flowspec-xdp
6 weeks agoStop dumping match count before update, users can get it if they want main
Matt Corallo [Fri, 10 Dec 2021 01:39:12 +0000 (01:39 +0000)]
Stop dumping match count before update, users can get it if they want

6 weeks agoPartially implement sorting
Matt Corallo [Thu, 9 Dec 2021 22:51:51 +0000 (22:51 +0000)]
Partially implement sorting

6 weeks agoCombine redundant rule conditions to work around LLVM bug 52455 fully
Matt Corallo [Thu, 9 Dec 2021 21:14:52 +0000 (21:14 +0000)]
Combine redundant rule conditions to work around LLVM bug 52455 fully

This adds a trivial optimization pass to combine redundant rule
conditions in back-to-back rules before printing them.

7 weeks agoMake dropcount not stupid slow
Matt Corallo [Thu, 9 Dec 2021 00:44:57 +0000 (00:44 +0000)]
Make dropcount not stupid slow

7 weeks agoUse best instruction set that the local kernel supports
Matt Corallo [Wed, 8 Dec 2021 20:14:50 +0000 (20:14 +0000)]
Use best instruction set that the local kernel supports

7 weeks agoPlace source-address checks last to work around LLVM bug 52455
Matt Corallo [Wed, 8 Dec 2021 19:29:09 +0000 (19:29 +0000)]
Place source-address checks last to work around LLVM bug 52455

3 months agoMove ratelimits into map lookup fn to reduce BPF verifier instructions
Matt Corallo [Wed, 27 Oct 2021 23:58:21 +0000 (23:58 +0000)]
Move ratelimits into map lookup fn to reduce BPF verifier instructions

3 months agoUse a single command to install xdp instead of remove+add
Matt Corallo [Sat, 23 Oct 2021 19:53:46 +0000 (19:53 +0000)]
Use a single command to install xdp instead of remove+add

3 months agoAvoid inlining siphash globally to avoid hitting BPF instruction limits
Matt Corallo [Sat, 23 Oct 2021 17:34:00 +0000 (17:34 +0000)]
Avoid inlining siphash globally to avoid hitting BPF instruction limits

3 months agoFix/better handling of no-stats-tracking rules
Matt Corallo [Sat, 23 Oct 2021 16:10:20 +0000 (16:10 +0000)]
Fix/better handling of no-stats-tracking rules

3 months agoReduce bash CPU time for high-core-count machines in dropcount.sh
Matt Corallo [Sun, 10 Oct 2021 17:16:50 +0000 (17:16 +0000)]
Reduce bash CPU time for high-core-count machines in dropcount.sh

4 months agoDouble hashtable bucket size, halve parallelism.
Matt Corallo [Tue, 14 Sep 2021 19:04:04 +0000 (19:04 +0000)]
Double hashtable bucket size, halve parallelism.

256-way parallelism should suffice for most use-cases, but 16-entry
buckets should allow for much lower collisions than 8-entry buckets.

This also adds calculation for hash table collision.

4 months agoReuse hash table bucket entries if they're stale 32+ seconds
Matt Corallo [Tue, 14 Sep 2021 18:02:47 +0000 (18:02 +0000)]
Reuse hash table bucket entries if they're stale 32+ seconds

7 months agoRate limit by hard-coded 16-packet leaky bucket with less storage
Matt Corallo [Thu, 10 Jun 2021 22:47:53 +0000 (22:47 +0000)]
Rate limit by hard-coded 16-packet leaky bucket with less storage

7 months agoOptimize per-src v6 matching on <= /64s to avoid always storing 4 0-bytes
Matt Corallo [Thu, 10 Jun 2021 15:35:31 +0000 (15:35 +0000)]
Optimize per-src v6 matching on <= /64s to avoid always storing 4 0-bytes

7 months agoNow that mem is more compact, bump max tracked src IPs to 1M
Matt Corallo [Thu, 10 Jun 2021 14:43:09 +0000 (14:43 +0000)]
Now that mem is more compact, bump max tracked src IPs to 1M

Also bump paralellism on maps to 512

7 months agoRewrite per-source ratelimiting rules to use a custom hashtable
Matt Corallo [Thu, 10 Jun 2021 03:43:02 +0000 (03:43 +0000)]
Rewrite per-source ratelimiting rules to use a custom hashtable

The in-kernel hashtable isn't at all fancy, and we can just use a
custom one to get basically the same outcomes, with much less
overhead due to the per-CPU stuff we have to do to get sensible
multicore access rules.

