Reply IP packets lost when using eBPF and AF_XDP --- where do they go?

Chris Ward

10/14/23, 8:37 AM

I have a test case eBPF/AF_XDP test case which is supposed to take incoming ethernet packets from an interface, send them to user-space using an AF_XDP socket, filter them according to some criterion (for the moment I am accepting all packets), and send them into the Linux kernel for regular network stack processing using a tun/tap 'tun' interface.

To get the test case to go, you have to copy the xsk_def_xdp_prog.c file over the matching file in xdp-tools (xdp-tools/lib/libxdp/xsk_def_xdp_prog.c) , and rebuild and install libxdp.

Most inbound packets should generate a reply, e.g. an incoming ICMP ping request should generate an ICMP ping response, and an incoming tcp SYN request for an ssh session should generate a tcp ACK packet if there is an sshd running. 'tcpdump' on the tun interface confirms that the packets are arriving there.

However I don't see any reponse packets. I was expecting the response packets to go from the kernel network stack to the eth device where the eBPF program for ingress is running; but 'tcpdump' does not show anything there and neither the 'ping' nor the 'ssh' gets any response on the client machine.

I thought the packets might be going to the tun interface, but this does not appear to be the case either.

Can anyone tell me where the packets are going to and how to trace them ?

It doesn't appear that 'iptables' is discarding them; I tried 'iptables -P FORWARD ACCEPT' and 'iptables -F FORWARD' with no effect, and now 'iptables -L' shows

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

also all the 'forwarding' controls under /proc/sys/net/ipv4 are set to 1, so it is not a problem with disabled forwarding.

I am using Ubuntu 22.04 with 5.15.0-48-generic kernel.

155

0 + 3

ubuntu

tun

linux-networking

Tero Kilkanen

10/14/23, 6:10 PM

What is the role of the device that is running this `XDP` program? Is it also the destination of the traffic? Or should the device forward the traffic somewhere? Please add IP addresses of the devices and the exact commands / responses used.

Chris Ward

10/15/23, 8:55 PM

This device is trying to filter inbound packets according to rules of allowed source IPs and ports, and destnation ports (the destination IP will be 'this box'). The idea is to eventually use it in a Kubernetes sysstem, but I am doing early research at the moment. The first (SYN) packet of a TCP stream should be sent to user space, processed, and then if appropriate fed to the kernel with tun. The reply (SYN-ACK) should go from the kernel to the eth device, and this is what is getting lost. I have a client box on IP 10.1.0.9 and this box as a server om 10.1.0.10 . I am using 'ssh' to test.

Chris Ward

10/16/23, 2:23 PM

https://github.com/tjcw/xdp-tutorial/tree/master/ebpf-filter-snapshot-315 has the test case; you need to copy the xsk_def_xdp_prog.c file over the matching file in xdp-tools (xdp-tools/lib/libxdp/xsk_def_xdp_prog.c) , and rebuild and install libxdp.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Reply IP packets lost when using eBPF and AF_XDP --- where do they go?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.