Lorenz Bauer <l...@cloudflare.com> wrote: > Apologies for contacting you out of the blue. I'm currently trying to > understand how TPROXY works under the hood. As part of this endeavour, > I've stumbled upon the commit attached to this email. > > From the commit message I infer that somewhere, TPROXY relies on a > check of skb->sk == NULL to function. However, I can't figure out > where! I've traced TPROXY from NF_HOOK(NF_INET_PRE_ROUTING) just after > the call to skb_orphan to __inet_lookup_skb / skb_steal_sock called > from the TCP and UDP receive functions, and as far as I can tell there > is no such check. Can you maybe shed some light on this?
Without the skb_orphan udp/tcp might steal tunnel/ppp etc. socket instead of tproxy assigned tcp/udp socket.
