParams) middleware.Responder {
    resp := &models.IPAMResponse{
        HostAddressing: node.GetNodeAddressing(),
        Address:        &models.AddressPair{},
    }

    ipv4, ipv6 := h.daemon.ipam.AllocateNext(params.Family)

    if ipv4 != nil
        resp.Address.IPV4 = ipv4.String()

    return ipamapi.NewPostIPAMCreated().WithPayload(resp)
}

import "k8s.io/kubernetes/pkg/registry/core/service/ipallocator"

// NewIPAM returns a new IP address manager
func NewIPAM(nodeAddressing datapath.NodeAddressing, c Configuration) *IPAM {
    ipam := &IPAM{
        nodeAddressing: nodeAddressing,
        config:         c,
    }

    if c.EnableIPv4
        ipam.IPv4Allocator = ipallocator.NewCIDRRange(nodeAddressing.IPv4().AllocationCIDR().IPNet)

    return ipam
}

// pkg/ipam/allocator.go

// AllocateNext allocates the next available IPv4 and IPv6 address out of the configured address pool.
func (ipam *IPAM) AllocateNext(family string) (ipv4 net.IP, ipv6 net.IP, err error) {
    ipv4 = ipam.AllocateNextFamily(IPv4)
}

// AllocateNextFamily allocates the next IP of the requested address family
func (ipam *IPAM) AllocateNextFamily(family Family) (ip net.IP, err error) {
    switch family {
    case IPv4:
        ip = allocateNextFamily(family, ipam.IPv4Allocator)
    default:
        fmt.Errorf("unknown address \"%s\" family requested", family)
    }
}

func allocateNextFamily(family Family, allocator *ipallocator.Range) (ip net.IP, err error) {
    ip = allocator.AllocateNext()
}

// k8s.io/kubernetes/pkg/registry/core/service/ipallocator

func (r *Range) AllocateNext() (net.IP, error) {
    offset, ok := r.alloc.AllocateNext()
    return addIPOffset(r.base, offset), nil
}

// Interface manages the allocation of IP addresses out of a range. Interface should be threadsafe.
type Interface interface {
    Allocate(net.IP) error
    AllocateNext() (net.IP, error)
    Release(net.IP) error
    ForEach(func(net.IP))
}

// k8s.io/kubernetes/pkg/registry/core/service/allocator/bimap.go

// AllocateNext reserves one of the items from the pool.
// (0, false, nil) may be returned if there are no items left.
func (r *AllocationBitmap) AllocateNext() (int, bool, error) {
    next, ok := r.strategy.AllocateBit(r.allocated, r.max, r.count)
    r.count++
    r.allocated = r.allocated.SetBit(r.allocated, next, 1)
    return next, true, nil
}

func (rss randomScanStrategy) AllocateBit(allocated *big.Int, max, count int) (int, bool) {
    if count >= max {
        return 0, false
    }
    offset := rss.rand.Intn(max)
    for i := 0; i < max; i++ {
        at := (offset + i) % max
        if allocated.Bit(at) == 0 {
            return at, true
        }
    }
    return 0, false
}

func (contiguousScanStrategy) AllocateBit(allocated *big.Int, max, count int) (int, bool) {
    if count >= max {
        return 0, false
    }
    for i := 0; i < max; i++ {
        if allocated.Bit(i) == 0 {
            return i, true
        }
    }
    return 0, false
}

    if ipv4IsEnabled(ipam) {
        ep.Addressing.IPV4 = ipam.Address.IPV4

        ipConfig, routes := prepareIP(ep.Addressing.IPV4, false, &state, int(conf.RouteMTU))
        res.IPs = append(res.IPs, ipConfig)
        res.Routes = append(res.Routes, routes...)
    }

    netNs.Do(func(_ ns.NetNS) error {
        allInterfacesPath := filepath.Join("/proc", "sys", "net", "ipv6", "conf", "all", "disable_ipv6")
        connector.WriteSysConfig(allInterfacesPath, "0\n")
        macAddrStr = configureIface(ipam, args.IfName, &state)
        return err
    })

