kaffa/XDP-Firewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use per CPU array map for filter rules to increase performance.

Browse Source
This commit is contained in:
Christian Deacon
2023-11-12 21:35:22 +00:00
parent 03d38b55e1
commit b3530e3e68
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/xdpfw.c
View File

@@ -43,7 +43,7 @@ void signalHndl(int tmp)
*/ */
void updatefilters(struct config *cfg) void updatefilters(struct config *cfg)
{ {
// Loop through all filters and delete the map. // Loop through all filters and delete the map. We do this in the case rules were edited and were put out of order since the key doesn't uniquely map to a specific rule.
for (__u8 i = 0; i < MAX_FILTERS; i++) for (__u8 i = 0; i < MAX_FILTERS; i++)
{ {
__u32 key = i; __u32 key = i;
@@ -60,8 +60,16 @@ void updatefilters(struct config *cfg)
break; break;
} }
// Create value array (max CPUs in size) since we're using a per CPU map.
struct filter filter[MAX_CPUS];
for (int j = 0; j < MAX_CPUS; j++)
{
filter[j] = cfg->filters[i];
}
// Attempt to update BPF map. // Attempt to update BPF map.
if (bpf_map_update_elem(filtersmap, &i, &cfg->filters[i], BPF_ANY) == -1) if (bpf_map_update_elem(filtersmap, &i, &filter, BPF_ANY) == -1)
{ {
fprintf(stderr, "Error updating BPF item #%d\n", i); fprintf(stderr, "Error updating BPF item #%d\n", i);
} }

2
src/xdpfw_kern.c
View File

@@ -29,7 +29,7 @@ struct
struct struct
{ {
__uint(type, BPF_MAP_TYPE_ARRAY); __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
__uint(max_entries, MAX_FILTERS); __uint(max_entries, MAX_FILTERS);
__type(key, __u32); __type(key, __u32);
__type(value, struct filter); __type(value, struct filter);