microsoft / microsoft/retina

inet_csk_accept ebpf program doesn't work properly

Open
#715 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
3.2k
Forks
304
Avg merge
1d 19h
Merged PRs (30d)
78

Description

`kretprobe/inet_csk_accept` (reason `TCP_ACCEPT_BASIC`) has two issues:

1. it misses some drops (it does a single rather than double pointer dereference of the value retrieved from `accept_pids` map; the rerieved pointer (and not underlying value) is assigned to `int` which given 2's complement notation means that anytime the memory address of the `err` value has the most significant bit == 0 (positive number), it returns early thinking the underlying function didn't indicate a drop).

2. it doesn't track **bytes dropped** for any packet it processes (it calls `get_packet_from_sock` which doesn't populate the packet's `skb_len`, since that value is not available in the socket struct this ebpf hook receives as input; this means that the subsequent call to `update_metrics_map` doesn't increase the drop bytes metrics)

Solutions:
1. I tried 2 approaches unsuccessfully so far: doing the second pointer deref (ebpf verifier failure); storing the actual error value from `inet_csk_accept` rather than the pointer, as a signed int, which obviates the need for the double deref, but also got a verifier error.

2. We'd need to figure out how to get the sk_buff from the socket.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.