On 4/16/19 8:00 AM, Florian Westphal wrote: > Lorenz Bauer <l...@cloudflare.com> wrote: >> Apologies for contacting you out of the blue. I'm currently trying to >> understand how TPROXY works under the hood. As part of this endeavour, >> I've stumbled upon the commit attached to this email. >> >> From the commit message I infer that somewhere, TPROXY relies on a >> check of skb->sk == NULL to function. However, I can't figure out >> where! I've traced TPROXY from NF_HOOK(NF_INET_PRE_ROUTING) just after >> the call to skb_orphan to __inet_lookup_skb / skb_steal_sock called >> from the TCP and UDP receive functions, and as far as I can tell there >> is no such check. Can you maybe shed some light on this? > > Without the skb_orphan udp/tcp might steal tunnel/ppp etc. socket > instead of tproxy assigned tcp/udp socket. > Florian, it is the responsibility of the loopback code to perform the skb_orphan() I am confident we can revert 71f9dacd2e4d23 and fix the paths that eventually miss the skb_orphan() call. loopback_xmit() properly calls skb_orphan(), we also need to make sure that any kind of loopback (veth and others) do the same. This is a prereq so that XDP or tc code can implement early demux earlier. As a bonus we remove one skb_orphan() in rx fast path ;) Note that skb_scrub_packet() used to call skb_orphan(), we need to a bit smarter and insert it only in __dev_forward_skb()
