fix: #739 Add sock consistency check to void tuple miss. #750
Conversation
The delay in ebpf events processing in user mode may cause tuple not found, new AddConn with same pid will overwrite the tuple which will be deleted by DestroyConn. Add sock consistency check before tuple cleaning.
|
@Asphaltt please help to review, thks |
There was a problem hiding this comment.
感谢您的贡献。
如 #744 (comment) 所说，这话问题是产生在FD的短期快速复用，当前PR是解决了错误删除的问题，但并没有解决根因。
你觉得是吗？
对于五元组无法准确关联的问题，我认为最好的解决方案是改从pcapng模式中，还原解析网络包，再读取五元组。
The text mode has many flaws. In the future, I am considering enhancing the functionality of the pcapng mode to parse network packets in real time, restore them based on the key, and then convert them into text format.
你有兴趣实现这个方案吗？
|
根据测试，避免错误删除tuple应该可以大概率解决 tuple为0问题，我们的https server运行了12h 没有再出现这个问题，修改前这个问题在http2 模式下非常频繁。但是如果用户态按照add1-add2-data1-destory1的时间线处理，data1会获取到add2的错误tuple，按照分析虽然影响范围有限但依然会影响数据准确性。当前我们的业务需要text模式，我们会先使用这个修改。 |
|
如果这个PR仅是为了防止错误删除conn的问题，我觉得是可以合并的。
是的，期待您的贡献。 |
The delay in ebpf events processing in user mode may cause tuple not found, new AddConn with same pid will overwrite the tuple which will be deleted by DestroyConn. Add sock consistency check before tuple cleaning.