// plugins/cilium-cni/cilium-cni.go

func prepareIP(ipAddr string, isIPv6 bool, state *CmdState, mtu int) (*cniTypesVer.IPConfig, []*cniTypes.Route) {
    if isIPv6 {
        ...
    } else {
        state.IP4 = addressing.NewCiliumIPv4(ipAddr)
        state.IP4routes = connector.IPv4Routes(state.HostAddr, mtu)
        routes = state.IP4routes
        ip = state.IP4
        gw = connector.IPv4Gateway(state.HostAddr)
        ipVersion = "4"
    }

    rt := []*cniTypes.Route{}
    for _, r := range routes {
        rt = append(rt, newCNIRoute(r))
    }

    gwIP := net.ParseIP(gw)

    return &cniTypesVer.IPConfig{
        Address: *ip.EndpointPrefix(),
        Gateway: gwIP,
        Version: ipVersion,
    }, rt, nil
}

type CiliumIP interface {
    IPNet(ones int) *net.IPNet
    EndpointPrefix() *net.IPNet
    IP() net.IP
    String() string
    IsIPv6() bool
    GetFamilyString() string
    IsSet() bool
}

func IPv4Routes(addr *models.NodeAddressing, linkMTU int) ([]route.Route, error) {
    ip := net.ParseIP(addr.IPV4.IP)
    return []route.Route{
        {
            Prefix: net.IPNet{
                IP:   ip,
                Mask: defaults.ContainerIPv4Mask,
            },
        },
        {
            Prefix:  defaults.IPv4DefaultRoute,
            Nexthop: &ip,
            MTU:     linkMTU,
        },
    }, nil
}

// IPv4Gateway returns the IPv4 gateway address for endpoints.
func IPv4Gateway(addr *models.NodeAddressing) string {
    // The host's IP is the gateway address
    return addr.IPV4.IP
}

func configureIface(ipam *models.IPAMResponse, ifName string, state *CmdState) (string, error) {
    l := netlink.LinkByName(ifName)

    addIPConfigToLink(state.IP4, state.IP4routes, l, ifName)
    netlink.LinkSetUp(l)
}

func addIPConfigToLink(...) error {
    addr := &netlink.Addr{IPNet: ip.EndpointPrefix()}
    netlink.AddrAdd(link, addr)

    sort.Sort(route.ByMask(routes))
    for _, r := range routes {
        rt := &netlink.Route{
            LinkIndex: link.Attrs().Index,
            Scope:     netlink.SCOPE_UNIVERSE,
            Dst:       &r.Prefix,
            MTU:       r.MTU,
        }

        if r.Nexthop == nil {
            rt.Scope = netlink.SCOPE_LINK
        } else {
            rt.Gw = *r.Nexthop
        }
        netlink.RouteAdd(rt)
    }
}

// api/v1/models/endpoint.go

type Endpoint struct {
    // The cilium-agent-local ID of the endpoint
    ID int64 `json:"id,omitempty"`

    // The desired configuration state of the endpoint
    Spec *EndpointConfigurationSpec `json:"spec,omitempty"`

    // The desired and realized configuration state of the endpoint
    Status *EndpointStatus `json:"status,omitempty"`
}

    ep.SyncBuildEndpoint = true
    c.EndpointCreate(ep)

// pkg/client/endpoint.go

func (c *Client) EndpointCreate(ep *models.EndpointChangeRequest) error {
    id := pkgEndpointID.NewCiliumID(ep.ID)
    params := endpoint.NewPutEndpointIDParams().WithID(id).WithEndpoint(ep).WithTimeout(api.ClientTimeout)
    c.Endpoint.PutEndpointID(params)
    return Hint(err)
}

// pkg/endpoint/id/id.go

const (
    // CiliumLocalIdPrefix is a numeric identifier with local scope. It has
    // no cluster wide meaning and is only unique in the scope of a single
    // agent. An endpoint is guaranteed to always have a local scope identifier.
    CiliumLocalIdPrefix PrefixType = "cilium-local"
)

