Leveraging Kernel Tables with XDP
Total Page:16
File Type:pdf, Size:1020Kb

Load more
Recommended publications
-
BERKELEY PACKET FILTER: Theory, Practice and Perspectives
Alma Mater Studiorum · Universita` di Bologna SCUOLA DI SCIENZE Corso di Laurea in Informatica BERKELEY PACKET FILTER: theory, practice and perspectives Relatore: Presentata da: Chiar.mo Prof. MICHELE DI STEFANO RENZO DAVOLI Sessione II Anno Accademico 2019/2020 All operating systems sucks, but Linux just sucks less. Linus Torvalds Introduction Initially packet filtering mechanism in many Unix versions was imple- mented in the userspace, meaning that each packet was copied from the kernel-space to the user-space before being filtered. This approach resulted to be inefficient compared with the performance shown by the introduction of the BSD classic Berkeley Packet Filter (cBPF). cBPF consists of an as- sembly language for a virtual machine which resides inside the kernel. The assembly language can be used to write filters that are loaded in to the ker- nel from the user-space allowing the filtering to happen in the kernel-space without copying each packet as before. cBPF use is not limited to just the networking domain but it is also applied as a mechanism to filter system calls through seccomp mode. Seccomp allows the programmer to arbitrary select which system calls to permit, representing an useful mechanism to implement sandboxing. In order to increase the number of use cases and to update the architecture accordingly to new advancements in modern processors, the virtual machine has been rewritten and new features have been added. The result is extended Berkeley Packet Filter (eBPF) which consists of a richer assembly, more pro- gram types, maps to store key/value pairs and more components. Currently eBPF (or just BPF) is under continuous development and its capacities are evolving, although the main uses are networking and tracing. -
Performance Evaluation of Express Data Path for Container-Based Network Functions
Performance Evaluation of eXpress Data Path for Container-Based Network Functions Tugce Özturk School of Electrical Engineering Thesis submitted for examination for the degree of Master of Science in Technology. Espoo 30.12.2020 Supervisor Prof. Raimo Kantola Advisor M. Sc. Riku Kaura-aho Copyright © 2020 Tugce Özturk Aalto University, P.O. BOX 11000, 00076 AALTO www.aalto.fi Abstract of the master’s thesis Author Tugce Özturk Title Performance Evaluation of eXpress Data Path for Container-Based Network Functions Degree programme Computer, Communication and Information Sciences Major Communications Engineering Code of major ELEC3029 Supervisor Prof. Raimo Kantola Advisor M. Sc. Riku Kaura-aho Date 30.12.2020 Number of pages 65 Language English Abstract The architectural shift in the implementations of Network Function Virtualization (NFV) has necessitated improvements in the networking performance of commodity servers in order to meet the requirements of new generation networks. To achieve this, many fast packet processing frameworks have been proposed by academia and industry, one of them being eXpress Data Path (XDP) incorporated in the Linux kernel. XDP differentiates from other packet processing frameworks by leveraging the in-kernel facilities and running in device driver context. In this study, the XDP technology is evaluated to address the question of supporting performance needs of container-based virtual network functions in cloud architectures. Thus, a prototype consisting of a data plane powered by XDP programs and a container layer emulating the virtual network function is implemented, and used as a test-bed for throughput and CPU utilization measurements. The prototype has been tested to investigate the scalability with varying traffic loads as well as to reveal potential limitations of XDP in such a deployment. -
Towards a Faster Iptables in Ebpf
