netdev - Re: [iovisor-dev] [RFC PATCH 00/11] OVS eBPF datapath.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180628030023.pkgdu4brun3jy2bz@ast-mbp.dhcp.thefacebook.com>
Date:   Wed, 27 Jun 2018 20:00:25 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     William Tu <u9012063@...il.com>
Cc:     dev@...nvswitch.org, iovisor-dev@...ts.iovisor.org,
        netdev@...r.kernel.org
Subject: Re: [iovisor-dev] [RFC PATCH 00/11] OVS eBPF datapath.

On Sat, Jun 23, 2018 at 05:16:32AM -0700, William Tu wrote:
> 
> Discussion
> ==========
> We are still actively working on finishing the feature, currently
> the basic forwarding and tunnel feature work, but still under
> heavy debugging and development.  The purpose of this RFC is to
> get some early feedbacks and direction for finishing the complete
> features in existing kernel's OVS datapath (the net/openvswitch/*).

Thank you for sharing the patches.

> Three major issues we are worried:
>   a. Megaflow support in BPF.
>   b. Connection Tracking support in BPF.

my opinion on the above two didn't change.
To recap:
A. Non scalable megaflow map is no go. I'd like to see packet classification
algorithm like hicuts or efficuts to be implemented instead, since it can be
shared by generic bpf, bpftiler, ovs and likely others.
B. instead of helpers to interface with conntrack the way ovs did, I prefer
a generic conntrack mechanism that can be used out of xdp too

>   c. Verifier limitation.

Not sure what limitations you're concerned about.