54 Commits (c7db9aa50d8a1c123e8a6825718b84b3a782e3c7)

Author	SHA1	Message	Date
Eric Leblond	8c88087948	af-packet: implementation of XDP bypass ... This patch adds support for XDP bypass. It provides an XDP filter that can be loaded to realize the bypass of flows.	7 years ago
Eric Leblond	31c947b4d8	af-packet: use per CPU hash in bypass ... eBPF has a data type which is a per CPU array. By adding one element to the array it is in fact added to all per CPU arrays in the kernel. This allows to have a lockless structure in the kernel even when doing counter update. In userspace, we need to update the flow bypass code to fetch all elements of the per CPU arrays.	7 years ago
Eric Leblond	06173267c6	af-packet: kernel bypass implementation ... This patch implements bypass capability for af-packet. The filter only bypass TCP and UDP in IPv4 and IPv6. It don't don't bypass IPv6 with extended headers. This patch also introduces a bypassed flow manager that takes care of timeouting the bypassed flows. It uses a 60 sec timeout on flow. As they are supposed to be active we can try that. If they are not active then we don't care to get them back in Suricata.	7 years ago
Eric Leblond	91e1256b01	af-packet: add support for eBPF cluster and filter ... This patch introduces the ebpf cluster mode. This mode is using an extended BPF function that is loaded into the kernel and provide the load balancing. An example of cluster function is provided in the ebpf subdirectory and provide ippair load balancing function. This is a function which uses the same method as the one used in autofp ippair to provide a symetrical load balancing based on IP addresses. A simple filter example allowing to drop IPv6 is added to the source. This patch also prepares the infrastructure to be able to load and use map inside eBPF files. This will be used later for flow bypass.	7 years ago