4 ms·

I'm not sure the network stack in userspace is going to help MUCH in this scenario. sendfile() does the disk (fd) read / enqueue to network socket (fd) in the

by mtanski 12y ago

I'm not sure the network stack in userspace is going to help MUCH in this scenario. sendfile() does the disk (fd) read / enqueue to network socket (fd) in the kernel space. This ends up being DMA to pagecache from the file and hopefully DMA to network socket Eg. zero copy. In reality the TCP stack will have some overhead (segmenting). If they have a network stack in userspace you need to make syscalls to for disk IO and you end up making copies from the page cache to your application buffers. You can do DMA from disk to your userspace buffer with O_DIRECT, but then you lose the page cache (and you'll end up having to re-implement it in userspace). If you don't have disk IO that needs be performed. Say you have a in-memory hash table then you might be able to get a measurable improvement in performance by using a userspace network stack. Lastly, you still need (some) elevated privileges for networking to a TCP in userspace so you end with a vulnerability vector there.

jerf 12y ago
To make this really work involves special hardware and driver support; user-space networking, AFAIK, doesn't help for conventional hardware, for those reasons. I also don't know if they're currently doing anything with TLS; the guys working on it next to me are just doing lower-level routing now and deliberately not peeking into the streams at all, let alone doing TLS. What's particularly nervewracking in security terms for the user-space networking stuff is really the fact that right now, you're probably only using it if you want to push 10Gbps, therefore you're working in an environment where you have merely hundreds of cycles to figure out what to do with a packet (maybe low single-digit thousands if your multicore support is working perfectly), and therefore everything is written in raw C. Ack. We needed Rust 1.0 about five years ago.

by mtanski 12y ago

jerf 12y ago

To make this really work involves special hardware and driver support; user-space networking, AFAIK, doesn't help for conventional hardware, for those reasons. I also don't know if they're currently doing anything with TLS; the guys working on it next to me are just doing lower-level routing now and deliberately not peeking into the streams at all, let alone doing TLS. What's particularly nervewracking in security terms for the user-space networking stuff is really the fact that right now, you're probably only using it if you want to push 10Gbps, therefore you're working in an environment where you have merely hundreds of cycles to figure out what to do with a packet (maybe low single-digit thousands if your multicore support is working perfectly), and therefore everything is written in raw C. Ack. We needed Rust 1.0 about five years ago.