ebpf strparser socket redirection

[DuratarskeyK]

Cloudflare blog has a nice overview of this feature, where the kernel handles splicing 2 sockets into each other. Unfortunately, their example implements a simple echo server. I'm trying to apply this to a reverse proxy: parse incoming http request, send it to target, then splice. Unfortunately, the response from target can come before I add the socket fd to the sockmap, and nothing gets sent and everything freezes. I'm wondering if someone has come up with a solution to that problem, since I can't figure out what to do. Can somebody help me?

[ti-mo]

Hi @DuratarskeyK, I'm afraid this question exceeds the scope of ebpf-go. The user base of this forum is also quite limited. Perhaps asking in #ebpf on Cilium Slack or on StackOverflow is more appropriate.

[DuratarskeyK]

Tried asking in Slack, no response received. I'll try stackoverflow then, thanks!

[erebe]

Hello,

Did you had your answer to this question, because i am in the same situation 😅

[erebe]

Ok thank you 🙏
It seems everybody that want to do that manage the whole lifecycle of the socket with ebpf.
I was expecting something more plug and play where you can setup/init/inspect stuff in user space and after delegate to ebpf sock map for forwarding.

[DuratarskeyK]

I decided to look at it again and I think I figured it out. You add sockets to the maps as usual, and then you do this to both sockets:

rawConn.Control(func(fd uintptr) {
    syscall.Recvmsg(int(fd), []byte{0}, []byte{}, syscall.MSG_PEEK)
})

And it seems to launch the whole process. I've added an artificial delay after I establish connection to my target, and my target is ssh which sends an identification string right away, and doing recvmsg with MSG_PEEK on the socket seems to launch the whole forwarding thing.

[erebe]

Indeed, adding a recvmsg on both sockets to pump data in works in my case too. But when I forward a TLS connection, after some random delay, the connection breaks due to a TLS bad message. (Same with downloading a file over raw HTTP, i never end-up with the correct sha256 for the file).

Sadly, I haven't add time to investigate it yet, and it is hard to get feedback regarding ebpf ¯_(ツ)_/¯

[DuratarskeyK]

Yeah, rcvmsg opened a huge can of worms. If the socket state moves from established to something else, a bunch of things go wrong. I'm also getting NULL pointer dereferences from kernel under huge loads...

Yeah, it's not hard, it's impossible :)

[DuratarskeyK]

I'm actually hitting the same SSL error, that I can't reproduce locally.