Page MenuHomeFreeBSD

kp (Kristof Provost)
Troubleshooter

Projects

User Details

User Since
Sep 28 2014, 7:22 PM (442 w, 4 d)

Recent Activity

Today

kp updated the diff for D39223: pfsync: hold b_mtx for callout_stop(pd_tmo).

Protect tailq operation with the bucket lock.

Fri, Mar 24, 8:51 AM
kp added inline comments to D39223: pfsync: hold b_mtx for callout_stop(pd_tmo).
Fri, Mar 24, 8:47 AM
kp requested review of D39248: pf: remove pd_refs from pfsync.
Fri, Mar 24, 8:42 AM
kp added inline comments to D39206: netlink: allow netlink sockets in non-vnet jails..
Fri, Mar 24, 8:17 AM
kp committed rGad729f8d503e: pf: ignore ip6_output() return value in pf_refragment6() (authored by kp).
pf: ignore ip6_output() return value in pf_refragment6()
Fri, Mar 24, 7:10 AM
kp committed rG0ab2c922340b: ifconfig: free memory allocated by getaddrinfo() (authored by kp).
ifconfig: free memory allocated by getaddrinfo()
Fri, Mar 24, 7:09 AM

Yesterday

kp added inline comments to D39206: netlink: allow netlink sockets in non-vnet jails..
Thu, Mar 23, 3:00 AM
kp updated the diff for D39223: pfsync: hold b_mtx for callout_stop(pd_tmo).

Remove unrelated changes.

Thu, Mar 23, 1:36 AM
kp requested review of D39223: pfsync: hold b_mtx for callout_stop(pd_tmo).
Thu, Mar 23, 1:34 AM

Mon, Mar 20

kp committed rGa6719858a480: pf tests: try to trigger locking issues in pfsync_timeout() (authored by kp).
pf tests: try to trigger locking issues in pfsync_timeout()
Mon, Mar 20, 4:40 PM
kp committed rG53247cdf1244: pfsync: fix pfsync_undefer_state() locking (authored by kp).
pfsync: fix pfsync_undefer_state() locking
Mon, Mar 20, 4:40 PM
kp committed rG844ad2828a35: pfsync: add missing unlock in pfsync_defer_tmo() (authored by kp).
pfsync: add missing unlock in pfsync_defer_tmo()
Mon, Mar 20, 4:39 PM
kp committed rG511a6d5ed34b: carp: use if_name() (authored by kp).
carp: use if_name()
Mon, Mar 20, 2:15 PM
kp committed rGddbd3a2b7c3c: carp tests: unicast tests (IPv6) (authored by kp).
carp tests: unicast tests (IPv6)
Mon, Mar 20, 2:15 PM
kp committed rGb1a4ccdd8394: carp: document peer/peer6 and mcast/mcast6 in the relevant man pages (authored by kp).
carp: document peer/peer6 and mcast/mcast6 in the relevant man pages
Mon, Mar 20, 2:15 PM
kp committed rG92c5dbbb131b: carp tests: unicast tests (IPv4) (authored by kp).
carp tests: unicast tests (IPv4)
Mon, Mar 20, 2:15 PM
kp committed rG137818006de5: carp: support unicast (authored by kp).
carp: support unicast
Mon, Mar 20, 2:15 PM
kp closed D38942: carp tests: unicast tests (IPv6).
Mon, Mar 20, 2:15 PM
kp closed D38943: carp: document peer/peer6 and mcast/mcast6 in the relevant man pages.
Mon, Mar 20, 2:15 PM
kp closed D38941: carp tests: unicast tests (IPv4).
Mon, Mar 20, 2:14 PM
kp closed D38940: carp: support unicast.
Mon, Mar 20, 2:14 PM
kp updated the diff for D38940: carp: support unicast.