POLITECNICO DI TORINO Master of Science in Computer Engineering Master Thesis Towards a faster Iptables in eBPF Supervisor Prof. Fulvio Risso Candidate Massimo Tumolo PoliMi Supervisor Prof. Antonio Capone Academic year 2017-2018 To my family. You did more then you could for me to get here, I hope I will be as great to my children as you were to me. Alla mia famiglia. Avete fatto oltre il possibile per farmi arrivare qui, e spero di poter essere per i miei figli quanto voi siete per me. i Acknowledgements I would like to acknowledge my supervisor, or my mentor, Prof. Fulvio Risso. He trusted me to work on this project, he believed in me and helped me through all the steps. This thesis has been a wonderful opportunity to grow personally and professionally, and everything I learned was thanks to the opportunities he opened for me. A huge acknowledgment goes to Matteo Bertrone. He developed this thesis with me, we had (very) long chats on problems, possible solutions, and consequent prob- lems. We had some coffee just to talk. He was a really nice friend and collaborator. Thanks. Thank you to Sebastiano Miano, for being a good friend and a source of precious tips. I owe him a bunch of coffees that he offered during our chats. And thank you for suggesting me my favorite pizza place in Turin. Thank you to Mauricio Vásquez Bernal, for teaching me a lot on eBPF, and for being always available to provide me with help and informations. Last but not least, thank you to Simona. -
Performance Implications of Packet Filtering with Linux Ebpf
Performance Implications of Packet Filtering with Linux eBPF Dominik Scholz, Daniel Raumer, Paul Emmerich, Alexander Kurtz, Krzysztof Lesiak and Georg Carle Chair of Network Architectures and Services, Department of Informatics, Technical University of Munich scholzd raumer emmericp kurtz lesiak carle @in.tum.de { | | | | | } Abstract—Firewall capabilities of operating systems are tra- not only used on UNIX-based systems. By the time a packet ditionally provided by inflexible filter routines or hooks in the is filtered in kernel space, rejected traffic already caused kernel. These require privileged access to be configured and are overhead, as each single packet was copied to memory and not easily extensible for custom low-level actions. Since Linux 3.0, the Berkeley Packet Filter (BPF) allows user-written extensions in underwent basic processing. To circumvent these problems, the kernel processing path. The successor, extended BPF (eBPF), two trends for packet filtering can be observed: Either the improves flexibility and is realized via a virtual machine featuring filtering is moved to a lower level leveraging hardware support both a just-in-time (JIT) compiler and an interpreter running in (e.g., offloading features or FPGA-based NICs), or breaking the kernel. It executes custom eBPF programs supplied by the up the ruleset and moving parts to user space. user, effectively moving kernel functionality into user space. We present two case studies on the usage of Linux eBPF. In this paper we show how eBPF can be used to break up the First, we analyze the performance of the eXpress Data Path conventional packet filtering model in Linux, even in environ- (XDP). -
Faster OVS Datapath with XDP
Faster OVS Datapath with XDP Toshiaki Makita William Tu [email protected] [email protected] NTT VMware NSBU Abstract 1.2 Open vSwitch and XDP XDP is fast and flexible, but difficult to use as it requires people OVS is widely used in virtualized data center environments as a to develop eBPF programs which often needs deep knowledge of software switching layer for a variety of operating systems. As eBPF. In order to mitigate this situation and to let people easily OVS is on the critical path, concerns about performance affect the use an XDP-based fast virtual switch, we introduce Open vSwitch architecture and features of OVS. For complicated configurations, (OVS) acceleration by XDP. OVS’s flow-based configuration can require huge rule sets. The key This has been already partly realized by recently introduced to OVS’s forwarding performance is flow caching. As shown in OVS netdev type, afxdp. Afxdp netdev type bypasses kernel Figure 1(a), OVS consists of two major components: a slow path network stack through AF XDP sockets and handles packets in userspace process and a fast path caching component, called the userspace. Although its goal, bringing XDP’s flexibility to OVS datapath. datapath by enabling us to update the datapath without updating When a packet is received by the NIC, the host OS does some kernel, was different from acceleration, afxdp is basically faster initial processing before giving it to the OVS datapath. The dat- than OVS kernel module. However, compared to native XDP in apath first parses the packet to extract relevant protocol headers kernel (i.e. -
