From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
To: Petar Penkov <ppenkov.kernel@gmail.com>
Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, davem@davemloft.net,
ast@kernel.org, daniel@iogearbox.net, edumazet@google.com,
lmb@cloudflare.com, sdf@google.com, toke@redhat.com,
Petar Penkov <ppenkov@google.com>
Subject: Re: [bpf-next,v2 0/6] Introduce a BPF helper to generate SYN cookies
Date: Mon, 29 Jul 2019 13:47:57 -0700 [thread overview]
Message-ID: <20190729204755.iu5wp3xisu42vkky@ast-mbp> (raw)
In-Reply-To: <20190729165918.92933-1-ppenkov.kernel@gmail.com>
On Mon, Jul 29, 2019 at 09:59:12AM -0700, Petar Penkov wrote:
> From: Petar Penkov <ppenkov@google.com>
>
> This patch series introduces a BPF helper function that allows generating SYN
> cookies from BPF. Currently, this helper is enabled at both the TC hook and the
> XDP hook.
>
> The first two patches in the series add/modify several TCP helper functions to
> allow for SKB-less operation, as is the case at the XDP hook.
>
> The third patch introduces the bpf_tcp_gen_syncookie helper function which
> generates a SYN cookie for either XDP or TC programs. The return value of
> this function contains both the MSS value, encoded in the cookie, and the
> cookie itself.
>
> The last three patches sync tools/ and add a test.
>
> Performance evaluation:
> I sent 10Mpps to a fixed port on a host with 2 10G bonded Mellanox 4 NICs from
> random IPv6 source addresses. Without XDP I observed 7.2Mpps (syn-acks) being
> sent out if the IPv6 packets carry 20 bytes of TCP options or 7.6Mpps if they
> carry no options. If I attached a simple program that checks if a packet is
> IPv6/TCP/SYN, looks up the socket, issues a cookie, and sends it back out after
> swapping src/dest, recomputing the checksum, and setting the ACK flag, I
> observed 10Mpps being sent back out.
Is it 10m because trafic gen is 10m?
What is cpu utilization at this rate?
Is it cpu or nic limited if you crank up the syn flood?
Original 7M with all cores or single core?
The patch set looks good to me.
I'd like Eric to review it one more time before applying.
next prev parent reply other threads:[~2019-07-29 20:48 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-29 16:59 [bpf-next,v2 0/6] Introduce a BPF helper to generate SYN cookies Petar Penkov
2019-07-29 16:59 ` [bpf-next,v2 1/6] tcp: tcp_syn_flood_action read port from socket Petar Penkov
2019-07-29 16:59 ` [bpf-next,v2 2/6] tcp: add skb-less helpers to retrieve SYN cookie Petar Penkov
2019-07-29 16:59 ` [bpf-next,v2 3/6] bpf: add bpf_tcp_gen_syncookie helper Petar Penkov
2019-07-29 16:59 ` [bpf-next,v2 4/6] bpf: sync bpf.h to tools/ Petar Penkov
2019-07-29 16:59 ` [bpf-next,v2 5/6] selftests/bpf: bpf_tcp_gen_syncookie->bpf_helpers Petar Penkov
2019-07-29 16:59 ` [bpf-next,v2 6/6] selftests/bpf: add test for bpf_tcp_gen_syncookie Petar Penkov
2019-07-29 20:47 ` Alexei Starovoitov [this message]
2019-07-29 23:45 ` [bpf-next,v2 0/6] Introduce a BPF helper to generate SYN cookies Petar Penkov
2019-07-31 4:12 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190729204755.iu5wp3xisu42vkky@ast-mbp \
--to=alexei.starovoitov@gmail.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=lmb@cloudflare.com \
--cc=netdev@vger.kernel.org \
--cc=ppenkov.kernel@gmail.com \
--cc=ppenkov@google.com \
--cc=sdf@google.com \
--cc=toke@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox