←back to thread

How to escape the Linux networking stack

(blog.cloudflare.com)
148 points meysamazad | 1 comments | 17 Nov 25 15:49 UTC | HN request time: 0s | source
Show context
notepad0x90 ◴[17 Nov 25 20:18 UTC] No.45957801[source]▶
I'm slightly surprised cloudflare isn't using a userspace tcp/ip stack already (faster - less context switches and copies). It's the type of company I'd expect to actually need one.
replies(2): >>45958128 #>>45959181 #
Droobfest ◴[17 Nov 25 20:51 UTC] No.45958128[source]▶
From 2016: https://blog.cloudflare.com/why-we-use-the-linux-kernels-tcp...
replies(1): >>45958213 #
notepad0x90 ◴[17 Nov 25 20:59 UTC] No.45958213[source]▶
Nice, they know better. But it also makes me wonder, because they're saying "but what if you need to run another app", I'd expect for things like loadbalancers for example, you'd only run one app per server on the data plane, the user space stack handles that, and the OS/services use a different control plane NIC with the kernel stack so that boxes are reachable even if there is link saturation, ddos,etc..

It also makes me wonder, why is tcp/ip special? The kernel should expose a raw network device. I get physical or layer 2 configuration happening in the kernel, but if it is supposed to do IP, then why stop there, why not TLS as well? Why run a complex network protocol stack in the kernel when you can just expose a configured layer 2 device to a user space process? It sounds like "that's just the way it's always been done" type of a scenario.

replies(3): >>45958565 #>>45959377 #>>45960224 #
1. rcxdude ◴[17 Nov 25 22:55 UTC] No.45959377[source]▶
You can do that if you want, but I think part of why tcp/ip is a useful layer of abstraction is it allows more robust boundaries between applications that may be running on the same machine. If you're just at layer 2 you are basically acting in behalf of the whole box.