AltraMayor / gatekeeper

The first open-source DDoS protection system
https://github.com/AltraMayor/gatekeeper/wiki
GNU General Public License v3.0
1.32k stars 227 forks source link

LPM iterators #542

Closed AltraMayor closed 2 years ago

AltraMayor commented 2 years ago

Once Gatekeeper v1.1 is out, the major roadblock for Gatekeeper to use a mainline version of DPDK is the need to iterate LPM tables for IPv4 and IPv6. There's no sign that this feature is going to make it into DPDK in the near future since DPDK's LPM library is meant to implement a forwarding information base (FIB) instead of a routing information base (RIB). The solution to avoid a patch to add LPM iterators to DPDK is for Gatekeeper to implement a prefix tree to work as a RIB.

Since Gatekeeper would have a FIB (current code) and a RIB (new code), we must make sure that the RIB is not memory hungry. Having a prefix tree would make iterators cheaper than the current implementation, and lookups fast enough for the needs of the interfaces that manage the routing table of Gatekeeper (i.e. Dynamic configuration and CPS blocks). The current FIB would still be used to forward packets at the data plane level.

AltraMayor commented 2 years ago

Another advantage of having a RIB in Gatekeeper would be to be able to replace DPDK's LPM library with LPM on SmartNICs that support this feature.