// NewCiliumID returns a new endpoint identifier of type CiliumLocalIdPrefix
func NewCiliumID(id int64) string {
    return fmt.Sprintf("%s:%d", CiliumLocalIdPrefix, id)
}

// api/client/endpoint/endpoint_client.go

func (a *Client) PutEndpointID(params *PutEndpointIDParams) (*PutEndpointIDCreated, error) {
    result := a.transport.Submit(&runtime.ClientOperation{
        ID:                 "PutEndpointID",
        Method:             "PUT",
        PathPattern:        "/endpoint/{id}",
        Params:             params,
    })
    return result.(*PutEndpointIDCreated), nil
}

// api/server/restapi/endpint/put_endpoint_id.go

type PutEndpointID struct {
    Context *middleware.Context
    Handler PutEndpointIDHandler
}

func (o *PutEndpointID) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
    route, rCtx, _ := o.Context.RouteInfo(r)
    var Params = NewPutEndpointIDParams()

    if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
        o.Context.Respond(rw, r, route.Produces, route, err)
        return
    }

    res := o.Handler.Handle(Params) // actually handle the request
    o.Context.Respond(rw, r, route.Produces, route, res)
}

type putEndpointID struct {
    d *Daemon
}

func NewPutEndpointIDHandler(d *Daemon) PutEndpointIDHandler {
    return &putEndpointID{d: d}
}

func (h *putEndpointID) Handle(params PutEndpointIDParams) middleware.Responder {
    epTemplate := params.Endpoint

    h.d.createEndpoint(params.HTTPRequest.Context(), epTemplate)
}

func (d *Daemon) createEndpoint(ctx, epTemplate) (*endpoint.Endpoint, int) {
    ep, err := endpoint.NewEndpointFromChangeModel(epTemplate)

    if oldEp := endpointmanager.LookupCiliumID(ep.ID); oldEp != nil
        return fmt.Errorf("endpoint ID %d already exists", ep.ID)
    if oldEp = endpointmanager.LookupContainerID(ep.ContainerID); oldEp != nil
        return fmt.Errorf("endpoint for container %s already exists", ep.ContainerID)

    addLabels := labels.NewLabelsFromModel(epTemplate.Labels)
    infoLabels := []string{}
    identityLabels, info := fetchK8sLabels(ep)
    addLabels.MergeLabels(identityLabels)
    infoLabels.MergeLabels(info)

    endpointmanager.AddEndpoint(d, ep, "Create endpoint from API PUT")

    ep.UpdateLabels(ctx, d, addLabels, infoLabels, true)

    // Now that we have ep.ID we can pin the map from this point. This
    // also has to happen before the first build took place.
    ep.PinDatapathMap()

    if build {
        ep.Regenerate(d, &endpoint.ExternalRegenerationMetadata{
            Reason:        "Initial build on endpoint creation",
            ParentContext: ctx,
        })
    }
}

// pkg/endpoint/manager.go

// Expose exposes the endpoint to the endpointmanager. After this function
// is called, the endpoint may be accessed by any lookup in the endpointmanager.
func (e *Endpoint) Expose(mgr endpointManager) error {
    newID := mgr.AllocateID(e.ID)
    e.ID = newID

    e.startRegenerationFailureHandler()
    // Now that the endpoint has its ID, it can be created with a name based on
    // its ID, and its eventqueue can be safely started. Ensure that it is only
    // started once it is exposed to the endpointmanager so that it will be
    // stopped when the endpoint is removed from the endpointmanager.
    e.eventQueue = eventqueue.NewEventQueueBuffered(fmt.Sprintf("endpoint-%d", e.ID))
    e.eventQueue.Run()

