On 2023/11/24 17:47, Daniel Borkmann wrote:
On 11/23/23 1:37 PM, Philo Lu wrote:
Sorry, I forgot to cc the maintainers.
On 2023/11/23 11:07, Philo Lu wrote:
Add 3 sock_ops operators, namely BPF_SOCK_OPS_DATA_SEND_CB,
BPF_SOCK_OPS_DATA_RECV_CB, and BPF_SOCK_OPS_DATA_ACKED_CB. A flag
BPF_SOCK_OPS_DATA_EVENT_CB_FLAG is provided to minimize the performance
impact. The flag must be explicitly set to enable these callbacks.
If the flag is enabled, bpf sock_ops program will be called every
time a
tcp data packet is sent, received, and acked.
BPF_SOCK_OPS_DATA_SEND_CB: call bpf after a data packet is sent.
BPF_SOCK_OPS_DATA_RECV_CB: call bpf after a data packet is receviced.
BPF_SOCK_OPS_DATA_ACKED_CB: call bpf after a valid ack packet is
processed (some sent data are ackknowledged).
We use these callbacks for fine-grained tcp monitoring, which collects
and analyses every tcp request/response event information. The whole
system has been described in SIGMOD'18 (see
https://dl.acm.org/doi/pdf/10.1145/3183713.3190659 for details). To
achieve this with bpf, we require hooks for data events that call
sock_ops bpf (1) when any data packet is sent/received/acked, and (2)
after critical tcp state variables have been updated (e.g., snd_una,
snd_nxt, rcv_nxt). However, existing sock_ops operators cannot meet our
requirements.
Besides, these hooks also help to debug tcp when data send/recv/acked.
Signed-off-by: Philo Lu <lulie@xxxxxxxxxxxxxxxxx>
---
include/net/tcp.h | 9 +++++++++
include/uapi/linux/bpf.h | 14 +++++++++++++-
net/ipv4/tcp_input.c | 4 ++++
net/ipv4/tcp_output.c | 2 ++
4 files changed, 28 insertions(+), 1 deletion(-)
Please also add selftests for the new hooks, and speaking of the latter
looks like this fails current BPF selftests :
https://github.com/kernel-patches/bpf/actions/runs/6974541866/job/18980491457
We will add selftests in the next version. The current selftests fail just
because of the new flag added, and we can also fix this in the next version.