Review remarks

Mon, Mar 20, 10:50 AM
kp added inline comments to D38940: carp: support unicast.
Mon, Mar 20, 10:49 AM
kp committed rG9d48283d6028: carp tests: test manually switch between backup and master (authored by kp).
carp tests: test manually switch between backup and master
Mon, Mar 20, 10:19 AM
kp closed D39115: carp tests: test manually switch between backup and master.
Mon, Mar 20, 10:18 AM
kp closed D39048: carp: add netlink interface.
Mon, Mar 20, 10:18 AM
kp committed rG40e043596409: carp: add netlink interface (authored by kp).
carp: add netlink interface
Mon, Mar 20, 10:18 AM
kp added a comment to D39048: carp: add netlink interface.

Nit: it'll break the build w/o NETLINK. I'll come up with a diff similar to D39148 in a day or two.

Mon, Mar 20, 9:57 AM
kp committed rG5e7bbde17d53: pf tests: test IPv6 fragmentation with link-local addresses (authored by kp).
pf tests: test IPv6 fragmentation with link-local addresses
Mon, Mar 20, 9:48 AM
kp committed rG4b77c46dc29a: pf tests: test IPv6 fragmentation with link-local addresses (authored by kp).
pf tests: test IPv6 fragmentation with link-local addresses
Mon, Mar 20, 9:48 AM

Sat, Mar 18

kp updated the diff for D38940: carp: support unicast.

Review remarks

Sat, Mar 18, 2:47 PM
kp updated the diff for D39048: carp: add netlink interface.

Review remarks

Sat, Mar 18, 2:47 PM
kp added inline comments to D38940: carp: support unicast.
Sat, Mar 18, 11:34 AM
kp accepted D39144: netlink: fix capped uncapped ack handling in snl(3)..
Sat, Mar 18, 10:45 AM
kp added a comment to D39048: carp: add netlink interface.

Q: any concerns over not adding find-by-name handler? It seems cheap codeline-wise on the kernel side and will simplify client side (avoid if_getunit call).

Sat, Mar 18, 10:41 AM

Fri, Mar 17

kp updated the diff for D38940: carp: support unicast.

Rebase on top of netlink-ified carp

Fri, Mar 17, 5:05 PM
kp updated the diff for D39048: carp: add netlink interface.

Review remarks

Fri, Mar 17, 5:05 PM
kp updated the diff for D39115: carp tests: test manually switch between backup and master.

Remove sleep

Fri, Mar 17, 3:18 PM

Thu, Mar 16

kp added inline comments to D39115: carp tests: test manually switch between backup and master.
Thu, Mar 16, 2:44 PM
kp requested review of D39115: carp tests: test manually switch between backup and master.
Thu, Mar 16, 11:02 AM
kp committed rG225e85513fd7: pf tests: test IPv6 fragmentation with link-local addresses (authored by kp).
pf tests: test IPv6 fragmentation with link-local addresses
Thu, Mar 16, 10:02 AM
kp committed rG80e76c61ccc4: pf: set scope in pf_refragment6() (authored by kp).
pf: set scope in pf_refragment6()
Thu, Mar 16, 10:02 AM
kp committed rGb52b61c0b6b1: pf: distinguish forwarding and output cases for pf_refragment6() (authored by kp).
pf: distinguish forwarding and output cases for pf_refragment6()
Thu, Mar 16, 10:02 AM
kp closed D39063: pf tests: test IPv6 fragmentation with link-local addresses.
Thu, Mar 16, 10:01 AM
kp closed D39062: pf: set scope in pf_refragment6().
Thu, Mar 16, 10:01 AM
kp added a comment to D39113: carp: carp_master_down_locked() requires net epoch.
In D39113#890320, @zlei wrote:

BTW, without INVARIANTS, I have not encounter any problem even run the test script (as in TEST PLAN) multiple times. Maybe I have good luck, or there're something hide behind net epoch .

carp_master_down_locked() will call ip_output() , arprequest() and nd6_na_output() those all require net epoch. Although the ifp holds a reference but I think without net epoch the system will behave badly, possibly access freed memory.

The epoch system serves to make sure that resources we rely on (such as the ifp, or route or neighbour objects) don't go away while we're using them. It's pretty unlikely for them to actually go away in the tiny slice of time where it'd matter, so it's completely normal that you didn't see any issues even with the missing epoch calls.

