Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for src IPv6, src port and src IPv6 sets #173

Merged
merged 14 commits into from
Nov 19, 2024

Commits on Nov 14, 2024

  1. bfcli: fix IPv6 prefix generation for /128

    Fix out of bound access of the IPv6 address prefix if /128 is used.
    qdeslandes committed Nov 14, 2024
    Configuration menu
    Copy the full SHA
    18fd05f View commit details
    Browse the repository at this point in the history

Commits on Nov 18, 2024

  1. tests: harness: add function to create a test set

    Similarly to the helpers defined in tests/harness/filters.c, add a new
    function to create a test set: bf_test_set_get().
    qdeslandes committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    c5c3ec0 View commit details
    Browse the repository at this point in the history
  2. tests: e2e: use Python 3 interpreter for genpkts.py

    `/usr/bin/env python` should not be used as genpkts.py hasn't been
    tested with Python2, look for Python 3 instead.
    qdeslandes committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    629e7f8 View commit details
    Browse the repository at this point in the history
  3. tests: e2e: discover Python 3 interpreter using CMake

    Use find_package(Python3) to locate the Python 3 interpreter on the
    system, intead of relying on genpkts.py's shebang. This way CMake will
    warn early about a missing dependency.
    qdeslandes committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    a1fb508 View commit details
    Browse the repository at this point in the history
  4. core: set: add set type to match against the packets source (IPv6, port)

    This is a very specific set type expected to be used internally at Meta.
    Eventually, generic sets will allow for any set key to be dynamically
    generated.
    qdeslandes committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    31e2207 View commit details
    Browse the repository at this point in the history
  5. core: matcher: add matcher for source (IPv6, port) set

    Add BF_MATCHER_SRCIP6PORT to match against a set of (source IPv6, source
    port) tuples set.
    
    The BPF bytecode will ensure the packet contains an IPv6 and a TCP or
    UDP header to filter on.
    qdeslandes committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    d5ff47c View commit details
    Browse the repository at this point in the history
  6. tests: e2e: add tests for (source IPv6 addr, source port) sets

    Tests the new BF_MATCHER_SRCIP6PORT matcher using 200k entries in a set.
    qdeslandes committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    8bc2635 View commit details
    Browse the repository at this point in the history
  7. core: set: serialize all the element of a set at once

    Serialize all the element of a set in a single marsh, instead of
    creating a marsh for every single element. The bigger the set the
    greater the performance gain.
    
    Tested on a 200k elements set with a performance gain of ~10000x.
    Because the type of the set is stored in the serialized data, there is
    no need for each element to have its own container.
    qdeslandes committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    6f322d5 View commit details
    Browse the repository at this point in the history
  8. cgen: gate bf_cgen_dump() to verbose mode only

    bf_cgen_dump() has a negative performance impact even if nothing is
    printed (as DUMP() uses bf_dbg() which is also gated to the verbose
    mode).
    
    Instead, only call bf_cgen_dump() if the verbose mode is enabled.
    qdeslandes committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    7c9a855 View commit details
    Browse the repository at this point in the history
  9. cgen: xdp: avoid bf_btf_get_field_off() and use offsetof

    Use offsetof() instead of bf_btf_get_field_off() for ingress_ifindex
    field of the xdp_md structure, this change saves us from searching for a
    specific symbol name in the kernel BTF.
    qdeslandes committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    09f112f View commit details
    Browse the repository at this point in the history
  10. cgen: program: fill the BPF maps used by the sets in batch

    Use BPF_MAP_UPDATE_BATCH to fill the BPF maps used to define the
    filtering sets, instead of inserting every element one after the other.
    qdeslandes committed Nov 18, 2024
    Configuration menu
    Copy the full SHA
    777511e View commit details
    Browse the repository at this point in the history

Commits on Nov 19, 2024

  1. tests: harness: set a process stdout/stderr buffer size to 1MiB

    The child process blocks once the pipe buffers (stdout and stderr used in
    the subprocess) are full, leading to confusing hangs. Set the buffers
    size to 1MiB preemptively. This should be enough are the process
    structures are used for testing.
    
    If this issue resurfaces, more control should be provided to the user to
    increase the buffers size or set the buffers as non blocking (or flush
    the buffers).
    qdeslandes committed Nov 19, 2024
    Configuration menu
    Copy the full SHA
    314fd14 View commit details
    Browse the repository at this point in the history
  2. tests: harness: build the test harness as a static library

    The test harness could be used outside of bpfilter to run custom
    benchmarks on bpfilter. Make the harness binary a static library.
    qdeslandes committed Nov 19, 2024
    Configuration menu
    Copy the full SHA
    f5c0f58 View commit details
    Browse the repository at this point in the history
  3. core: set: add support for source IPv6 addresses set

    Add support for sets containing source IPv6 addresses. This implement is
    subpar but is required for benchmarking. Eventually, bpfilter will
    support generic sets (user-defined sets with custom keys) and static set
    types will be removed.
    qdeslandes committed Nov 19, 2024
    Configuration menu
    Copy the full SHA
    0eb6c6a View commit details
    Browse the repository at this point in the history