linux-kernel - Running AF_XDP inside Docker using veth driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 18 Sep 2019 15:44:20 +0800
From:   Yu-han Lin <guesslin@...snostic.com>
To:     linux-kernel@...r.kernel.org
Cc:     Yu-han Lin <guesslin@...snostic.com>,
        Marcus Schiesser <marcus@...snostic.com>,
        "Shimansky, Gregory" <gregory.shimansky@...el.com>,
        "Melik-Adamyan, Areg" <areg.melik-adamyan@...el.com>
Subject: Running AF_XDP inside Docker using veth driver

Hello,

I wrote a test case handling network traffic in user-space inside a
Docker network
by using an XDP socket with libbpf. You can find the code in

https://github.com/glasnostic/af_xdp_test

My kernel version is 5.1 with XDP_SOCK enabled.

In this example, I have an unstable result while getting packets from
the XDP socket.
We can see a significant delay (~10s) until the packets are received
by the process.
It seems that XDP processes packets in batches and only when enough
packets exist,
all of the packets are sent to the userspace process.

This is a problem for traffic consisting of one packet (e.g. ARP, PING).

What is the correct way to deal with this problem?
E.g. can we force XDP to flush packets?

Thanks for the help.
- Yu-Han