Thu, Mar 16, 9:16 AM
kp added a comment to D39113: carp: carp_master_down_locked() requires net epoch.
In D39113#890307, @zlei wrote:
In D39113#890304, @kp wrote:

It'd be good to add this case to the carp tests. Can you? If not, I'll take a look. I'm doing some carp work as well anyway.

I'm not familiar with the atf test framework, and I have no bandwidth. I'm still struggling with route cache framework yet :(

Thu, Mar 16, 8:52 AM
kp accepted D39113: carp: carp_master_down_locked() requires net epoch.

It'd be good to add this case to the carp tests. Can you? If not, I'll take a look. I'm doing some carp work as well anyway.

Thu, Mar 16, 8:25 AM

Wed, Mar 15

kp added inline comments to D39092: netlink: improve snl(3).
Wed, Mar 15, 7:33 PM
kp accepted D39092: netlink: improve snl(3).
Wed, Mar 15, 2:19 PM

Tue, Mar 14

kp added inline comments to D39048: carp: add netlink interface.
Tue, Mar 14, 4:25 PM
kp updated the diff for D39048: carp: add netlink interface.

Use attributes (i.e. TLV) for everything.

Tue, Mar 14, 4:22 PM
kp added inline comments to D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.
Tue, Mar 14, 12:22 PM
kp updated the diff for D39061: pf: distinguish forwarding and output cases for pf_refragment6().

Review remarks

Tue, Mar 14, 10:26 AM
kp updated the diff for D39063: pf tests: test IPv6 fragmentation with link-local addresses.

ping6 -> ping -6

Tue, Mar 14, 7:39 AM

Mon, Mar 13

kp requested review of D39063: pf tests: test IPv6 fragmentation with link-local addresses.
Mon, Mar 13, 5:19 PM
kp requested review of D39062: pf: set scope in pf_refragment6().
Mon, Mar 13, 5:19 PM
kp requested review of D39061: pf: distinguish forwarding and output cases for pf_refragment6().
Mon, Mar 13, 5:19 PM
kp added inline comments to D39048: carp: add netlink interface.
Mon, Mar 13, 1:51 PM
kp updated the diff for D39048: carp: add netlink interface.

Full patch this time.

Mon, Mar 13, 1:50 PM
kp added a reviewer for D39048: carp: add netlink interface: melifaro.
Mon, Mar 13, 1:49 PM
kp added a comment to D38940: carp: support unicast.

I'm happy to work with you (or implement a variation of this patch myself) that uses netlink as the control mechanism.

Mon, Mar 13, 1:49 PM
kp requested review of D39048: carp: add netlink interface.
Mon, Mar 13, 1:47 PM
kp accepted D39046: net: refactor if_clone.c #1.

Two non-blocking remarks.

Mon, Mar 13, 12:51 PM
kp accepted D39047: netlink: make netlink the standard part of the kernel..
Mon, Mar 13, 12:45 PM

Wed, Mar 8

kp added a comment to D38940: carp: support unicast.
In D38940#887365, @zlei wrote:
In D38940#887195, @kp wrote:
In D38940#887150, @zlei wrote:

This allows carp to be used in unicast mode, which is useful in certain virtual configurations (e.g. AWS, VMWare ESXi, ...)

I use carp in my production environment (ESXi), and I have to enable promisc mode for virtual ports so that multicast frames can forward between VMs.

I do not familiar with AWS, so suppose AWS does not provide mechanism like ESXi. If AWS is willing to provide ( configuration of promisc mode ) then this feature is not that useful.

It doesn't. Yesterday I discovered that the current version of the patch doesn't work in AWS, because it changes the source MAC address to a multicast address. I've got a fix for that (i.e. don't change the MAC address in unicast mode) that allows it to work in AWS.

I think AWS and ESXi by default block those forge packets with CARP(VRRP) multicast source MAC address.