7 months agoUse a common function in test and test building in XDP mode as well
Matt Corallo [Thu, 10 Jun 2021 03:29:45 +0000 (03:29 +0000)]
Use a common function in test and test building in XDP mode as well

7 months agoCheck in siphash
Matt Corallo [Sat, 29 May 2021 23:01:01 +0000 (23:01 +0000)]
Check in siphash

8 months agoDrop union in rate limiting struct that is just confusing
Matt Corallo [Tue, 25 May 2021 19:19:54 +0000 (19:19 +0000)]
Drop union in rate limiting struct that is just confusing

8 months agoUse BPF_F_NO_COMMON_LRU on BPF_MAP_TYPE_LRU_PERCPU_HASH maps
Matt Corallo [Tue, 25 May 2021 03:07:17 +0000 (03:07 +0000)]
Use BPF_F_NO_COMMON_LRU on BPF_MAP_TYPE_LRU_PERCPU_HASH maps

8 months agoDrop ports_valid flag, it just wastes a register
Matt Corallo [Tue, 25 May 2021 03:06:53 +0000 (03:06 +0000)]
Drop ports_valid flag, it just wastes a register

8 months agoSatisfy BPF verifier with port swhich it can't prove are init'd values
Matt Corallo [Thu, 20 May 2021 14:26:41 +0000 (14:26 +0000)]
Satisfy BPF verifier with port swhich it can't prove are init'd values

8 months agoFix fragment parsing due to further `,` overload confusion.
Matt Corallo [Tue, 18 May 2021 15:13:00 +0000 (15:13 +0000)]
Fix fragment parsing due to further `,` overload confusion.

Ondrej said "No, fragmentation-type is just a variant of bitmask."

8 months agoPull hash table size limit from extended community byte, up to 256k
Matt Corallo [Tue, 18 May 2021 00:37:14 +0000 (00:37 +0000)]
Pull hash table size limit from extended community byte, up to 256k

8 months agoProperly parse bitmask-match `,`s, which are AND, though it is not documented
Matt Corallo [Mon, 17 May 2021 17:24:13 +0000 (17:24 +0000)]
Properly parse bitmask-match `,`s, which are AND, though it is not documented

8 months agoOnly increment match on ratelimits when we reach the limit
Matt Corallo [Mon, 17 May 2021 17:09:17 +0000 (17:09 +0000)]
Only increment match on ratelimits when we reach the limit

8 months agoAdd per-source ratelimit support
Matt Corallo [Mon, 17 May 2021 16:38:55 +0000 (16:38 +0000)]
Add per-source ratelimit support

8 months agoFix some casting required in mask/endian calculation
Matt Corallo [Mon, 17 May 2021 16:38:33 +0000 (16:38 +0000)]
Fix some casting required in mask/endian calculation

8 months agoFix checksum offset calculation
Matt Corallo [Tue, 11 May 2021 23:36:00 +0000 (23:36 +0000)]
Fix checksum offset calculation

8 months agoSupport a wrapper XDP prog which can call the defined xdp_drop meth
Matt Corallo [Tue, 11 May 2021 21:00:12 +0000 (21:00 +0000)]
Support a wrapper XDP prog which can call the defined xdp_drop meth

9 months agoHandle packet rate limits, too
Matt Corallo [Fri, 9 Apr 2021 17:29:11 +0000 (13:29 -0400)]
Handle packet rate limits, too

9 months agoDefault to parse-options because some people like `ping -R`
Matt Corallo [Fri, 9 Apr 2021 16:48:59 +0000 (12:48 -0400)]
Default to parse-options because some people like `ping -R`

9 months agoTrack both packet count and packet sizes in drop counts.
Matt Corallo [Wed, 7 Apr 2021 19:36:40 +0000 (15:36 -0400)]
Track both packet count and packet sizes in drop counts.

9 months agoUpdate README to note lack of sorting.
Matt Corallo [Wed, 7 Apr 2021 19:27:25 +0000 (15:27 -0400)]
Update README to note lack of sorting.