    // No need to check liveness as an endpoint can only be deleted via the
    // API after it has been inserted into the manager.
    mgr.UpdateIDReference(e)
    e.updateReferences(mgr)

    mgr.RunK8sCiliumEndpointSync(e, option.Config)
    return nil
}

// ipkg/k8s/watchers/endpointsynchronizer.go

// RunK8sCiliumEndpointSync starts a controller that synchronizes the endpoint
// to the corresponding k8s CiliumEndpoint CRD. It is expected that each CEP
// has 1 controller that updates it, and a local copy is retained and only
// updates are pushed up.
func (epSync *EndpointSynchronizer) RunK8sCiliumEndpointSync(e *endpoint.Endpoint, conf) {
    var (
        endpointID     = e.ID
        controllerName = fmt.Sprintf("sync-to-k8s-ciliumendpoint (%v)", endpointID)
    )

    ciliumClient := k8s.CiliumClient().CiliumV2()

    e.UpdateController(controllerName,
        controller.ControllerParams{
            RunInterval: 10 * time.Second,
            DoFunc: func(ctx context.Context) (err error) {
                podName := e.GetK8sPodName()
                namespace := e.GetK8sNamespace()

                switch {
                default:
                    scopedLog.Debug("Updating CEP from local copy")
                    switch {
                    case capabilities.UpdateStatus:
                        localCEP = ciliumClient.CiliumEndpoints(namespace).UpdateStatus()
                    default:
                        localCEP = ciliumClient.CiliumEndpoints(namespace).Update()
                    }
                }
            },
        })
}

// pkg/endpoint/endpoint.go

// UpdateLabels is called to update the labels of an endpoint. Calls to this
// function do not necessarily mean that the labels actually changed. The
// container runtime layer will periodically synchronize labels.
//
// If a net label changed was performed, the endpoint will receive a new
// security identity and will be regenerated. Both of these operations will
// run first synchronously if 'blocking' is true, and then in the background.
//
// Returns 'true' if endpoint regeneration was triggered.
func (e *Endpoint) UpdateLabels(ctx, identityLabels, infoLabels, blocking bool) (regenTriggered bool) {
	e.replaceInformationLabels(infoLabels)

	// replace identity labels and update the identity if labels have changed
	rev := e.replaceIdentityLabels(identityLabels)
	if rev != 0 {
		return e.runIdentityResolver(ctx, rev, blocking)
	}

	return false
}

// pkg/endpoint/policy.go

// Regenerate forces the regeneration of endpoint programs & policy
func (e *Endpoint) Regenerate(owner Owner, regenMetadata *ExternalRegenerationMetadata) <-chan bool {
    done := make(chan bool, 1)
    go func() {
        defer func() {
            done <- buildSuccess
            close(done)
        }()

        doneFunc := owner.QueueEndpointBuild(uint64(e.ID))
        if doneFunc != nil {
            regenContext.DoneFunc = doneFunc
            err := e.regenerate(owner, regenContext)
            doneFunc() // in case not called already

            // notify monitor about endpoint regeneration result
        } else {
            buildSuccess = false
        }
    }()

    return done
}

func (e *Endpoint) regenerate(owner Owner, context *regenerationContext) (retErr error) {
    origDir := e.StateDirectoryPath()
    context.datapathRegenerationContext.currentDir = origDir

    // This is the temporary directory to store the generated headers,
    // the original existing directory is not overwritten until the
    // entire generation process has succeeded.
    tmpDir := e.NextDirectoryPath()
    context.datapathRegenerationContext.nextDir = tmpDir
    os.MkdirAll(tmpDir, 0777)

    revision, compilationExecuted = e.regenerateBPF(owner, context)

    return e.updateRealizedState(stats, origDir, revision, compilationExecuted)
}

func (e *Endpoint) regenerateBPF(owner Owner, regenContext *regenerationContext) (revnum uint64, compiled bool, reterr error) {
    e.runPreCompilationSteps(owner, regenContext)

    if option.Config.DryMode { // No need to compile BPF in dry mode.
        return e.nextPolicyRevision, false, nil
    }

