fix(link): add missing BPF_F_REPLACE flag for RawAttachProgram

[wucm667]

Fixes #1994

Summary

When using RawAttachProgram with Anchor: link.ReplaceProgram(oldProg), the BPF_F_REPLACE flag was not being set in AttachFlags. This caused the kernel to silently ignore the replacement and treat the call as a regular append, resulting in two programs being attached instead of one being replaced.

Root Cause

In link/program.go, when flags == sys.BPF_F_REPLACE:

• attr.ReplaceBpfFd was set correctly
• But attr.AttachFlags was not updated with sys.BPF_F_REPLACE

Per the Linux kernel (commit 7dd68b3), the kernel requires BPF_F_REPLACE in attach_flags to perform the replacement — without it, replace_bpf_fd is ignored.

Fix

Add attr.AttachFlags |= sys.BPF_F_REPLACE in the BPF_F_REPLACE branch of RawAttachProgram, ensuring the kernel actually performs the replacement operation.

[michalskrivanek]

Thank you for the quick fix!
I can confirm the patch fixes the problem.

[wucm667]

@michalskrivanek Good catch — you're right, that comment was misleading. Updated it to clarify that the kernel requires BPF_F_REPLACE in attach_flags for the replace operation to take effect, not just on old kernels.

[wucm667]

@michalskrivanek @mmat11 Heads up on the CI — the Build and Lint failures (3 govet inline warnings in and ) are pre-existing and unrelated to my change in .

They appear to be triggered by a new inline check in the latest golangci-lint version. Happy to help fix those if needed, or we can handle them separately.

[mmat11]

would it be possible to add a test that exercises this code path?

[wucm667]

@mmat11 Done both:

1. Refactored AttachFlags assignment — set attr.AttachFlags |= flags unconditionally before the if/else, which now only routes fdOrID to ReplaceBpfFd or RelativeFdOrId.
2. Added TestRawAttachProgramReplace — attaches progA, replaces it with progB using ReplaceProgram(progA), then queries attached programs to verify only progB remains (not both).

All changes compile cleanly and go vet passes. Runtime tests require CAP_BPF so they'll run in CI.

[ti-mo]

Thanks! This needs a rebase to pass CI, and detach errors shouldn't be ignored. Please squash this into a single commit.

Also, for awareness, our GenAI policy is about to be finalized and will go into effect soon: cilium/community#408. I'm calling this out because your replies feel very generated, and this won't be allowed under the new policy. Please don't be afraid of making mistakes! Most of us aren't native speakers either. We'd rather talk to a real human, we have agents too, just like everyone else. :)

[wucm667]

done, rebased and squashed. moved the detach into t.Cleanup with assert