mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 13:46:52 +01:00
Wade Simmons
53c565eb29
Lanes were collapsing onto lane 0 and staying there. Nebula writes a peer's inbound packets to the tun queue matching the socket they arrived on, and tun_flow_update teaches the kernel to steer that flow's outbound packets to the same queue, preferring what it learned over the hash. So while a tunnel's lanes were still down -- which is every tunnel, for its first moments -- all traffic arrived on socket 0, pinning every flow to queue 0 on both hosts for as long as it stayed busy. With the lane following the routine, that meant lane 0 forever. Two changes break the loop: Choose the lane from the packet's own 5-tuple hash, so lane spread no longer depends on tun steering at all. The hash is symmetric, and the high-addressed side rotates its choice by the low side's port offset, so a flow's two directions land on partner lanes with exact reverse 4-tuples and each arrives through the conntrack entry the other's probe opened. Seed every lane as demanded at lane-set creation, so the first traffic tick probes them all at once rather than waiting for a flow to hash onto each. Lanes have to be up before the flows are, not after. A routine may now send on any lane, so it holds a SendBatch per lane, built lazily and all borrowing one shared arena -- the slab is the expensive part, and a batch per (routine, lane) would otherwise cost hundreds of megabytes. full() counts across the batches so the total outstanding stays bounded as before. That also means several routines can write to one socket, which was already true for base traffic under multiport: the linux batchWriter's sendmmsg scratch had no lock. Take a mutex there, once per flush.
79 lines
2.5 KiB
Go
79 lines
2.5 KiB
Go
package batch
|
|
|
|
import "net/netip"
|
|
|
|
const SendBatchCap = 128
|
|
|
|
// batchWriter is the minimal subset of udp.Conn needed by SendBatch to flush.
|
|
type batchWriter interface {
|
|
WriteBatch(bufs [][]byte, addrs []netip.AddrPort) (int, error)
|
|
}
|
|
|
|
// SendBatch accumulates encrypted UDP packets and flushes them via WriteBatch.
|
|
// One SendBatch is owned by each listenIn goroutine; no locking is needed.
|
|
// Slots are backed by an Arena (see its docs)
|
|
type SendBatch struct {
|
|
out batchWriter
|
|
bufs [][]byte
|
|
dsts []netip.AddrPort
|
|
// arena backs the slots. borrowed means someone else owns it and Flush must
|
|
// leave it alone.
|
|
arena *Arena
|
|
borrowed bool
|
|
}
|
|
|
|
// NewSendBatch makes a SendBatch with batchCap slots and an arenaSize byte buffer for slices to back those slots
|
|
func NewSendBatch(out batchWriter, batchCap, arenaSize int) *SendBatch {
|
|
return newSendBatch(out, batchCap, NewArena(arenaSize), false)
|
|
}
|
|
|
|
// NewSendBatchSharedArena makes a SendBatch that borrows arena rather than
|
|
// allocating one. Several batches over different sockets can then split a single
|
|
// slab, which is what multiport lanes need: the slab is the expensive part of a
|
|
// SendBatch and one routine may hold a batch per lane. Flush leaves the arena
|
|
// alone, so the owner must Reset it once every batch sharing it is drained.
|
|
func NewSendBatchSharedArena(out batchWriter, batchCap int, arena *Arena) *SendBatch {
|
|
return newSendBatch(out, batchCap, arena, true)
|
|
}
|
|
|
|
func newSendBatch(out batchWriter, batchCap int, arena *Arena, borrowed bool) *SendBatch {
|
|
return &SendBatch{
|
|
out: out,
|
|
bufs: make([][]byte, 0, batchCap),
|
|
dsts: make([]netip.AddrPort, 0, batchCap),
|
|
arena: arena,
|
|
borrowed: borrowed,
|
|
}
|
|
}
|
|
|
|
func (b *SendBatch) Reserve(sz int) []byte {
|
|
return b.arena.Reserve(sz)
|
|
}
|
|
|
|
// Len reports how many packets are queued for the next Flush. Callers use
|
|
// it to flush incrementally once a full sendmmsg batch has accumulated,
|
|
// bounding how long the first packet of a large read batch waits.
|
|
func (b *SendBatch) Len() int { return len(b.bufs) }
|
|
|
|
func (b *SendBatch) Commit(pkt []byte, dst netip.AddrPort) {
|
|
b.bufs = append(b.bufs, pkt)
|
|
b.dsts = append(b.dsts, dst)
|
|
}
|
|
|
|
// Flush writes every queued packet and reports how many actually went out. A short count means some destinations
|
|
// were undeliverable; the batch is drained either way.
|
|
func (b *SendBatch) Flush() (int, error) {
|
|
var err error
|
|
written := 0
|
|
if len(b.bufs) > 0 {
|
|
written, err = b.out.WriteBatch(b.bufs, b.dsts)
|
|
}
|
|
clear(b.bufs)
|
|
b.bufs = b.bufs[:0]
|
|
b.dsts = b.dsts[:0]
|
|
if !b.borrowed {
|
|
b.arena.Reset()
|
|
}
|
|
return written, err
|
|
}
|