Under what circumstances does bpf_get_socket_cookie() return 0

Question

bpf-helpers(7) states that bpf_get_socket_cookie() returns 0 if the socket field is missing inside skb.

Under what conditions is the socket field missing in this context? Does it depend where in the datapath a BPF program is attached to? For instance, would bpf_get_socket_cookie() always return 0 in the case of a filter that attaches with tc filter add dev ... ingress ... bpf ... (on a Linux kernel 4.19, say)?

Answer 1

The socket field is NULL if the packet wasn't demultiplexed to a socket yet. For TCP, that happens in tcp_v4_early_demux().

So yes, that will depend on where you attach your BPF program. You'd need to attach it before the packet is demultiplexed to a socket.