webnet/tailscale
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

net/batching: implement NodeAttrNeverGSOEqualTail

Browse Source 
This NodeCapability works around the UDP GSO bugs introduced by
torvalds/linux@b10b446 (v7.0-rc1). These bugs were later fixed by
torvalds/linux@78effd8 and torvalds/linux@5f17ae0 (v7.1-rc5). These
Linux kernel bugs cause mangled UDP headers and UDP checksums, resulting
in high levels of packet loss.

The aforementioned bugs have already made their way downstream into
various distros, e.g. Ubuntu 26.04 LTS. Impacted users are now dealing
with poor UDP performance in tailscaled, and in any other software that
makes use of UDP GSO.

Not all users of the affected kernels are impacted as the relevant
kernel code path sits between kernel and netdev driver, and behaviors
vary by driver/device capability.

We cannot detect impact at runtime, as this would require gathering all
netdevs, and performing loopback tests. This is invasive and in many
cases impossible.

So, we are left to choose between disabling UDP GSO for all users on
affected kernels, whether they experience real impact or not, or try
and work around the bugs. Disabling UDP GSO for a user that is not
impacted can cut max throughput in half, and consume more CPU cycles.

This commit attempts to workaround the bugs by avoiding UDP GSO when
batches are small, and injecting a 1-byte sentinel tail payload when
they are large. This tail payload is smaller than "GSO size", which
sidesteps the primary trigger of all fragments in a batch being
equal in length.

The end result is slightly increased payload and packet overhead, but
functional UDP GSO for all Linux 7.0-7.1.4 users, regardless of
netdev/driver.

