{"id":75939,"date":"2020-03-29T19:42:19","date_gmt":"2020-03-29T17:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cloudflare-podgotovila-patchi-kardinalno-uskoryayushhie-diskovoe-shifrovanie-v-linux"},"modified":"2020-03-29T19:42:19","modified_gmt":"2020-03-29T17:42:19","slug":"kompaniya-cloudflare-podgotovila-patchi-kardinalno-uskoryayushhie-diskovoe-shifrovanie-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/kompaniya-cloudflare-podgotovila-patchi-kardinalno-uskoryayushhie-diskovoe-shifrovanie-v-linux","title":{"rendered":"Spolo\u010dnos\u0165 Cloudflare pripravila opravy, ktor\u00e9 radik\u00e1lne zr\u00fdch\u013euj\u00fa \u0161ifrovanie disku v Linuxe","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1ri zo spolo\u010dnosti Cloudflare ozn\u00e1mili<\/a><\/noindex> o optimaliz\u00e1cii v\u00fdkonu \u0161ifrovania disku v jadre Linuxu. V d\u00f4sledku toho boli pripraven\u00e9 z\u00e1platy<\/a><\/noindex> pre subsyst\u00e9m dm-crypt<\/a><\/noindex> a Crypto API, ktor\u00e9 v syntetickom teste viac ne\u017e zdvojn\u00e1sobili priepustnos\u0165 pri \u010d\u00edtan\u00ed a z\u00e1pise, ako aj zn\u00ed\u017eili latencie na polovicu. Pri testovan\u00ed na re\u00e1lnom hardv\u00e9ri sa n\u00e1klady na \u0161ifrovanie podarilo zn\u00ed\u017ei\u0165 takmer na \u00farove\u0148 pozorovan\u00fa pri pr\u00e1ci s diskom bez \u0161ifrovania d\u00e1t.<\/p>\n

Cloudflare pou\u017e\u00edva dm-crypt na \u0161ifrovanie d\u00e1t na \u00falo\u017en\u00fdch zariadeniach, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa na cacheovanie obsahu v sieti CDN. Dm-crypt funguje na \u00farovni blokov\u00e9ho zariadenia a vykon\u00e1va \u0161ifrovanie z\u00e1pisov\u00fdch vstupov a de\u0161ifrovanie \u010d\u00edtac\u00edch po\u017eiadaviek, pri\u010dom vystupuje ako vrstva medzi blokov\u00fdm zariaden\u00edm a ovl\u00e1da\u010dom s\u00faborov\u00e9ho syst\u00e9mu. <\/p>\n

\"Spolo\u010dnos\u0165<\/a><\/noindex><\/center><\/p>\n

Na hodnotenie v\u00fdkonu dm-crypt sa pomocou bal\u00edka Flexible I\/O tester<\/a><\/noindex> uskuto\u010dnilo meranie r\u00fdchlosti pr\u00e1ce so \u0161ifrovan\u00fdmi a ne\u0161ifrovan\u00fdmi oddielmi na RAM-disku umiestnenom v RAM, aby sa vyl\u00fa\u010dili v\u00fdkyvy v\u00fdkonu diskov a zameralo sa na v\u00fdkon k\u00f3du. Pre ne\u0161ifrovan\u00e9 oddiely sa v\u00fdkon \u010d\u00edtania a z\u00e1pisu udr\u017eiaval na \u00farovni 1126 MB\/s, ale po zapnut\u00ed \u0161ifrovania sa r\u00fdchlos\u0165 zn\u00ed\u017eila o 7-kr\u00e1t<\/b> a dosiahla 147 MB\/s. <\/p>\n

