Re: [PATCH net-next] net: bpf: add hook for close of tcp timewait sock

On Thu, Dec 30, 2021 at 12:46 AM Alexei Starovoitov
[off-list ref] wrote:

On Wed, Dec 29, 2021 at 3:33 AM [off-list ref] wrote:

quoted

From: Menglong Dong <redacted>

The cgroup eBPF attach type 'CGROUP_SOCK_OPS' is able to monitor the
state change of a tcp connect with 'BPF_SOCK_OPS_STATE_CB' ops.

However, it can't trace the whole state change of a tcp connect. While
a connect becomes 'TCP_TIME_WAIT' state, this sock will be release and
a tw sock will be created. While tcp sock release, 'TCP_CLOSE' state
change will be passed to eBPF program. Howeven, the real state of this
connect is 'TCP_TIME_WAIT'.

To make eBPF get the real state change of a tcp connect, add
'CGROUP_TWSK_CLOSE' cgroup attach type, which will be called when
tw sock release and tcp connect become CLOSE.

The use case is not explained.

Sorry for the absence of use cases and selftests. In my case, it is for NAT of
a docker container.

Simply speaking, I'll add an element to a hash map during sys_connect() with
'BPF_SOCK_OPS_TCP_CONNECT_CB' ops of 'BPF_CGROUP_SOCK_OPS'
cgroup attach type. Therefore, the received packet of the host can do DNAT
according to the hash map.

I need to release the element in the hashmap when the connection closes.
With the help of 'BPF_SOCK_OPS_STATE_CB', I can monitor the TCP_CLOSE
of the connection. However, as I mentioned above, it doesn't work well when
it comes to tw sock. When the connect become 'FIN_WAIT2' or 'TIME_WAIT',
the state of the tcp sock becomes 'TCP_CLOSE', which doesn't match the connect
state. Therefore, the 'fin' packet that the host received can't be DNAT, as the
element is already removed.

In this patch, BPF_SOCK_OPS_TW_CLOSE_FLAG is introduced, which is used
make 'BPF_SOCK_OPS_STATE_CB' not called when this sock becomes
TCP_CLOSE if it is being replaced with a tw sock.

Why bpf tracing cannot be used to achieve the same?

En...do you mean kprobe based eBPF trace? It can work, but I don't think it's
high-performance, especially for network NAT. Strictly speaking, attach types,
such as 'CGROUP_INET_SOCK_RELEASE', can be replaced by bpf tracing, but
they exist out of performance.

Thanks!
Menglong Dong

Also there are no selftests.