Updates #19777

Signed-off-by: Jordan Whited <jordan@tailscale.com>
This commit is contained in:
Jordan Whited
2026-05-29 11:36:35 -07:00
committed by Jordan Whited
parent 7355116c05
commit 8b58bd6c64
4 changed files with 234 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/batching/conn_linux_test.go
+120 -6
View File
@@ -140,8 +140,6 @@ func Test_linuxBatchingConn_splitCoalescedMessages(t *testing.T) {
}
func Test_linuxBatchingConn_coalesceMessages(t *testing.T) {
c := &linuxBatchingConn{}
withGeneveSpace := func(len, cap int) []byte {
return make([]byte, len+packet.GeneveFixedHeaderLength, cap+packet.GeneveFixedHeaderLength)
}
@@ -152,13 +150,17 @@ func Test_linuxBatchingConn_coalesceMessages(t *testing.T) {
geneve.VNI.Set(1)
cases := []struct {
name string
buffs [][]byte
geneve packet.GeneveHeader
name string
buffs [][]byte
geneve packet.GeneveHeader
neverGSOEqualTail bool
// Each wantLens slice corresponds to the Buffers of a single coalesced message,
// and each int is the expected length of the corresponding Buffer[i].
wantLens [][]int
wantGSO []int
// wantSentinelAtTail[i], when true, asserts that the tail entry of
// msgs[i].Buffers is the shared neverGSOEqualTailSentinelPayload slice.
wantSentinelAtTail []bool
}{
{
name: "one-message-no-coalesce",
@@ -257,10 +259,113 @@ func Test_linuxBatchingConn_coalesceMessages(t *testing.T) {
wantLens: [][]int{{2 + packet.GeneveFixedHeaderLength, 2 + packet.GeneveFixedHeaderLength, 2 + packet.GeneveFixedHeaderLength}},
wantGSO: []int{2 + packet.GeneveFixedHeaderLength},
},
{
name: "two-equal-len-coalesce-neverGSOEqualTail-appends-sentinel",
buffs: [][]byte{
withGeneveSpace(3, 3),
withGeneveSpace(3, 3),
},
neverGSOEqualTail: true,
wantLens: [][]int{{3, 3, len(neverGSOEqualTailSentinelPayload)}},
wantGSO: []int{3},
wantSentinelAtTail: []bool{true},
},
{
name: "two-equal-len-coalesce-neverGSOEqualTail-vni-isSet-appends-sentinel",
buffs: [][]byte{
withGeneveSpace(3, 3+packet.GeneveFixedHeaderLength),
withGeneveSpace(3, 3),
},
geneve: geneve,
neverGSOEqualTail: true,
wantLens: [][]int{{3 + packet.GeneveFixedHeaderLength, 3 + packet.GeneveFixedHeaderLength, len(neverGSOEqualTailSentinelPayload)}},
wantGSO: []int{3 + packet.GeneveFixedHeaderLength},
wantSentinelAtTail: []bool{true},
},
{
name: "two-unequal-len-coalesce-neverGSOEqualTail-smaller-tail-no-sentinel",
buffs: [][]byte{
withGeneveSpace(3, 3),
withGeneveSpace(2, 2),
},
neverGSOEqualTail: true,
wantLens: [][]int{{3, 2}},
wantGSO: []int{3},
},
{
name: "one-byte-tail-neverGSOEqualTail-not-coalesced",
// okToCoalesceWithSentinel is false when msgLen == 1 and
// neverGSOEqualTail is set; the 1-byte tail is split into
// its own non-coalesced singleton msg.
buffs: [][]byte{
withGeneveSpace(2, 2),
withGeneveSpace(1, 1),
},
neverGSOEqualTail: true,
wantLens: [][]int{{2}, {1}},
wantGSO: []int{0, 0},
},
{
name: "one-byte-tail-neverGSOEqualTail-vni-isSet-coalesced",
// With vniIsSet, msgLen always includes the Geneve header, so
// okToCoalesceWithSentinel is true even for "1-byte payloads".
// The naturally smaller tail short-circuits the sentinel.
buffs: [][]byte{
withGeneveSpace(2, 2+packet.GeneveFixedHeaderLength),
withGeneveSpace(1, 1),
},
geneve: geneve,
neverGSOEqualTail: true,
wantLens: [][]int{{2 + packet.GeneveFixedHeaderLength, 1 + packet.GeneveFixedHeaderLength}},
wantGSO: []int{2 + packet.GeneveFixedHeaderLength},
},
{
name: "batch-boundary-sentinel-appended-on-prior-batch-neverGSOEqualTail",
// The 4th buff (length 5) is larger than gsoSize=3 so it
// closes the first batch. The first batch has dgramCnt > 1 and
// no smaller tail, so the sentinel is appended before starting
// the new batch.
buffs: [][]byte{
withGeneveSpace(3, 3),
withGeneveSpace(3, 3),
withGeneveSpace(3, 3),
withGeneveSpace(5, 5),
},
neverGSOEqualTail: true,
wantLens: [][]int{{3, 3, 3, len(neverGSOEqualTailSentinelPayload)}, {5}},
wantGSO: []int{3, 0},
wantSentinelAtTail: []bool{true, false},
},
{
name: "single-buff-neverGSOEqualTail-no-sentinel",
// Only one datagram, no GSO happening, no sentinel.
buffs: [][]byte{
withGeneveSpace(3, 3),
},
neverGSOEqualTail: true,
wantLens: [][]int{{3}},
wantGSO: []int{0},
},
{
name: "equal-len-then-smaller-tail-then-equal-neverGSOEqualTail",
// The smaller tail ends the first batch with no sentinel
// (variation already provided), then a second singleton batch
// is started for the trailing equal-length buff.
buffs: [][]byte{
withGeneveSpace(3, 3),
withGeneveSpace(3, 3),
withGeneveSpace(2, 2),
withGeneveSpace(3, 3),
},
neverGSOEqualTail: true,
wantLens: [][]int{{3, 3, 2}, {3}},
wantGSO: []int{3, 0},
},
}
for _, tt := range cases {
t.Run(tt.name, func(t *testing.T) {
c := &linuxBatchingConn{}
addr := &net.UDPAddr{
IP: net.ParseIP("127.0.0.1"),
Port: 1,
@@ -270,7 +375,7 @@ func Test_linuxBatchingConn_coalesceMessages(t *testing.T) {
msgs[i].Buffers = make([][]byte, 1)
msgs[i].OOB = make([]byte, controlMessageSize)
}
got := c.coalesceMessages(addr, tt.geneve, tt.buffs, msgs, packet.GeneveFixedHeaderLength)
got := c.coalesceMessages(addr, tt.geneve, tt.buffs, msgs, packet.GeneveFixedHeaderLength, tt.neverGSOEqualTail)
if got != len(tt.wantLens) {
t.Fatalf("got len %d want: %d", got, len(tt.wantLens))
}
@@ -288,6 +393,15 @@ func Test_linuxBatchingConn_coalesceMessages(t *testing.T) {
}
}
wantSentinel := i < len(tt.wantSentinelAtTail) && tt.wantSentinelAtTail[i]
if wantSentinel {
tail := msgs[i].Buffers[len(msgs[i].Buffers)-1]
if len(tail) != len(neverGSOEqualTailSentinelPayload) ||
&tail[0] != &neverGSOEqualTailSentinelPayload[0] {
t.Errorf("msgs[%d] tail buffer is not neverGSOEqualTailSentinelPayload", i)
}
}
// coalesceMessages calls setGSOSizeInControl, which uses a cmsg
// type of UDP_SEGMENT, and getGSOSizeInControl scans for a cmsg
// type of UDP_GRO. Therefore, we have to use the lower-level