Florin Andrei wrote:
quoted text
> 
> ##############
> Huge performance improvements in the network stack, including:
>     * In pf, store routing table ID, queue ID etc directly in the packet 
> header mbuf instead of using mbuf tags (which use malloc'd memory). This 
> yields a 100% improvement in pf performance.
>     * Skip TCP/UDP/ICMP/ICMP6 checksumming when not necessary. This 
> yields a further 10% improvement in pf performance.
>     * A change in the way the kernel random pool is stirred greatly 
> increases performance with network interface cards that support 
> interrupt mitigation, especially on architectures where reading the 
> clock is expensive (such as amd64).
> ##############
> 
> I'll try 4.2.

HOLY SH*T! I tried 4.2. It rocks!

Just the first test that I tried after installing it:
- switched gigabit network
- web server behind 1:1 NATing firewall
- firewall is AMD64 X2 2.4GHz
- downloading 2GB file via HTTP through the firewall in infinite loop
- flooding the firewall with small UDP packets, random source IPs, 
generated as fast as my workstation (AMD64 X2 6400, Intel Pro/1000 PCI 
Express card, Linux Fedora 7, running the kernel-level "pktgen" packet 
generator which is very fast) can crank them out. The packets are 
directed to the NATed address of the web server, to a port that's 
blocked by the firewall.

Under these conditions, OpenBSD 4.1 as a firewall just keels over and 
dies. All traffic through the firewall just stops in an instant.
Linux 2.6.18 fares slightly better, the current download finishes up, 
but another one won't start.

But the default OpenBSD 4.2 i386 uniprocessor kernel doesn't seem to 
care. The download just keeps going. New downloads are initiated OK 
through the firewall. There are even spare CPU cycles left :-) not many 
(10%) but still. There's a very large percentage of CPU (80...90%) used 
for interrupts.

Good job folks, I'm impressed.

Anyone building gigabit routers and firewalls, don't delay, upgrade to 
4.2. Heck, do that even for 100Mbit systems, this type of DoS doesn't 
need much bandwidth to be effective.

I'll keep doing tests. If anything interesting shows up, I'll post the 
results in a new thread.

-- 
Florin Andrei

http://florin.myip.org/