Stop tracking skb in the end of its lifetime #241
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The outstanding issue is, I can't come up with a good flag name. In the 3rd commit, I added a flag But I don't think |
jschwinger233
force-pushed
the
gray/skb-lifetime
branch
from
aab3737
to
debe343
Compare
Previous injection assumes the next instruction to `printk()` is
"goto <label_return>", which isn't guaranteed by clang.
Technically, previous injection adds a ret insn to implement "exit
immediately if not matched":
asm.Return().WithSymbol("return")
which forces us to remove the duplicated assumed "goto <label_return>"
after `printk()`.
This commit improves the way to inject ebpf pcap filter without such
assumption by setting proper values to registers to avoid adding ret
insn.
Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
jschwinger233
force-pushed
the
gray/skb-lifetime
branch
from
debe343
to
963b12b
Compare
jschwinger233
commented
Aug 28, 2023
main.go
Outdated
| if flags.FilterTrackSkb { | ||
| skbLifetimeEndAt := []string{"kfree_skbmem"} | ||
| if !flags.FilterTrackSkbAcrossNamespaces { | ||
| skbLifetimeEndAt = append(skbLifetimeEndAt, "eth_type_trans") |
There was a problem hiding this comment.
I don't know how to do it flexibly without hard coding eth_type_trans and kfree_skbmem - -
Tough one 😅 What's about |
|
Marking As for Below is a typical pwru output for an egress traffic inside a netns:
I don't know how to stop tracking an egress skb. |
|
Maybe only handle Below is pwru output for an egress skb on bare metal: As we see, there is a The disadvantage of stopping tracking only at A quick fix for that is to filter the events in userspace: we double check the skb's netns before printing them from golang process. Edit: nothing needs to be fixed.
|
SGTM! |
jschwinger233
force-pushed
the
gray/skb-lifetime
branch
from
963b12b
to
560314b
Compare
`kfree_skbmem` marks the end of an skb's lifetime, so we stop tracking it at that time when `--filter-track-skb` is enabled. Signed-off-by: Zhichuan Liang <gray.liang@isovalent.com>
jschwinger233
force-pushed
the
gray/skb-lifetime
branch
from
560314b
to
f96c270
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
--filter-track-skbhas a problem of mismatching skbs with same pointer address. This PR tries to fix it by stopping tracking after an skb ends its lifetime.In general, an skb has 3 possible endings:
All the three endings hit
kfree_skbmemeventually, so we delete tracked skb pointer address from bpf map at that time.Fixes: #194
Signed-off-by: Zhichuan Liang gray.liang@isovalent.com