Commit Graph

12 Commits (027c903f50bcba8da10a4577891c6142cac09429)

Author SHA1 Message Date
Eric Leblond f04391031f af-packet: XDP bypass in IPS mode
Implement XDP bypass in IPS mode by using XDP redirect to send
packets from bypassed flow directly to the transmission interface.
7 years ago
Eric Leblond bc34703c09 ebpf: add some comments to eBPF filter 7 years ago
Eric Leblond 0807dd6740 ebpf: slight bypass_filter optimization 7 years ago
Eric Leblond 4f57008a23 af-packet: add support for XDP cpu redirect map
This patch adds a boolean option "xdp-cpu-redirect" to af-packet
interface configuration. If set, then the XDP filter will load
balance the skb creation on specified CPUs instead of doing the
creation on the CPU handling the packet. In the case of a card
with asymetric hashing this will allow to avoid saturating the
single CPU handling the trafic.

The XDP filter must contains a set of map allowing load balancing.
This is the case of xdp_filter.bpf.

Fixed-by: Jesper Dangaard Brouer <netoptimizer@brouer.com>
7 years ago
Eric Leblond 33072a49fe ebpf: import more recent version of helpers 7 years ago
Eric Leblond cde438f670 af-packet: add missing copyright header
And also fixes the copyright date in some files.
7 years ago
Eric Leblond 17a32bdaa0 af-packet: fix bypassing of IPv6
Also misc fixes.
7 years ago
Eric Leblond a229635792 ebpf: implement vlan filter
Basic filter allowing only a list of VLANs.
7 years ago
Eric Leblond 8c88087948 af-packet: implementation of XDP bypass
This patch adds support for XDP bypass. It provides an XDP
filter that can be loaded to realize the bypass of flows.
7 years ago
Eric Leblond 31c947b4d8 af-packet: use per CPU hash in bypass
eBPF has a data type which is a per CPU array. By adding one element
to the array it is in fact added to all per CPU arrays in the kernel.
This allows to have a lockless structure in the kernel even when doing
counter update.

In userspace, we need to update the flow bypass code to fetch all
elements of the per CPU arrays.
7 years ago
Eric Leblond 06173267c6 af-packet: kernel bypass implementation
This patch implements bypass capability for af-packet.

The filter only bypass TCP and UDP in IPv4 and IPv6. It don't
don't bypass IPv6 with extended headers.

This patch also introduces a bypassed flow manager that takes
care of timeouting the bypassed flows. It uses a 60 sec
timeout on flow. As they are supposed to be active we can
try that. If they are not active then we don't care to get them
back in Suricata.
7 years ago
Eric Leblond 91e1256b01 af-packet: add support for eBPF cluster and filter
This patch introduces the ebpf cluster mode. This mode is using
an extended BPF function that is loaded into the kernel and
provide the load balancing.

An example of cluster function is provided in the ebpf
subdirectory and provide ippair load balancing function.
This is a function which uses the same method as
the one used in autofp ippair to provide a symetrical
load balancing based on IP addresses.

A simple filter example allowing to drop IPv6 is added to the
source.

This patch also prepares the infrastructure to be able to load
and use map inside eBPF files. This will be used later for flow
bypass.
7 years ago