cgroup skb egress ebpf hook - skb->cb[0-4] updated values are reset in tc egress ebpf hook

user_18285225 0
Viewed 149

I am just updating the skb->cb with constant values (0xfeed) and trying to get the same packet data at egress tc layer ebpf hook. It is all zero. Am i missing something here? Is there anyway to send meta data between hooks with skb itself (LRU_HASH map may help but having in-band metadata will be faster, I think).

SEC("cgroup/skb")
int cgrp_dump_pkt(struct __sk_buff *skb) {

void *data_end = (void *) (long) skb->data_end;
void *data     = (void *) (long) skb->data;

if(data < data_end)
{   

    skb->cb[0] = 0xfeed;
    skb->cb[1] = 0xfeed;
    skb->cb[2] = 0xfeed;
    skb->cb[3] = 0xfeed;
    skb->cb[4] = 0xfeed;
           bpf_printk("hash:%x  mark:%x pri:%x", skb->hash, skb->mark, skb->priority);
    bpf_printk("cb0:%x cb1:%x cb2:%x", skb->cb[0], skb->cb[1], skb->cb[2]);
    bpf_printk("cb3:%x cb4:%x", skb->cb[3], skb->cb[4]);
}

return 1;
}

The above hook is attached to a docker instance cgroup and I am trying to see the same packets by attaching the hook in tc egress (will just print the packet info includes cb[0-4]). cb[0-4] values are shown as 0. Is it an expected behavior? How to pass the metadata between ebpf hook from cgroup skb to tc egress or lower layers?

ebpf bpf linux-kernel
1 Answers

I've only ever used the cb fields to pass data across BPF tail calls. To pass data from one hook point to another in the stack, you could use skb->mark (32-bit value).

Do make sure that no other software is using the same bits you want to use though. See https://github.com/fwmark/registry for example.

user_68845900
Related