Na za\u010diatku sa objavilo podozrenie na pou\u017eitie neefekt\u00edvnych algoritmov v kryptosyst\u00e9me jadra. Av\u0161ak v testoch bol pou\u017eit\u00fd najr\u00fdchlej\u0161\u00ed algoritmus aes-xts s 256-bitov\u00fdm k\u013e\u00fa\u010dom \u0161ifrovania, ktor\u00e9ho v\u00fdkon pri vykonan\u00ed \u201ecryptsetup benchmark\u201c je viac ako dvakr\u00e1t vy\u0161\u0161\u00ed ako v\u00fdsledok z\u00edskan\u00fd pri testovan\u00ed RAM-disku. Experimenty s praporkami dm-crypt na ladenie v\u00fdkonu nepriniesli v\u00fdsledky: pri pou\u017eit\u00ed praporku \u201e\u2014perf-same_cpu_crypt\u201c sa v\u00fdkon dokonca zn\u00ed\u017eil na 136 MB\/s, a pri uveden\u00ed praporku \u201e\u2014perf-submit_from_crypt_cpus\u201c vzr\u00e1stol iba na 166 MB\/s.<\/p>\n

Hlb\u0161ie presk\u00famanie logiky fungovania uk\u00e1zalo, \u017ee dm-crypt nie je tak\u00fd jednoduch\u00fd, ako sa zd\u00e1 \u2014 ke\u010f pr\u00edde od ovl\u00e1da\u010da FS po\u017eiadavka na z\u00e1pis, dm-crypt ju nevybavuje okam\u017eite, ale umiest\u0148uje ju do frontu \u201ekcryptd\u201c, ktor\u00fd sa spracov\u00e1va nie okam\u017eite, ale pri uskuto\u010dnen\u00ed vhodn\u00e9ho momentu. Z frontu sa po\u017eiadavka odosiela do Linux Crypto API na vykonanie \u0161ifrovania. Ale preto\u017ee Crypto API pou\u017e\u00edva asynchr\u00f3nny model vykon\u00e1vania, \u0161ifrovanie sa taktie\u017e neuskuto\u010d\u0148uje okam\u017eite, ale prech\u00e1dza e\u0161te jednou frontou. Po dokon\u010den\u00ed \u0161ifrovania sa dm-crypt pok\u00fa\u0161a uskuto\u010dni\u0165 triedenie \u010dakaj\u00facich po\u017eiadaviek na z\u00e1pis pomocou vyh\u013ead\u00e1vacieho stromu. \u010derveno-\u010dierny<\/a><\/noindex>. Na konci sa op\u00e4\u0165 ur\u010dit\u00e9 vl\u00e1kno jadra so zrete\u013en\u00fdm oneskoren\u00edm chyt\u00ed nahromaden\u00e9 po\u017eiadavky vstupov\/v\u00fdstupov a odosiela ich do z\u00e1sobn\u00edka blokov\u00e9ho zariadenia.<\/p>\n

\"Spolo\u010dnos\u0165<\/a><\/noindex><\/center><\/p>\n

Pri \u010d\u00edtan\u00ed najprv dm-crypt prid\u00e1va do frontu \u201ekcryptd_io\u201c po\u017eiadavku na z\u00edskanie \u00fadajov z \u00falo\u017eiska. Po nejakom \u010dase sa \u00fadaje stan\u00fa dostupn\u00fdmi a umiestnia sa do frontu \u201ekcryptd\u201c na de\u0161ifrovanie.
\nKcryptd odosiela po\u017eiadavku do Linux Crypto API, ktor\u00e9 de\u0161ifruje inform\u00e1cie v asynchr\u00f3nnom re\u017eime. Po\u017eiadavky v\u017edy neprejd\u00fa cez v\u0161etky fronty, ale v najhor\u0161om pr\u00edpade m\u00f4\u017ee po\u017eiadavka na z\u00e1pis uviaznu\u0165 vo front\u00e1ch a\u017e 4-kr\u00e1t, zatia\u013e \u010do po\u017eiadavka na \u010d\u00edtanie a\u017e 3-kr\u00e1t. Ka\u017ed\u00e9 zaradenie do fronty vedie k vzniku oneskoren\u00ed, ktor\u00e9 s\u00fa k\u013e\u00fa\u010dovou pr\u00ed\u010dinou v\u00fdznamn\u00e9ho zn\u00ed\u017eenia v\u00fdkonu dm-crypt. <\/p>\n