Fast Packet Processing with Ebpf and XDP: Concepts, Code, Challenges and Applications
X Fast Packet Processing with eBPF and XDP: Concepts, Code, Challenges and Applications MARCOS A. M. VIEIRA∗, MATHEUS S. CASTANHO, RACYUS D. G. PACÍFICO, ELERSON R. S. SANTOS, EDUARDO P. M. CÂMARA JÚNIOR, and LUIZ F. M. VIEIRA, Universidade Federal de Minas Gerais, Brazil Extended Berkeley Packet Filter (eBPF) is an instruction set and an execution environment inside the Linux kernel. It enables modification, interaction and kernel programmability at runtime. eBPF can beusedto program the eXpress Data Path (XDP), a kernel network layer that processes packets closer to the NIC for fast packet processing. Developers can write programs in C or P4 languages and then compile to eBPF instructions, which can be processed by the kernel or by programmable devices (e.g. SmartNICs). Since its introduction in 2014, eBPF has been rapidly adopted by major companies such as Facebook, Cloudflare, and Netronome. Use cases include network monitoring, network traffic manipulation, load balancing, and system profiling. This work aims to present eBPF to an inexpert audience, covering the main theoretical and fundamental aspects of eBPF and XDP, as well as introducing the reader to simple examples to give insight into the general operation and use of both technologies. CCS Concepts: • Networks → Programming interfaces; Middle boxes / network appliances; End nodes. Additional Key Words and Phrases: Computer Networking, Packet processing, Network functions ACM Reference Format: Marcos A. M. Vieira, Matheus S. Castanho, Racyus D. G. Pacífico, Elerson R. S. Santos, Eduardo P. M. Câmara Júnior, and Luiz F. M. Vieira. 2019. Fast Packet Processing with eBPF and XDP: Concepts, Code, Challenges and Applications. -
XDP Express Data Path Used for Ddos Protection Learning Ebpf Code
XDP – eXpress Data Path Used for DDoS protection Linux Kernel self protection Learn writing eBPF code Jesper Dangaard Brouer Principal Engineer, Red Hat Lund Linux Con 1/37 XDP – eXpress Data Path May, 2017 Audience: Prepare yourself! ● Git clone or fork ● https://github.com/netoptimizer/prototype-kernel/ ● XDP eBPF code example in directory: ● kernel/samples/bpf/ ● Documentation ● https://prototype-kernel.readthedocs.io/ ● Notice two “sections” ● XDP - eXpress Data Path ● eBPF - extended Berkeley Packet Filter 2/37 XDP – eXpress Data Path Overview ● What is XDP – eXpress Data Path ● Using XDP for DDoS protection 1) Linux Kernel self protection 2) Handling volume attacks with scrubbing ● Learn to write eBPF XDP code by examples ● Blacklist example ready to use ● Modify and adapt to DDoS attacks ● New mailing list ● [email protected] 3/37 XDP – eXpress Data Path Introduction ● An eXpress Data Path (XDP) in kernel-space ● The "packet-page" idea from NetDev1.1 "rebranded" ● Thanks to: Tom Herbert, Alexei and Brenden Blanco, putting effort behind idea ● Basic idea: work on raw packet-page inside driver ● Hook before any allocations or normal stack overhead ● Performance is primary focus and concern ● Target is competing with DPDK speeds ● No fancy features! ● Need features: use normal stack delivery 4/37 XDP – eXpress Data Path XDP: What is XDP (eXpress Data Path)? ● Thin layer at lowest levels of SW network stack ● Before allocating SKBs ● Inside device drivers RX function ● Operate directly on RX DMA packet-pages ● XDP is NOT kernel bypass ● Designed to work in concert with stack ● XDP - run-time programmability via "hook" ● Run eBPF program at hook point ● Learn writing eBPF code later.. -
XDP-Programmable Data Path in the Linux Kernel (PDF)
XDP-Programmable Data Path in the Linux Kernel DIPTANUPROGRAMMING GON CHOUDHURY Diptanu Gon Choudhury works erkeley Packet Filter was introduced almost two decades ago and has on large-scale distributed been an important component in the networking subsystem of the systems. His interests lie in kernel for assisting with packet filtering. Extended BPF can do much designing large-scale cluster B schedulers, highly available more than that and is gradually finding its way into more kernel subsystems control plane systems, and high-performance as a generic event-processing infrastructure. In this article, I provide enough network services. He is the author of the background to help you understand how eBPF works, then describe a simple upcoming O’Reilly book Scaling Microservices. and