[Reposting with correct format this time. Sorry.] On Fri, Jun 21, 2019 at 12:20 AM CEST, Joe Stringer wrote: > On Wed, Jun 19, 2019 at 2:14 AM Jakub Sitnicki <jakub@xxxxxxxxxxxxxx> wrote: >> >> Hey Florian, >> >> Thanks for taking a look at it. >> >> On Tue, Jun 18, 2019 at 03:52 PM CEST, Florian Westphal wrote: >> > Jakub Sitnicki <jakub@xxxxxxxxxxxxxx> wrote: >> >> - XDP programs using bpf_sk_lookup helpers, like load balancers, can't >> >> find the listening socket to check for SYN cookies with TPROXY redirect. >> > >> > Sorry for the question, but where is the problem? >> > (i.e., is it with TPROXY or bpf side)? >> >> The way I see it is that the problem is that we have mappings for >> steering traffic into sockets split between two places: (1) the socket >> lookup tables, and (2) the TPROXY rules. >> >> BPF programs that need to check if there is a socket the packet is >> destined for have access to the socket lookup tables, via the mentioned >> bpf_sk_lookup helper, but are unaware of TPROXY redirects. >> >> For TCP we're able to look up from BPF if there are any established, >> request, and "normal" listening sockets. The listening sockets that >> receive connections via TPROXY are invisible to BPF progs. >> >> Why are we interested in finding all listening sockets? To check if any >> of them had SYN queue overflow recently and if we should honor SYN >> cookies. > > Why are they invisible? Can't you look them up with bpf_skc_lookup_tcp()? They are invisible in that sense that you can't look them up using the packet 4-tuple. You have to somehow make the XDP/TC progs aware of the TPROXY redirects to find the target sockets. -Jakub
