The existing redirect mode uses XDP to maximize performance but is not suitably
secure: packets are copied directly from the driver into a userspace buffer
(UMEM). But because the UMEM is shared among all processes with a socket open
on a particular NIC queue, sandboxes using redirect mode all map the same UMEM
and thus can read each other's packets.
Tunnel mode instead installs an eBPF program that copies packets from the
host's NIC driver into a per-sandbox NIC driver. This incurs an additional
copy, but there is no longer memory shared between sandboxes.
Benchmarking tunnel mode with redis-benchmark shows a performance gain over
standard Docker networking of 20%. Redirect mode showed a 30% improvement.
PiperOrigin-RevId: 595746162
In combination with `xdp_loader redirect`, this allows `runsc` to receive
packets directly from any NIC. It is intended to be used with a machine's NIC
to avoid the Linux networking stack entirely.
PiperOrigin-RevId: 591090544
Usage is something like:
```
$ xdp_loader redirect --devidx 2 --unpin # Clear xdp_loader state on device 2
$ xdp_loader redirect --devidx 2 # Add and pin a map and program on device 2
```
When the map and program are pinned, a socket can be inserted so that packets
are routed directly from the NIC to that socket. SSH packets (IPv4 TCP port 22)
packets are allowed through for debugging.
Also, make xdp_loader fully static for ease of deployment.
PiperOrigin-RevId: 590955764
No change to behavior, just a refactor.
Another program (tunnel) is coming, and the code is becoming unwieldy. Impose
some structure.
PiperOrigin-RevId: 472818768
Uses an AF_XDP socket to log packets entering a device. Can be used for
testing, but mostly useful as a minimal example of receiving packets via
AF_XDP.
Note that this actually prevents the packets from reaching their intended
destination, as redirection does not also send the packet through Linux's
network stack.
PiperOrigin-RevId: 470073040
Setup gVisor so that an AF_XDP dispatcher can be implemented.
Specifically:
- xdp_loader: a binary for testing XDP programs
- Two basic XDP programs
- Update the cilium/ebpf dep
- Genrule for building BPF programs
- Install clang on buildkite to support building BPF programs
PiperOrigin-RevId: 464562411
