netdev - Re: [PATCH v3 net-next 2/2] tc: add 'needs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 09 Apr 2015 10:20:48 -0700
From:	Alexei Starovoitov <ast@...mgrid.com>
To:	Eric Dumazet <eric.dumazet@...il.com>,
	Daniel Borkmann <daniel@...earbox.net>
CC:	David Miller <davem@...emloft.net>, tgraf@...g.ch,
	jiri@...nulli.us, jhs@...atatu.com, netdev@...r.kernel.org
Subject: Re: [PATCH v3 net-next 2/2] tc: add 'needs_l2' flag to ingress qdisc

On 4/9/15 8:36 AM, Eric Dumazet wrote:
>
> Maybe we'll finally have a fast packet capture, instead of simply
> focusing on the filter part, which is tiny.

My plan for that was to use early_ingress_l2() hook before taps.
which will push L2 and call into the program _without_ skb_share_check.
We'll use it on the main interface where all traffic is seen.
The program will parse the packet the way it likes and redirect
the interesting packets to either different physical interface or
another tap/veth where user space will capture it. Then for 99%
of traffic on the main interface we don't pay any extra cost and if
external physical device is used for capturing then it's even cheaper.
On tracing side we were planing to use existing perf ring buffer infra
to pass some data to user space. The same helpers can be used to pass
info about the packet when user space doesn't need to see the whole
packet. In such case the bpf program will extract interesting headers
from the packet, store them into ring buffer and copy to user space
which is extremely fast.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html