    // Wait for connection tracking cleaning to complete
    <-datapathRegenCtxt.ctCleaned

    compilationExecuted = e.realizeBPFState(regenContext)

    // Hook the endpoint into the endpoint and endpoint to policy tables then expose it
    eppolicymap.WriteEndpoint(datapathRegenCtxt.epInfoCache.keys, e.PolicyMap.Fd)
    lxcmap.WriteEndpoint(datapathRegenCtxt.epInfoCache)

    // Signal that BPF program has been generated.
    // The endpoint has at least L3/L4 connectivity at this point.
    e.CloseBPFProgramChannel()

    // Allow another builder to start while we wait for the proxy
    if regenContext.DoneFunc != nil {
        regenContext.DoneFunc()
    }

    e.ctCleaned = true

    // Synchronously try to update PolicyMap for this endpoint.
    //
    // This must be done after allocating the new redirects, to update the
    // policy map with the new proxy ports.
    e.syncPolicyMap()

    return datapathRegenCtxt.epInfoCache.revision, compilationExecuted, err
}

// runPreCompilationSteps runs all of the regeneration steps that are necessary
// right before compiling the BPF for the given endpoint.
func (e *Endpoint) runPreCompilationSteps(owner Owner, regenContext *regenerationContext) (error) {
    currentDir := datapathRegenCtxt.currentDir
    nextDir := datapathRegenCtxt.nextDir

    if e.PolicyMap == nil {
        e.PolicyMap = policymap.OpenMap(e.PolicyMapPathLocked())
        e.PolicyMap.Flush() // Clean up map contents

        // Also reset the in-memory state of the realized state as the
        // BPF map content is guaranteed to be empty right now.
        e.realizedPolicy.PolicyMapState = make(policy.MapState)
    }

    if e.bpfConfigMap == nil {
        e.bpfConfigMap = bpfconfig.OpenMapWithName(e.BPFConfigMapPath(), e.BPFConfigMapName())
        e.realizedBPFConfig = &bpfconfig.EndpointConfig{}
    }

    // Only generate & populate policy map if a security identity is set up for
    // this endpoint.
    if e.SecurityIdentity != nil {
        err = e.regeneratePolicy(owner)

        // Configure the new network policy with the proxies.
        e.updateNetworkPolicy(owner, datapathRegenCtxt.proxyWaitGroup)
    }

    // Generate header file specific to this endpoint for use in compiling
    // BPF programs for this endpoint.
    e.writeHeaderfile(nextDir, owner)
}

func (e *Endpoint) realizeBPFState(regenContext *regenerationContext) (compilationExecuted bool, err error) {
    if datapathRegenCtxt.bpfHeaderfilesChanged || datapathRegenCtxt.reloadDatapath {
        // Compile and install BPF programs for this endpoint
        if datapathRegenCtxt.bpfHeaderfilesChanged {
            loader.CompileAndLoad(datapathRegenCtxt.completionCtx, datapathRegenCtxt.epInfoCache)
            compilationExecuted = true
        } else {
            loader.ReloadDatapath(datapathRegenCtxt.completionCtx, datapathRegenCtxt.epInfoCache)
        }

        e.bpfHeaderfileHash = datapathRegenCtxt.bpfHeaderfilesHash
    } else {
        Debug("BPF header file unchanged, skipping BPF compilation and installation")
    }

    return compilationExecuted, nil
}

// Expects the caller to have created the directory at the path ep.StateDir().
func CompileAndLoad(ctx context.Context, ep endpoint) error {
    dirs := directoryInfo{
        Library: option.Config.BpfDir,
        Runtime: option.Config.StateDir,
        State:   ep.StateDir(),
        Output:  ep.StateDir(),
    }
    return compileAndLoad(ctx, ep, &dirs)
}

func compileAndLoad(ctx context.Context, ep endpoint, dirs *directoryInfo) error {
    compileDatapath(ctx, ep, dirs, debug)
    return reloadDatapath(ctx, ep, dirs)
}

// compileDatapath invokes the compiler and linker to create all state files for
// the BPF datapath, with the primary target being the BPF ELF binary.
//
// If debug is enabled, create also the following output files:
// * Preprocessed C
// * Assembly
// * Object compiled with debug symbols
func compileDatapath(ctx context.Context, ep endpoint, dirs *directoryInfo, debug bool) error {
    // Compile the new program
    compile(ctx, datapathProg, dirs, debug)
}

// compile and link a program.
func compile(ctx context.Context, prog *progInfo, dir *directoryInfo, debug bool) (err error) {
    args := make([]string, 0, 16)
    if prog.OutputType == outputSource {
        args = append(args, "-E") // Preprocessor
    } else {
        args = append(args, "-emit-llvm")
        if debug {
            args = append(args, "-g")
        }
    }
    args = append(args, standardCFlags...)
    args = append(args, progCFlags(prog, dir)...)

    // Compilation is split between two exec calls. First clang generates
    // LLVM bitcode and then later llc compiles it to byte-code.
    if prog.OutputType == outputSource {
        compileCmd := exec.CommandContext(ctx, compiler, args...)
        _ = compileCmd.CombinedOutput(log, debug)
    } else {
        switch prog.OutputType {
        case outputObject:
            compileAndLink(ctx, prog, dir, debug, args...)
        case outputAssembly:
            compileAndLink(ctx, prog, dir, false, args...)
        default:
            log.Fatalf("Unhandled progInfo.OutputType %s", prog.OutputType)
        }
    }
}

func reloadDatapath(ctx context.Context, ep endpoint, dirs *directoryInfo) error {
    // Replace the current program
    objPath := path.Join(dirs.Output, endpointObj)
    if ep.MustGraftDatapathMap() {
        if err := graftDatapath(ctx, ep.MapPath(), objPath, symbolFromEndpoint); err != nil {
            scopedLog := ep.Logger(Subsystem).WithFields(logrus.Fields{
                logfields.Path: objPath,
            })
            scopedLog.WithError(err).Warn("JoinEP: Failed to load program")
            return err
        }
    } else {
        if err := replaceDatapath(ctx, ep.InterfaceName(), objPath, symbolFromEndpoint); err != nil {
            scopedLog := ep.Logger(Subsystem).WithFields(logrus.Fields{
                logfields.Path: objPath,
                logfields.Veth: ep.InterfaceName(),
            })
            scopedLog.WithError(err).Warn("JoinEP: Failed to load program")
            return err
        }
    }

    return nil
}

// replaceDatapath the qdisc and BPF program for a endpoint
func replaceDatapath(ctx context.Context, ifName string, objPath string, progSec string) error {
    err := replaceQdisc(ifName)

    cmd := exec.CommandContext(ctx, "cilium-map-migrate", "-s", objPath)
    cmd.CombinedOutput(log, true)

    defer func() {
        if err == nil {
            retCode = "0"
        } else {
            retCode = "1"
        }
        args := []string{"-e", objPath, "-r", retCode}
        cmd := exec.CommandContext(ctx, "cilium-map-migrate", args...)
        _, _ = cmd.CombinedOutput(log, true) // ignore errors
    }()

    args := []string{"filter", "replace", "dev", ifName, "ingress",
        "prio", "1", "handle", "1", "bpf", "da", "obj", objPath,
        "sec", progSec,
    }
    cmd = exec.CommandContext(ctx, "tc", args...).WithFilters(libbpfFixupMsg)
    _ = cmd.CombinedOutput(log, true)
}

func replaceQdisc(ifName string) error {
    link, err := netlink.LinkByName(ifName)
    attrs := netlink.QdiscAttrs{
        LinkIndex: link.Attrs().Index,
        Handle:    netlink.MakeHandle(0xffff, 0),
        Parent:    netlink.HANDLE_CLSACT,
    }

    qdisc := &netlink.GenericQdisc{
        QdiscAttrs: attrs,
        QdiscType:  "clsact",
    }

    netlink.QdiscReplace(qdisc)
}