- people - netdevconf.info

0x14: nutsnbolts talk, SynGate: Issuing SYN cookies in XDP
by Jamal Hadi Salim 31 Jan '20

31 Jan '20

Lets start with some context. The Problem: TCP SYN DDOS attack. TCP SYN attacks flood a targetted server with SYN requests. Each SYN request received by the server is responded to with a SYN ACK which results in a connection state being created and put in a half-open (SYN RCVD) TCP state awaiting an ACK to come back. *The ACK response never comes* and the SYN requests keep coming in resulting in more half-open state creation in the backlog... At some point, during this attack, there will be a lot of TCP half-open state such that the targeted server's ability to respond to new SYN requests is lost because all the available port resources have been exhausted... How does one defend against SYN flood attack? A popular defense against SYN attacks uses what is known as SYN cookies. So, how do SYN cookies work? When the server sees the TCP SYN, it constructs the SYN ACK using a sequence # created from a cryptographic hash of some of the flow attributes. The computed ACK sequence # has enough flow attributes encoding in it such that can be later (on response to this sequence #) used to reconstruct the original SYN request should the original sender response. Two possibilities on responses: 1) If this was an attack, then the server will never receive a response. It is no big deal since we are not storing any half-open info in the backlog; and therefore no server resources are wasted in anticipation of that response. 2) This is legit client request - in which case there will be a response coming back. When the ACK is received, we look at the ACK sequence # and reconstruct the SYN queue entry using the information that was originally encoded in the SYN ACK. SYN cookies are effective, but: the operation requires the packets traverse the TCP/IP layers all the way up. For a busy server, the extra code path and the hash computation constrains how fast you can issue SYN cookies back. In this talk, Petar Penkov, Eric Dumazet and Stanislav Fomichev discuss SynGate, an XDP-based approach to handling SYN cookies. By moving the response lower in the stack it enables the system to increase the rate at which a host can issue SYN cookies and therefore improving its resilience to SYN flood attacks. Petar et al will detail the design of this solution, the advantages eBPF provided them and, challenges faced during development of of SynGate and finally they will discuss areas they are considering for improvement. More info: https://netdevconf.info/0x14/session.html?talk-issuing-SYN-cookies-in-XDP Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: nutsnbolts talk, Taking Control of your SmartNIC
by Jamal Hadi Salim 30 Jan '20

30 Jan '20

SmartNICs are introducing a new paradigm in hardware offload/acceleration world - that of introducing additional general purpose processors in the NIC. So try to visualize the NIC as almost its own machine connected to your host. Meaning you can, for example, move your control plane to the NIC. In this talk, Or Gerlitz and Andy Gospodarek start by describing high level view of this class of NICs. They will then explore common deployment methods and models and help us understand better how this new class of NICs operate by exploring: - what is out there in terms of networking open source code/features - automation recipes and scripts to onboard software infra - common kernel offload techniques in use - upstream kernel and distro SoC support Or and Andy will iterate a few working examples that are available for use across devices from multiple, open SmartNIC vendors. They will also discuss approaches of integrating into known cloud orchestration systems like OpenStack and Kubernetes. More info: https://netdevconf.info/0x14/session.html?talk-taking-control-of-your-Smart… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: nutnbolts talk, Application Device Queues (ADQ) for system-level network I/O performance improvements
by Jamal Hadi Salim 30 Jan '20

30 Jan '20

ADQ(Application Device Queues) support has been in the kernel for a while now. ADQ enables network application data to be isolated to specific (symmetric rx/tx) hardware netdevice queue pair(s). Application specific-data is ingressed towards these dedicated queues and rate controlled in the egress direction - all using policy definitions. ADQ uses standard Linux interfaces to achieve its goals. In this talk, Amritha Nambiar, Kiran Patil and Sridhar Samudrala will: - dig into the details of ADQ architecture and operations. - illustrate collected data on how ADQ helps to improve predictability by reducing jitter, lowering latency and improving throughput. - show, via an example application, how developers can take advantage of ADQ. Amritha et al will also discuss future plans for ADQ such as enabling busy polling on AF_XDP sockets by associating a NAPI_ID to an AF_XDP socket at bind time. More info: https://netdevconf.info/0x14/session.html?talk-ADQ-for-system-level-network… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: Bronze Sponsor, IPv4 Unicast Extensions Project
by Jamal Hadi Salim 29 Jan '20