fast firewall using Express Data Path (XDP) and eBPF. [email protected] Berkeley Packet Filter (BPF) has been around for more than two decades, born out of the requirement for fast and flexible packet filtering machinery to replace the early ’90s imple- mentations, which were no longer suitable for emerging processors. BPF has since made its way into Linux and BSDs via libpcap, which is the foundation of tcpdump. Instead of writing the packet filtering subsystem as a kernel module, which can be unsafe and fragile, McCanne and Jacobson designed an efficient yet minimal virtual machine in the kernel, which allows execution of bytecode in the data path of the networking stack. The virtual machine was very simple in design, providing a minimalistic RISC-based instruction set, with two 32-bit registers, but it was very effective in allowing developers to express logic around packet filtering. -
Brno University of Technology Packet
BRNO UNIVERSITY OF TECHNOLOGY VYSOKÉ UČENÍ TECHNICKÉ V BRNĚ FACULTY OF INFORMATION TECHNOLOGY FAKULTA INFORMAČNÍCH TECHNOLOGIÍ DEPARTMENT OF INFORMATION SYSTEMS ÚSTAV INFORMAČNÍCH SYSTÉMŮ PACKET FILTERING USING XDP FILTROVÁNÍ PAKETŮ POMOCÍ XDP TERM PROJECT SEMESTRÁLNÍ PROJEKT AUTHOR Bc. JAKUB MACKOVIČ AUTOR PRÁCE SUPERVISOR Ing. MATĚJ GRÉGR, Ph.D. VEDOUCÍ PRÁCE BRNO 2019 Brno University of Technology Faculty of Information Technology Department of Information Systems (DIFS) Academic year 2018/2019 Master's Thesis Specification Student: Mackovič Jakub, Bc. Programme: Information Technology Field of study: Information Systems Title: Packet Filtering Using XDP Category: Networking Assignment: 1. Get familiar with eXpress Data Path and eBPF technologies. 2. Design a packet filtration mechanism using XDP and eBPF. 3. Implement the design and deploy it in Brno University of Technology networking testbed. 4. Test the performance of your approach and compare it with iptables and ipset tools. Recommended literature: Bharadwaj, R. (2017). Mastering Linux Kernel development: A kernel developer's reference manual. ISBN: 978-1-78588-613-3. Robert Love. 2010. Linux Kernel Development (3rd ed.). Addison-Wesley Professional. ISBN: 978-0-672-32946-3 Requirements for the semestral defence: Items 1 and 2 Detailed formal requirements can be found at http://www.fit.vutbr.cz/info/szz/ Supervisor: Grégr Matěj, Ing., Ph.D. Head of Department: Kolář Dušan, doc. Dr. Ing. Beginning of work: November 1, 2018 Submission deadline: May 22, 2019 Approval date: October 31, 2018 Master's Thesis Specification/21433/2018/xmacko09 Strana 1 z 1 Powered by TCPDF (www.tcpdf.org) Packet Filtering Using XDP Declaration I hereby declare that this thesis was prepared as an original author’s work under the super- vision of Mr. -
XDP – Express Data Path an In-Kernel Network Fast-Path a Technology Overview
XDP – eXpress Data Path An in-kernel network fast-path A technology overview Jesper Dangaard Brouer Principal Kernel Engineer, Red Hat Driving-IT, Denmark 3rd November 2017 1/27 XDP explained, Driving-IT 2017 Introduction ● This presentation is about XDP ● XDP – eXpress Data Path ● Why Linux need it ● Making people aware of this technology ● XDP: New in-kernel building block for networking ● Explaining the building blocks of XDP ● Help understand idea behind eBPF 2/27 XDP explained, Driving-IT 2017 What is the problem? ● Compared to bypass solutions, DPDK and netmap ● Linux kernel networking is said to be slow ● Fundamental reason: Linux build on assumption ● that most packets travel into sockets ● takes cost upfront of allocating a "socket buff" (sk_buff/SKB) ● Linux lacks an in-kernel fast-path ● DPDK bypass operate on "earlier" network layer ● Kernel lack network layer before allocating SKBs 3/27 XDP explained, Driving-IT 2017 Why is an in-kernel fast-path needed? ● Today everything relies on networking ● Kernel provides core foundation for network ● Solutions like DPDK: make networking an add-on ● No longer part of core foundation everybody share ● DPDK require maintaining full separate drivers ● Special kernel boot parameters, 100% CPU usage ● Harder to integrate into products/solutions ● e.g. takes over entire NIC ● e.g. DPDK and containers are not compatible ● e.g. you need to reimplement a TCP/IP stack ● Need in-kernel fast-path solution, part of core 4/27 XDP explained, Driving-IT 2017 What is XDP (eXpress Data Path)? ● XDP is