On 10/30/24 7:41 PM, Jason Xing wrote:
All that said, while looking at tcp_tx_timestamp() again, there is always
"shinfo->tskey = TCP_SKB_CB(skb)->seq + skb->len - 1;". shinfo->tskey can be
used directly as-is by the bpf prog. I think now I am missing why the bpf prog
needs the sk_tskey in the sk?
As you said, tcp seqno could be treated as the key, but it leaks the
information in TCP layer to users. Please see the commit:
I don't think it is a concern for bpf prog running in the kernel. The sockops
bpf prog can already read the sk, the skb (which has seqno), and many others.
The bpf prog is not a print-only logic. Only using bpf prog to do raw data
dumping is not fully utilizing its capability, e.g. data aggregation. The bpf
prog should aggregate the data first which is to calculate the delay here.
