On Wed, Jun 19, 2019 at 2:14 AM Jakub Sitnicki <jakub@xxxxxxxxxxxxxx> wrote: > > Hey Florian, > > Thanks for taking a look at it. > > On Tue, Jun 18, 2019 at 03:52 PM CEST, Florian Westphal wrote: > > Jakub Sitnicki <jakub@xxxxxxxxxxxxxx> wrote: > >> - XDP programs using bpf_sk_lookup helpers, like load balancers, can't > >> find the listening socket to check for SYN cookies with TPROXY redirect. > > > > Sorry for the question, but where is the problem? > > (i.e., is it with TPROXY or bpf side)? > > The way I see it is that the problem is that we have mappings for > steering traffic into sockets split between two places: (1) the socket > lookup tables, and (2) the TPROXY rules. > > BPF programs that need to check if there is a socket the packet is > destined for have access to the socket lookup tables, via the mentioned > bpf_sk_lookup helper, but are unaware of TPROXY redirects. > > For TCP we're able to look up from BPF if there are any established, > request, and "normal" listening sockets. The listening sockets that > receive connections via TPROXY are invisible to BPF progs. > > Why are we interested in finding all listening sockets? To check if any > of them had SYN queue overflow recently and if we should honor SYN > cookies. Why are they invisible? Can't you look them up with bpf_skc_lookup_tcp()?