I wouldn't describe the traffic as forged. (And I was wrong, it's not a multicast MAC address, but a "virtual router MAC address"). The VRRP standard at least explicitly requires that address to be used. CARP isn't formally standardised (at least that I could find), but it behaves very like VRRP.
In any event, we need to do things slightly differently to make them work in cloud setups.

Wed, Mar 8, 4:28 PM
kp added a comment to D38981: routing: move all kernel datapath definitions to route/route_fib.h.

If I'm reading this right there's a userspace visible change in definitions (e.g. struct route is no longer visible without _KERNEL). If so, should we do an exp-run over the ports to see what the fallout is going to be like?

Wed, Mar 8, 1:41 PM
kp added inline comments to D38947: netlink: add snl writer.
Wed, Mar 8, 8:52 AM
kp added a comment to D38940: carp: support unicast.
In D38940#887150, @zlei wrote:

This allows carp to be used in unicast mode, which is useful in certain virtual configurations (e.g. AWS, VMWare ESXi, ...)

I use carp in my production environment (ESXi), and I have to enable promisc mode for virtual ports so that multicast frames can forward between VMs.

I do not familiar with AWS, so suppose AWS does not provide mechanism like ESXi. If AWS is willing to provide ( configuration of promisc mode ) then this feature is not that useful.

It doesn't. Yesterday I discovered that the current version of the patch doesn't work in AWS, because it changes the source MAC address to a multicast address. I've got a fix for that (i.e. don't change the MAC address in unicast mode) that allows it to work in AWS. Even in promiscuous mode the multicast traffic never arrives, so we do need this at least for AWS, and it would be useful for ESXi to avoid needing to run interfaces in promiscuous mode.

Wed, Mar 8, 7:52 AM

Tue, Mar 7

kp added a comment to D38940: carp: support unicast.
In D38940#886690, @kp wrote:

I'm going to use this as an opportunity to get to know netlink a bit more, so I'll take a stab at a first version myself, and then we'll go from there.

Tue, Mar 7, 4:08 PM
kp added a comment to D38940: carp: support unicast.

I'm happy to work with you (or implement a variation of this patch myself) that uses netlink as the control mechanism.

Tue, Mar 7, 1:37 PM
kp added a comment to D38940: carp: support unicast.

I'm a little torn on how to handle the extension in the interface to userspace. I've added a new ioctl for it, but we could also extend the struct (and then teach the existing ioctl to cope with two sizes of structure), or we could convert the whole thing to using netlink, to make future extensions easier.

Tue, Mar 7, 10:49 AM
kp requested review of D38943: carp: document peer/peer6 and mcast/mcast6 in the relevant man pages.
Tue, Mar 7, 10:48 AM
kp requested review of D38942: carp tests: unicast tests (IPv6).
Tue, Mar 7, 10:47 AM
kp requested review of D38941: carp tests: unicast tests (IPv4).
Tue, Mar 7, 10:47 AM
kp requested review of D38940: carp: support unicast.
Tue, Mar 7, 10:47 AM
kp committed rGf427703f16db: carp tests: ensure exactly one jail is master (authored by kp).
carp tests: ensure exactly one jail is master
Tue, Mar 7, 10:38 AM
kp added a comment to D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.

We're failing a couple of test cases in /usr/tests/sbin/pfctl with this patch. At least one of the failures is due to the duplicate allow-opts, so an easy fix.

Tue, Mar 7, 10:27 AM

Mon, Mar 6

kp committed rG9f1beeaed4d5: pfctl: fix superblock printf format mismatch (authored by vegeta_tuxpowered.net).
pfctl: fix superblock printf format mismatch
Mon, Mar 6, 7:27 PM
kp committed rG1be25bdb730f: pfctl: remove set but unused variable (authored by kp).
pfctl: remove set but unused variable
Mon, Mar 6, 7:27 PM
kp closed D38918: pfctl: Fix superblock printf format mismatch.
Mon, Mar 6, 7:27 PM
kp added reviewers for D38918: pfctl: Fix superblock printf format mismatch: kp, network.
Mon, Mar 6, 3:02 PM
kp added a comment to D38918: pfctl: Fix superblock printf format mismatch.

