4 ms·

If more performance is better, why isn't this the default in the Linux networking stack? What are the drawbacks of using this and are there security implication

by binkHN 3y ago

If more performance is better, why isn't this the default in the Linux networking stack? What are the drawbacks of using this and are there security implications?

furkansahin 3y ago
There are a couple of important points to consider when using Flowtables. Depending on the traffic characteristics, Flowtables may also drop the network performance. It also depends on the amount of rules and their configuration. For example, if we had much much more rules in nftables file for so many different operations (think of it like adding a new rule per IP address), Flowtables would hurt the performance in Ubicloud. They go hand in hand with how the overall network is configured. In our case at Ubicloud, it helps us, but we have a fairly simple Nftables definition as you can see a big part of it here https://github.com/ubicloud/ubicloud/blob/main/prog/vnet/update_firewall_rules.rb https://github.com/ubicloud/ubicloud/blob/main/prog/vnet/upd...
- deleted 3y ago
  [deleted]
- chatmasta 3y ago
  I wonder if there are any security implications to consider, particularly in a multi-tenant environment, when caching routing information for the "same" connection.
  - furkansahin 3y ago
    In this case, no. The reason is, we setup separate network namespaces per VM and the flowtables are also created separately per namespace.
    - BikiniPrince 3y ago
      Sorta, you are using hardware offload at a level above the vm. There are a lot of situations in which traffic can interact poorly with that nic. You won’t really be able to identify what traffic resulted in the nic responding because of a bug. I’m assuming you are not using sr-iov vf devices if you are managing offload at the parent. Probably for the best if it is that card.
fdr 3y ago
I think history is at least a part of this. The software flow table implementation (which ubicloud demonstrates here, full disclosure, I work there) offers some speedup, but the motive appears closely coupled with hardware flow table offloading: https://lwn.net/Articles/738214/ https://lwn.net/Articles/738214/
nolist_policy 3y ago
nftables is very flexible and flowtables won't work (transparently) in all configurations. For example sending packets from a single connection over multiple links round-robin. The cache will remember only one link and route all packets over that link. And packets in offloaded connections will bypass nftables rate/bandwidth limits and counters.

by binkHN 3y ago

If more performance is better, why isn't this the default in the Linux networking stack? What are the drawbacks of using this and are there security implications?

furkansahin 3y ago

There are a couple of important points to consider when using Flowtables. Depending on the traffic characteristics, Flowtables may also drop the network performance. It also depends on the amount of rules and their configuration. For example, if we had much much more rules in nftables file for so many different operations (think of it like adding a new rule per IP address), Flowtables would hurt the performance in Ubicloud. They go hand in hand with how the overall network is configured. In our case at Ubicloud, it helps us, but we have a fairly simple Nftables definition as you can see a big part of it here https://github.com/ubicloud/ubicloud/blob/main/prog/vnet/update_firewall_rules.rb https://github.com/ubicloud/ubicloud/blob/main/prog/vnet/upd...

deleted 3y ago
[deleted]
chatmasta 3y ago
I wonder if there are any security implications to consider, particularly in a multi-tenant environment, when caching routing information for the "same" connection.
- furkansahin 3y ago
  In this case, no. The reason is, we setup separate network namespaces per VM and the flowtables are also created separately per namespace.
  - BikiniPrince 3y ago
    Sorta, you are using hardware offload at a level above the vm. There are a lot of situations in which traffic can interact poorly with that nic. You won’t really be able to identify what traffic resulted in the nic responding because of a bug. I’m assuming you are not using sr-iov vf devices if you are managing offload at the parent. Probably for the best if it is that card.

fdr 3y ago

I think history is at least a part of this. The software flow table implementation (which ubicloud demonstrates here, full disclosure, I work there) offers some speedup, but the motive appears closely coupled with hardware flow table offloading: https://lwn.net/Articles/738214/ https://lwn.net/Articles/738214/

nolist_policy 3y ago

nftables is very flexible and flowtables won't work (transparently) in all configurations. For example sending packets from a single connection over multiple links round-robin. The cache will remember only one link and route all packets over that link. And packets in offloaded connections will bypass nftables rate/bandwidth limits and counters.