Repository navigation
bpf: close rate-limit bypasses via IPv6, fragments, non-IP, rotating flows - #3
Open
terraboops wants to merge 1 commit into
Open
terraboops wants to merge 1 commit into
terraboops wants to merge 1 commit into
Conversation
…flows A pod could get past its bandwidth limit several ways: - IPv6: parse_flow returned -1 for anything but IPv4 and the packet passed unaccounted. It now parses IPv6, XOR-folding the addresses into the existing 32-bit key fields so the IPv4 hash cost doesn't change. - IPv4 fragments: ports were read from non-first fragments' payload, so every fragment looked like a new mouse. Fragments now key on the address pair + protocol. - Non-IP frames and truncated/malformed headers passed unaccounted. They're keyed on EtherType (or a partial tuple) and go through the sketch like everything else; single ARP-sized frames stay mice. - Rotating 5-tuples: each new flow stays under hh_threshold, so a pod could push ~24-48x its rate before the CMS saturated. Mouse bytes are now summed per direction over a ~134 ms window; past max(rate x 125 ms, 4 x hh_threshold) further packets go through the token bucket. With the default threshold that bounds mice to ~3x the configured rate, and mice still pass whenever the bucket has tokens. TestScenarioThousandMice ran 320 KB of mice at 1 B/s, which is the rotating-flow pattern itself; it now uses 100 Mbps so the traffic fits the mouse budget while the one-byte bucket still drops anything that reaches it. New L3 tests (test/bpf/bypass_linux_test.go) cover each case; all five fail on main and pass here. Claude-Session: https://claude.ai/code/session_01RyYnvjh5DBevutC4HTgELn
terraboops
force-pushed
the
fix/bpf-limit-bypass
branch
from
September 30, 2026 03:40
723f924 to
222026c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found in a security review. Each one lets a pod exceed its own
kubernetes.io/*-bandwidthlimit. None reaches another pod's state.parse_flowreturned -1, so the packet passed unaccountedhh_threshold; ~24–48x rate until CMS saturationmax(rate × 125 ms, 4 × hh_threshold)per ~134 ms window; past it, mice pay tokens. That's ~3x rate at the default threshold, and mice still pass whenever the bucket has tokensTestScenarioThousandMicesent 320 KB of mice at 1 B/s, which is the rotating-flow pattern itself. It now runs at 100 Mbps so the traffic fits the budget, and the one-byte bucket still drops anything that reaches it.Testing
New L3 tests in
test/bpf/bypass_linux_test.go, one per bypass, with both directions checked in each test.On
main(unfixed BPF), all five fail:On this branch,
make test-bpfandmake test-perfboth pass (full L3, including the new tests, and L5).L5 single-sample ns/op,
main→ branch: prog_run 759.0 → 746.6, one_elephant ingress 849.4 → 816.3, egress 827.3 → 812.6, thousand_mice 807.1 → 811.5 (noise-level). Repeated-sample A/B and the full-profileperf-vs-vanillacomparison againstmainare in progress; results will be posted here before merge.https://claude.ai/code/session_01RyYnvjh5DBevutC4HTgELn