inet_csk_accept ebpf program doesn't work properly
- Dominant language
- Go
- Stars
- 3.2k
- Forks
- 304
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 78
Description
`kretprobe/inet_csk_accept` (reason `TCP_ACCEPT_BASIC`) has two issues:
1. it misses some drops (it does a single rather than double pointer dereference of the value retrieved from `accept_pids` map; the rerieved pointer (and not underlying value) is assigned to `int` which given 2's complement notation means that anytime the memory address of the `err` value has the most significant bit == 0 (positive number), it returns early thinking the underlying function didn't indicate a drop).
2. it doesn't track **bytes dropped** for any packet it processes (it calls `get_packet_from_sock` which doesn't populate the packet's `skb_len`, since that value is not available in the socket struct this ebpf hook receives as input; this means that the subsequent call to `update_metrics_map` doesn't increase the drop bytes metrics)
Solutions:
1. I tried 2 approaches unsuccessfully so far: doing the second pointer deref (ebpf verifier failure); storing the actual error value from `inet_csk_accept` rather than the pointer, as a signed int, which obviates the need for the double deref, but also got a verifier error.
2. We'd need to figure out how to get the sk_buff from the socket.
Contributor guide
Assessment
This issue has not been assessed yet.