Where is my eBPF packet going?

Chris Ward

12/10/23, 11:39 AM

I have a test case using eBPF which sets up a 'ping' between 2 namespaces. My eBPF program intercepts the first packet of a flow, sends it to user space, where it is used to construct a map so that subsequent packets of the flow pass directly from the receiving eth to the kernel where the ping reply is generated. The first packet is then fed in to an eBPF transmit queue where I am expecting it to go to the kernel and generate a ping reply, but in fact I see no further trace of this packet; not in 'tcpdump' on the interfaces, and not in 'pwru'. Can anyone tell me what I am doing wrong ?

My test case is here https://github.com/tjcw/bpf-examples/tree/tjcw-send-first-packet-debug-20221210.1121/AF_XDP-filter ; the run script for it is here https://github.com/tjcw/bpf-examples/blob/tjcw-send-first-packet-debug-20221210.1121/AF_XDP-filter/ping-namespace-direct-with-dummy/run.sh .

The log of the run (including formatted tcpdumps) is here https://github.com/tjcw/bpf-examples/blob/tjcw-send-first-packet-debug-20221210.1121/AF_XDP-filter/ping-namespace-direct-with-dummy/runlog.txt and the log from pwru is here https://github.com/tjcw/bpf-examples/blob/tjcw-send-first-packet-debug-20221210.1121/AF_XDP-filter/ping-namespace-direct-with-dummy/pwru.txt .

I am running under Ubuntu 22.04 completely updated.

Apologies, the run log above doesn't have tcpdump output. Here https://github.com/tjcw/bpf-examples/blob/tjcw-send-first-packet-debug-20221210.1121/AF_XDP-filter/ping-namespace-direct-with-dummy/run2.txt is what I intended to post, with tcpdumps.

I have added a UDP test in directory https://github.com/tjcw/bpf-examples/tree/tjcw-send-first-packet-debug-20221212.1400/AF_XDP-filter ( see files udp-sender-count.c and udp-receiver.c , and run scripts and log files in directory udp-namespace-direct-with-dummy ) . This test case shows the first packet being redirected to user space and then being lost, and the second packet getting through to the udp listener.

129

1 + 5

linux

ubuntu

linux-networking

Chris Ward

12/10/23, 12:05 PM

This is with kernel 5.15.0-56-generic . I have previously tried a TCP session; with this the SYN packet gets lost, and TCP retries after about a second and the session connects. I will try a UDP test case next time I am at the machine. What weird special cases would affect the `ping` ?

anx

12/10/23, 12:40 PM

Just one example I ran into: ICMP defaults to invisible rate limiting.. skipped for loopback. Silly me assumed this could never confuse me because of the symmetry in and out.. but viewed from outside its not when the reply is destined for a bridge with the full address range assigned.

Chris Ward

12/10/23, 2:37 PM

I left the interfaces up at the end of the test case run so I could do some manual debugging, then tore them down and rebuilt them at the start of the test case. Are you saying I might get different results if I wait some delay time after tearing down the interfaces and before setting them up ? How long a delay.should I specify ?

anx

12/10/23, 11:46 PM

I am not aware of any relevant changes that take effect after some delay; I am merely suggesting to consider *"RTNETLINK answers: File exists"* (found that in your logs) an error. It implies in that particular run, you did not recreate the bridge from scratch.

Chris Ward

12/12/23, 11:48 AM

I have added a version of the test which uses udp instead of ping. It shows the same effect.

Score:1

Server

Chris Ward

12/12/23, 4:23 PM

My mistake was that I was not setting up the transmit buffer correctly. With the code in https://github.com/tjcw/bpf-examples/blob/tjcw-send-first-packet-debug-20221212.1612/AF_XDP-filter/af_xdp_user.c this is fixed, and the run log https://github.com/tjcw/bpf-examples/blob/tjcw-send-first-packet-debug-20221212.1612/AF_XDP-filter/ping-namespace-direct-with-dummy/runlog2.txt and pwru log https://github.com/tjcw/bpf-examples/blob/tjcw-send-first-packet-debug-20221212.1612/AF_XDP-filter/ping-namespace-direct-with-dummy/pwru.log.2 now show the packets being handled correctly.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Where is my eBPF packet going?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.