29 Jan '20

New Sponsor, the IPv4 Unicast Extensions Project. We are grateful for your support! Thank you. IPv4 Unicast Extensions Project is working on extending the unicast portion of the IPv4 address space, including hundreds of millions of addresses that are currently reserved, or are very underutilized. This extension will make more IPv4 addresses usable for providing globally reachable services during the long transition to IPv6, reducing the price of IPv4 addresses to end users. cheers, jamal

1 0

0x14: Moonshot talk, Linux Kernel Network Scripting with Lua
by Jamal Hadi Salim 29 Jan '20

29 Jan '20

I'll spend a bit more time summarizing this talk because it will no doubt generate passions in (some) people and curiosity in others. If you thought that eBPF is the only approach to extend the kernel, think again. In this talk, Lourival Vieira Neto et al describe a framework, Lunatik, which facilitates dynamically injecting Lua scripts into the kernel to extend kernel mechanisms. Some context: what is Lua? 1) It is a scripting language that is very widely deployed as an embededable _extension language_. Game programming in particular predominantly uses it for extensions. Openwrt uses it as config language and there are many others listed here: https://en.wikipedia.org/wiki/List_of_applications_using_Lua. Wide deployment means it has seen exposure in many environments. The _extension 2) It is a tiny language (the whole language is about 200KB) that is designed to be easy to embed - in particular in C 3) It is considered relatively secure. Despite the wide deployment over many years there have been very few CVEs reported against Lua in more than a decade. See: https://www.cvedetails.com/product/28436/LUA-LUA.html?vendor_id=13641). Why scripting? Extending kernels with scripts is nothing new. But: The simple answer to this question is to compare a compiler driven approach (think C) vs a scripting language(think Bash or python). The former requires a complex development environment (think eBPF needing latest clang, gcc, correct libbpf, etc) while the later provides faster turnarounds to development and deployment (you need a kernel with the Lua VM but not much after that in terms of tooling) and of course, a much simpler and stable ABI. Script based execution is often not as performant but often more usable relatively speaking. And back to the talk... The Lunatik framework has rich coverage across different kernel hooks and has been used to script different Linux subsystems such as CPUfreq, Sockets, RCU, ULP, Netfilter, and now XDP. Lunatik has been around for a while, just not upstreamed - and to give a little sample space of its deployment: NFLua is currently deployed _in production in over 20 million home routers_! You dont want a rogue script kill your kernel and system. Lourival et al will discuss the challenges and approach taken in allowing script injection into the kernel while still maintaining correctness, isolation, and liveness. They will then describe NFLua and introduce XPDLua, which allows users to extend XDP with Lua. XDPLua aims to replace NFLua. The authors will detail how Lua can be used within XDP: as a standalone to directly invoke currently exposed eBPF helpers or alternatively have eBPF programs invoke Lua scripts. And last but not least: Lourival et al will provide comparison performance data for packet filtering between with Iptables, eBPF, NFLua and XDPLua. sounds exciting? Come to the conference, listen, learn, and engage the speakers! More info: https://netdevconf.info/0x14/session.html?talk-linux-network-scripting-with… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

2 1

0x14: nutsnbolts talk, Storage application performance boost with zero thrashing networking stack
by Jamal Hadi Salim 29 Jan '20

