5 ms·
And if you're using FreeBSD with a fast NIC, look into the pfilctl command and use a "head" input hook into your NIC driver's ethernet input handling routine.
by drewg123 3y ago
And if you're using FreeBSD with a fast NIC, look into the pfilctl command and use a "head" input hook into your NIC driver's ethernet input handling routine. Doing this allows the firewall input checks to happen early, before the packet has been received into the network stack, while its still in DMA-mapped, driver-owned buffers. If the firewall decides a packet is to be dropped, the NIC can recycle the buffer with minimal overhead (skips DMA-unmap, buffer free, ethernet input into the IP stack, and the replacement buffer alloc, DMA map).
This allows for very fast dropping of DOS flood attacks. I've tested this using ipfw up to screening and dropping several 10s of millions of packets on 2014 era Xeons with minimal impact to traffic serving. I wrote a paper about this for a conf. that was cancelled due to COVID. I really need to re-submit it someplace.
This works for Mellanox, Chelsio, and NICs that use iflib (ix, ixl, igb, bnxt, and more that I'm forgetting).
- digitalsushi 3y agoI'm picturing that scene a few episodes into the soul art anime - I barely remember it but the main character was so overpowered, he was standing there absorbing a full barrage from a much lower ranked opponent flooding him with punches and kicks; the main character's health regenerated so quickly that the attack didn't have effects. In 2014 I was working on a hardware appliance for a company that has something to do with packet capture, and I found an intel driver that implemented a ring buffer on a 1 gigabit Ethernet adapter that allowed me to capture line rate without dropping a single packet over the course of hours; prior to this the adapter was barely able to capture 90% of the packets. I remember marveling at the design that must have gone into it, and here too to your description of this performance improvement. I miss that stuff. Thanks for sharing,
- jpk 3y agoWould love to watch that talk (so please re-submit it somewhere!), but in lieu of that, is the paper available anywhere?
- bravetraveler 3y agoThis is awesome to see [as a mostly-Linux person] - people have managed to impress the sentiment on me that the BSDs are well-suited for networking. I never quite 'got it' - this helps. Are you aware of similar tweaks in Linux land, by chance? I consider myself reasonably well-experienced as a systems administrator... but can't quite recall stumbling across anything quite like this.
- epcoa 3y agohttps://en.wikipedia.org/wiki/Express_Data_Path https://en.wikipedia.org/wiki/Express_Data_Path
- bravetraveler 3y agoThank you, I've heard of {e,}BPF but not so much applications - thank you again! Makes sense why I haven't seen it, came out around the time I joined $CurrentEmployer, and we're stuck a couple decades behind.
- ADSSDA 3y agoIMO Linux is significantly better than the *BSDs at this particular use case. Check out https://blog.cloudflare.com/l4drop-xdp-ebpf-based-ddos-mitigations/ https://blog.cloudflare.com/l4drop-xdp-ebpf-based-ddos-mitig... and: https://github.com/xdp-project/xdp-tools https://github.com/xdp-project/xdp-tools
- gigatexal 3y agoBut don’t have to cobble together a bunch of arcane iptables commands and then combine bpf and other userland tools … when one can just use the clean syntax of PF especially for home use that’s a clear win.
- ADSSDA 3y agoI've used both extensively and I find eBPF+iptables (and sometimes nft) significantly more flexible and easier to use in the real world (not just simple examples) than PF. shrug
- gigatexal 3y agoDo you have a sample or blogpost of how your setup looks? I’m keen to see how folks are using eBPF in the personal firewall space
- 3y ago
- brynet 3y ago> This allows for very fast dropping of DOS flood attacks. OpenBSD has something very close to that w/ bpf(4) BIOCGFILDROP filter "drop". https://man.openbsd.org/bpf#BIOCGFILDROP https://man.openbsd.org/bpf#BIOCGFILDROP https://man.openbsd.org/tcpdump#B https://man.openbsd.org/tcpdump#B https://marc.info/?l=openbsd-tech&m=155228135415650&w=2 https://marc.info/?l=openbsd-tech&m=155228135415650&w=2
- deleted 3y ago[deleted]
- tedunangst 3y agoI think that's pretty different. It's less processing, but still copies packet off nic.
- gigatexal 3y agoI had no idea! This is really cool. Have you by chance a blog about it?
- datadeft 3y agoThis sounds nice for a specific case when you are not dealing with bandwidth based DOS.