9 months agoUpdate README
Matt Corallo [Tue, 6 Apr 2021 03:59:52 +0000 (23:59 -0400)]
Update README

9 months agoLess effecient, but much, much less naive rate-limiter
Matt Corallo [Tue, 6 Apr 2021 14:05:07 +0000 (10:05 -0400)]
Less effecient, but much, much less naive rate-limiter

9 months agoSupport ratelimiting communities
Matt Corallo [Tue, 6 Apr 2021 02:40:24 +0000 (22:40 -0400)]
Support ratelimiting communities

9 months agoImplement (only manually-tested) flowspec community detection except ratelimit
Matt Corallo [Mon, 5 Apr 2021 23:30:55 +0000 (19:30 -0400)]
Implement (only manually-tested) flowspec community detection except ratelimit

9 months agoTotal across loaded interfaces
Matt Corallo [Mon, 5 Apr 2021 16:29:15 +0000 (12:29 -0400)]
Total across loaded interfaces

9 months agoSimplify and (correctly) test DSCP matches
Matt Corallo [Mon, 5 Apr 2021 03:18:48 +0000 (23:18 -0400)]
Simplify and (correctly) test DSCP matches

9 months agoTrack and print rule source in drop prints
Matt Corallo [Sun, 4 Apr 2021 20:55:30 +0000 (16:55 -0400)]
Track and print rule source in drop prints

9 months agoTrack ports valid directly - as LLVM will | pointers which BPF wont allow
Matt Corallo [Sun, 4 Apr 2021 20:46:04 +0000 (16:46 -0400)]
Track ports valid directly - as LLVM will | pointers which BPF wont allow

9 months agoHelp the BPF verifier somewhat by splitting v4 and v6 rules
Matt Corallo [Sun, 4 Apr 2021 20:31:34 +0000 (16:31 -0400)]
Help the BPF verifier somewhat by splitting v4 and v6 rules

9 months agoClean up length checks with a macro and comment strange semantics
Matt Corallo [Sun, 4 Apr 2021 18:19:06 +0000 (14:19 -0400)]
Clean up length checks with a macro and comment strange semantics

9 months agoSupport multi-if map dump and fix last element print
Matt Corallo [Sun, 4 Apr 2021 17:30:31 +0000 (13:30 -0400)]
Support multi-if map dump and fix last element print

9 months agoPrint diagnostics about install location
Matt Corallo [Sun, 4 Apr 2021 17:15:06 +0000 (13:15 -0400)]
Print diagnostics about install location

9 months agoCorrect second-frag L4 matching
Matt Corallo [Sun, 4 Apr 2021 17:14:08 +0000 (13:14 -0400)]
Correct second-frag L4 matching

9 months agoAdd README
Matt Corallo [Sun, 4 Apr 2021 16:42:55 +0000 (12:42 -0400)]
Add README

9 months agoImprove drop count printing
Matt Corallo [Sun, 4 Apr 2021 16:46:28 +0000 (12:46 -0400)]
Improve drop count printing

9 months agoUpdate (and test) AST grammar based on feedback
Matt Corallo [Sun, 4 Apr 2021 15:54:59 +0000 (11:54 -0400)]
Update (and test) AST grammar based on feedback

9 months agoAdd default installer script
Matt Corallo [Sun, 4 Apr 2021 02:14:43 +0000 (22:14 -0400)]
Add default installer script

9 months agoTrack drops
Matt Corallo [Sun, 4 Apr 2021 01:43:17 +0000 (21:43 -0400)]
Track drops

9 months agoMake v6 frag parsing optional
Matt Corallo [Sun, 4 Apr 2021 00:00:51 +0000 (20:00 -0400)]
Make v6 frag parsing optional

9 months agoOnly parse v4/v6 if we have relevant rules for them
Matt Corallo [Sat, 3 Apr 2021 22:09:57 +0000 (18:09 -0400)]
Only parse v4/v6 if we have relevant rules for them

9 months agoImprove arg parsing somewhat and add flexibility/standardness
Matt Corallo [Sat, 3 Apr 2021 22:08:01 +0000 (18:08 -0400)]
Improve arg parsing somewhat and add flexibility/standardness

9 months agoTag short packets as unlikely
Matt Corallo [Sat, 3 Apr 2021 21:57:16 +0000 (17:57 -0400)]
Tag short packets as unlikely

9 months agoSupport v6 fragment parsing
Matt Corallo [Sat, 3 Apr 2021 20:41:41 +0000 (16:41 -0400)]
Support v6 fragment parsing

9 months agoInitial checkin
Matt Corallo [Sat, 3 Apr 2021 04:07:27 +0000 (00:07 -0400)]
Initial checkin