29 Jan '20

There has been an ongoing effort in the community to get Zero-copy working over the last few years - with much success. While both MSG_ZEROCOPY (zero copy transmit) and socket mmap (zero copy receive) have been out in the wild for sometime now, there are no known high scale open source application consumers of these interfaces. In this talk, Or Gerlitz will describe how he makes use of these interfaces to integrate into spdk(https://spdk.io/) - an open source storage framework which uses sockets for nvme-over-tcp in a smart NIC environment. The goal is to use kernel uAPIs while achieving high scale performance. Or will delve into MSG_ZEROCPOY and the challenges that he had to deal with. He will describe the need for an app author to understand and how to best tie-in their app state machine to the interfaces: to address both transactions responses from the peer app and zero-copy notifications from the local socket provider. Should the app use ZC with all or nothing approach or sometimes yes and other-times no? Come to the talk to get the answer and advise on how to effectively use these interfaces. In addition Or will spend time going into the performance analysis details correlating I/O performance visavis CPU cost (which is often tricky to get right with traditional tools like profiler/flame-graphs). More info: https://netdevconf.info/0x14/session.html?talk-storage-application-performa… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: nutsnbolts talk, Media Redundancy Protocol
by Jamal Hadi Salim 28 Jan '20

28 Jan '20

MRP(Media Redundancy Protocol) is an open standard for ring topologies in industrial ethernet networks defined in common standards-based protocol(IEC 62439-2). In an MRP-enabled network each Ethernet switch is connected to two other switches forming a ring. An MRP-enabled ring can overcome single link point of failures at worst case recovery time of 30ms - which is faster than STP. In this talk Horatiu Vultur will describe the MRP protocol in some detail. They will then proceed to discuss the effort to add support to the kernel; different implementation approaches considered and eventual implementation path taken after receiving feedback on the mailing list. And last but not least, future work will be discussed including hardware offload of MRP as well as preliminary results comparing hardware-offloaded MRP vs non-offloaded version. More info: https://netdevconf.info/0x14/session.html?talk-adding-MRP-to-the-linux-kern… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: nutsnbolts talk, Extend segment routing for another source routing protocol named RPL
by Jamal Hadi Salim 28 Jan '20

28 Jan '20

RPL is an IPv6 Routing Protocol for Low-Power and Lossy Networks defined in RFC 6550. RFC 6550 defines a mode that is known as "storing" mode. RFC 6554 defines a "non-storing" mode of route propogation. While there are several other RPL open source implementations, they all implement RPL using the "storing" mode which propagates routes via ICMPv6. There are no open source "non-storing" mode implementations. In this talk, Alexander Aring et al will discuss an implementation that uses "non-storing" mode (RFC 6554). In the storing mode(per RFC 6554), route propagation is done via the IPv6 Routing Header. Aring et al discuss the architecture, interface approach, challenges that they overcame and outstanding future work. More info: https://netdevconf.info/0x14/session.html?talk-extend-segment-routing-for-R… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: nutsnbolts talk, Implementation of IPv6 IOAM in Linux Kernel
by Jamal Hadi Salim 28 Jan '20

28 Jan '20

Operations, Administration, and Maintenance (OAM) refers to a set of techniques and mechanisms for performing fault detection, isolation and performance measurements. Classical approaches such are traceroute, ping, etc can now be improved by collecting more granular and precise per-packet telemetry. The IETF is currently in the process of standardizing In-situ OAM (IOAM) to allow collecting operational information along a path. In this talk Justin Iurman et al discuss an implementation of IOAM for the Linux kernel with IPv6 as the encapsulation protocol. They will discuss the details of their approach and demonstrate evaluation results. More info: https://netdevconf.info/0x14/session.html?talk-implementation-of-IPv6-IOAM-… Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

0x14: Free Range Routing workshop
by Jamal Hadi Salim 28 Jan '20

28 Jan '20

The PC has accepted a new workshop session. Donald Sharp and David Lamparter will chair the FRRouting (https://frrouting.org/) workshop. Current agenda for the workshop includes: * Where to put kernel boundary conventions: * Current Status on netconf/yang models * Status of using kernel nexthop groups FRR * FRR feature rundown: Recent past and future work * Installing FRR for kernel developers For more details: https://netdevconf.info/0x14/session.html?workshop-FRR Reminder, registration is now open and early bird is still in effect. https://netdevconf.info/0x14/registration.html cheers, jamal

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

people