5 ms·

What we are missing from linux today is a networking subsystem that allows for configurable efficient hardware offloading. Without hacking up everything, like

What we are missing from linux today is a networking subsystem that allows for configurable efficient hardware offloading. Without hacking up everything, like it is done in consumer routers these days. Will BPF handle that better than nftables?

ibotty 9y ago
That's stated in the discussion as one of the major points of bpfilter against netfilter's nftables.
vbernat 9y ago
Outside firewalling, Linux already has support for offloading switching and routing to hardware if possible (through switchdev). This works with Mellanox network cards for example.
qeole 9y ago
Offloading eBPF programs attached to TC (traffic control interface) or XDP (at the driver level) is possible since kernel 4.9, and keeps getting better (more complete, and easier). [Disclaimer: I work for the company working on this.] Tools in iproute2 package are being updated too, so typically you would attach and offload programs to hardware with `tc`- or `ip`-based command lines.
- sargun 9y ago
  You work at Netronome? I’m curious if we will ever see your chips in traditional data planes like switches.
chrissnell 9y ago
In this age where major security flaws are being discovered in hardware, do we really want to offload network filtering to what might be black box hardware with limited/no auditability?
- viraptor 9y ago
  There are various levels of offloading. There are basic operations like checksum offloading that existed for a long time and it's optional. Not sure anyone would complain about the auditability of that one. (you would see errors on the next hop if it didn't work correctly)
  - kardos 9y ago
    I interpreted OP's point as moving that kind of complexity to a black box would open it up to being compromised and then leveraged as a backdoor into your system, or as a botnet, etc.
- kardos 9y ago
  We already have plenty of insecure non-auditable black boxes on our networks [1,2] and in our CPUs [3]. A dodgy offload chip seems like a minor concern until those are solved [1] https://www.networkworld.com/article/3016992/security/juniper-firewalls-compromised-by-spy-code-what-you-need-to-know.html https://www.networkworld.com/article/3016992/security/junipe... [2] https://www.theregister.co.uk/2015/09/15/compromised_cisco_routers/ https://www.theregister.co.uk/2015/09/15/compromised_cisco_r... [3] https://en.wikipedia.org/wiki/Intel_Management_Engine#Security_vulnerabilities https://en.wikipedia.org/wiki/Intel_Management_Engine#Securi...
0xdeadbeefbabe 9y ago
From what I can tell snabb might be able to do this, but it bypasses the kernel: https://github.com/snabbco/snabb https://github.com/snabbco/snabb

ibotty 9y ago

That's stated in the discussion as one of the major points of bpfilter against netfilter's nftables.

vbernat 9y ago

Outside firewalling, Linux already has support for offloading switching and routing to hardware if possible (through switchdev). This works with Mellanox network cards for example.

qeole 9y ago

Offloading eBPF programs attached to TC (traffic control interface) or XDP (at the driver level) is possible since kernel 4.9, and keeps getting better (more complete, and easier). [Disclaimer: I work for the company working on this.] Tools in iproute2 package are being updated too, so typically you would attach and offload programs to hardware with `tc`- or `ip`-based command lines.

sargun 9y ago
You work at Netronome? I’m curious if we will ever see your chips in traditional data planes like switches.

chrissnell 9y ago

In this age where major security flaws are being discovered in hardware, do we really want to offload network filtering to what might be black box hardware with limited/no auditability?

viraptor 9y ago
There are various levels of offloading. There are basic operations like checksum offloading that existed for a long time and it's optional. Not sure anyone would complain about the auditability of that one. (you would see errors on the next hop if it didn't work correctly)
- kardos 9y ago
  I interpreted OP's point as moving that kind of complexity to a black box would open it up to being compromised and then leveraged as a backdoor into your system, or as a botnet, etc.
kardos 9y ago
We already have plenty of insecure non-auditable black boxes on our networks [1,2] and in our CPUs [3]. A dodgy offload chip seems like a minor concern until those are solved [1] https://www.networkworld.com/article/3016992/security/juniper-firewalls-compromised-by-spy-code-what-you-need-to-know.html https://www.networkworld.com/article/3016992/security/junipe... [2] https://www.theregister.co.uk/2015/09/15/compromised_cisco_routers/ https://www.theregister.co.uk/2015/09/15/compromised_cisco_r... [3] https://en.wikipedia.org/wiki/Intel_Management_Engine#Security_vulnerabilities https://en.wikipedia.org/wiki/Intel_Management_Engine#Securi...

0xdeadbeefbabe 9y ago

From what I can tell snabb might be able to do this, but it bypasses the kernel: https://github.com/snabbco/snabb https://github.com/snabbco/snabb