With the patch that seems to fail to build on armv6 (and I suspect on i386 as well):

Mon, Mar 6, 3:02 PM
kp added a comment to D38888: pf: add sample netlink interface.

Also, somewhat random question: are we keeping the programming API identical (or close to) Linux?

Mon, Mar 6, 1:56 PM
kp added a comment to D38888: pf: add sample netlink interface.

That's not bad at all. It seems to perform about as well as the current copy-structs-around ioctl() interface.

Mon, Mar 6, 1:20 PM

Sat, Mar 4

kp added a comment to D38843: epair: Simplify the transmit path and reduce tail latency.

@kp , just out of curiosity. How many packets per second did you get in your test after this patch?

Sat, Mar 4, 7:53 PM
kp committed rG38e2d5db2ab1: netpfil tests: Add functions for testing routing scenarios (authored by kp).
netpfil tests: Add functions for testing routing scenarios
Sat, Mar 4, 1:39 PM
kp committed rGf5b204adf4a6: ifconfig: remove unused variable (authored by kp).
ifconfig: remove unused variable
Sat, Mar 4, 1:39 PM
kp closed D38126: netpfil tests: Add functions for testing routing scenarios.
Sat, Mar 4, 1:38 PM
kp accepted D38843: epair: Simplify the transmit path and reduce tail latency.

Yeah, my test box has vm.ndomains: 2.
This version is much, much faster than the pervious, and it does make the code simpler to reason about (than what we had before) as well.

Sat, Mar 4, 12:13 PM

Fri, Mar 3

kp accepted D38893: net: unify mtu update code.
Fri, Mar 3, 4:45 PM

Thu, Mar 2

kp committed rG5e9b79c4e652: pfsync: ensure 'error' is always initialised (authored by kp).
pfsync: ensure 'error' is always initialised
Thu, Mar 2, 4:26 PM
kp committed rG3dec62eded04: pfsync: support deferring IPv6 packets (authored by kp).
pfsync: support deferring IPv6 packets
Thu, Mar 2, 4:26 PM
kp committed rG7e2de012f38a: pfsync: ensure 'error' is always initialised (authored by kp).
pfsync: ensure 'error' is always initialised
Thu, Mar 2, 4:26 PM
kp committed rGdacffdd4dc51: pfsync: support deferring IPv6 packets (authored by kp).
pfsync: support deferring IPv6 packets
Thu, Mar 2, 4:26 PM
kp added a comment to D38843: epair: Simplify the transmit path and reduce tail latency.

Thanks! I'll try setting this up. Was it a plain GENERIC-NODEBUG config, or were you testing with options RSS enabled?

Thu, Mar 2, 1:24 PM
kp added a comment to D38843: epair: Simplify the transmit path and reduce tail latency.
In D38843#884393, @kp wrote:

The intent was also to avoid locking between the sender and receiver side.
Re-running my test setup shows 889.672 Kpps without this change, and with it I see 42.635 Kpps. That's kind of a steep hit.

Wow, indeed. Could you please describe your test setup?

Thu, Mar 2, 12:44 PM
kp added a comment to D38843: epair: Simplify the transmit path and reduce tail latency.

The intent was also to avoid locking between the sender and receiver side.
Re-running my test setup shows 889.672 Kpps without this change, and with it I see 42.635 Kpps. That's kind of a steep hit.

Thu, Mar 2, 7:50 AM

Wed, Mar 1

kp committed rG2a02d3dad391: pf tests: test pfsync over IPSec (authored by kp).
pf tests: test pfsync over IPSec
Wed, Mar 1, 3:11 PM
kp committed rG69361b878546: if_ovpn tests: skip the if_ovpn_c test if if_ovpn.ko isn't loaded (authored by kp).
if_ovpn tests: skip the if_ovpn_c test if if_ovpn.ko isn't loaded
Wed, Mar 1, 10:01 AM