netdev - Re: eBPF: how to check the flow table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 19 Sep 2016 08:56:55 +0200
From:   Eric Leblond <eric@...it.org>
To:     netdev@...r.kernel.org
Cc:     Alexei Starovoitov <alexei.starovoitov@...il.com>,
        daniel@...earbox.net
Subject: Re: eBPF: how to check the flow table

Hello,

On Sun, 2016-09-18 at 14:02 +0200, Eric Leblond wrote:
> Hello,
> 
> I'm currently testing a code implementing AF_PACKET bypass for
> Suricata. The idea is that Suricata is updating a hash table
> containing
> a list of flows it does not want to see anymore.
> 
> I want to check flow timeout from the userspace, so my current
> algorithm is doing:
> 
>     while (bpf_get_next_key(mapfd, &key, &next_key) == 0) {
>         bpf_lookup_elem(mapfd, &next_key, &value);
>         FlowCallback(mapfd, &next_key, &value, data);
>         key = next_key;
>     }
> 
> In the FlowCallback, I check the timing in the flow entry and I
> remove
> the key if the flow is timeout.
> 
> This is currently working well when there is only a few flows but on
> a
> real system with log of insertion in the table, the loop is never
> returning because we dequeue slower than we enqueue.
> 
> Is there a better algorithm or an other way to do it ? 

It seems I missed an obvious race condition in my existing code. I'll
continue to test and relive this thread if necessary.

BR,
-- 
Eric Leblond <eric@...it.org>