From 0ac7dea853a16579072fe9d85cfc791226167491 Mon Sep 17 00:00:00 2001 From: Matt Corallo Date: Thu, 10 Jun 2021 14:43:09 +0000 Subject: [PATCH] Now that mem is more compact, bump max tracked src IPs to 1M Also bump paralellism on maps to 512 --- README.md | 2 +- genrules.py | 8 ++++---- xdp.c | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 2d96ec7..6437197 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ provide rate-limiting on a per-source basis. When the upper two bytes in an exte 0x8306 (rate in bytes) or 0x830c (rate in packets), we rate limit the same as 0x8006 or 0x800c except that the rate limit is applied per source address. The encoding mirrors the non-per-source encoding in that the last 4 octets are the floating-point rate limit. Instead of a 2 octet -AS/ignored value, the third octet is the maximum number of source IPs tracked (plus one, times 1024) +AS/ignored value, the third octet is the maximum number of source IPs tracked (plus one, times 4096) and the fourth octet is a prefix length mask, which is applied to the source IP before rate-limiting. `install.sh` provides a simple example script which will compile and install a generated XDP program diff --git a/genrules.py b/genrules.py index a09fde1..1ab90b0 100755 --- a/genrules.py +++ b/genrules.py @@ -419,17 +419,17 @@ with open("rules.h", "w") as out: continue first_action += f"const uint32_t srcip = ip->saddr & MASK4({mid_byte});\n" first_action += f"void *rate_map = &v4_src_rate_{len(v4persrcratelimits)};\n" - first_action += f"struct persrc_rate4_ptr rate_ptr = get_v4_persrc_ratelimit(srcip, rate_map, {(high_byte + 1) * 1024});\n" + first_action += f"struct persrc_rate4_ptr rate_ptr = get_v4_persrc_ratelimit(srcip, rate_map, {(high_byte + 1) * 4096});\n" first_action += f"struct persrc_rate4_entry *rate = rate_ptr.rate;\n" - v4persrcratelimits.append((high_byte + 1) * 1024) + v4persrcratelimits.append((high_byte + 1) * 4096) else: if mid_byte > 128: continue first_action += f"const uint128_t srcip = ip6->saddr & MASK6({mid_byte});\n" first_action += f"void *rate_map = &v6_src_rate_{len(v6persrcratelimits)};\n" - first_action += f"struct persrc_rate6_ptr rate_ptr = get_v6_persrc_ratelimit(srcip, rate_map, {(high_byte + 1) * 1024});\n" + first_action += f"struct persrc_rate6_ptr rate_ptr = get_v6_persrc_ratelimit(srcip, rate_map, {(high_byte + 1) * 4096});\n" first_action += f"struct persrc_rate6_entry *rate = rate_ptr.rate;\n" - v6persrcratelimits.append((high_byte + 1) * 1024) + v6persrcratelimits.append((high_byte + 1) * 4096) first_action += "if (rate) {\n" first_action += f"\t{spin_lock}\n" first_action += "\tif (likely(rate->sent_rate > 0))" + " {\n" diff --git a/xdp.c b/xdp.c index 6c9a01a..29e2cf3 100644 --- a/xdp.c +++ b/xdp.c @@ -196,7 +196,7 @@ struct { // Then we build an array of MAX_ENTRIES/2**SRC_HASH_MAX_PARALLELISM_POW entries, // which are split into buckets of size SRC_HASH_BUCKET_COUNT. An entry can appear // in any of the SRC_HASH_BUCKET_COUNT buckets at it's hash value. -#define SRC_HASH_MAX_PARALLELISM_POW 7 +#define SRC_HASH_MAX_PARALLELISM_POW 9 #define SRC_HASH_MAX_PARALLELISM (1 << SRC_HASH_MAX_PARALLELISM_POW) #define SRC_HASH_BUCKET_COUNT_POW 3 #define SRC_HASH_BUCKET_COUNT (1 << SRC_HASH_BUCKET_COUNT_POW) -- 2.30.2