Pou\u017eitie front je sp\u00f4soben\u00e9 potrebou pr\u00e1ce v podmienkach v\u00fdskytu preru\u0161enia. V roku 2005, ke\u010f bola implementovan\u00e1 s\u00fa\u010dasn\u00e1 modelov\u00e1 pr\u00e1ca dm-crypt na z\u00e1klade front, Crypto API e\u0161te nebol asynchr\u00f3nny. Po prechode Crypto API na asynchr\u00f3nny model vykon\u00e1vania sa v podstate zaviedla dvojit\u00e1 ochrana. Fronty sa tie\u017e zav\u00e1dzali na \u00fasporu spotreby z\u00e1sobn\u00edkov jadra, ale po jeho zv\u00fd\u0161en\u00ed v roku 2014 tieto optimaliz\u00e1cie stratili relevanciu. Dodato\u010dn\u00fd front «kcryptd_io» bol zaveden\u00fd na preklenutie \u00fazkeho miesta, ktor\u00e9 sp\u00f4sobovalo \u010dakanie na pridelenie pam\u00e4te pri prich\u00e1dzaj\u00facom ve\u013ekom mno\u017estve po\u017eiadaviek. V roku 2015 bola navy\u0161e zaveden\u00e1 f\u00e1za triedenia, preto\u017ee po\u017eiadavky na \u0161ifrovanie na viacprocesorov\u00fdch syst\u00e9moch mohli kon\u010di\u0165 bez dodr\u017eania poradia odoslania (namiesto sekven\u010dn\u00e9ho pr\u00edstupu na disk sa realizoval pr\u00edstup n\u00e1hodne, a pl\u00e1nova\u010d CFQ nepracoval efekt\u00edvne). V s\u00fa\u010dasnosti, pri pou\u017eit\u00ed SSD diskov, triedenie stratilo zmysel a pl\u00e1nova\u010d CFQ sa u\u017e v jadre nepou\u017e\u00edva.<\/p>\n

Vzh\u013eadom na to, \u017ee modern\u00e9 \u00falo\u017eisk\u00e1 sa stali r\u00fdchlej\u0161\u00edmi a inteligentnej\u0161\u00edmi, syst\u00e9m rozde\u013eovania zdrojov v jadre Linux bol prehodnoten\u00fd a niektor\u00e9 subsyst\u00e9my boli preroben\u00e9, in\u017einieri Cloudflare bol pridan\u00fd<\/a><\/noindex> v dm-crypt nov\u00fd re\u017eim pr\u00e1ce, zbaven\u00fd pou\u017eitia nadbyto\u010dn\u00fdch front a asynchr\u00f3nnych volan\u00ed. Re\u017eim sa aktivuje samostatnou praporkou «force_inline» a vedie dm-crypt k forme jednoduch\u00e9ho proxy, ktor\u00e9 \u0161ifruje a de\u0161ifruje prich\u00e1dzaj\u00face po\u017eiadavky. Interakcia s Crypto API bola optimalizovan\u00e1 explicitn\u00fdm v\u00fdberom \u0161ifrovac\u00edch algoritmov, ktor\u00e9 pracuj\u00fa v synchronnom re\u017eime a nevyu\u017e\u00edvaj\u00fa fronty po\u017eiadaviek. Pre synchronn\u00fa pr\u00e1cu s Crypto API bolo je navrhnut\u00fd<\/a><\/noindex> modul, ktor\u00fd umo\u017e\u0148uje pou\u017e\u00edva\u0165 FPU\/AES-NI na zr\u00fdchlenie a priamo pren\u00e1\u0161a po\u017eiadavky na \u0161ifrovanie a de\u0161ifrovanie.<\/p>\n

Nakoniec sa pri testovan\u00ed RAM disku podarilo viac ako dvakr\u00e1t zv\u00fd\u0161i\u0165 v\u00fdkon dm-crypt \u2014 v\u00fdkon vzr\u00e1stol z 294 MB\/s (2 x 147 MB\/s) na 640 MB\/s, \u010do je ve\u013emi bl\u00edzko k v\u00fdkonu hol\u00e9ho \u0161ifrovania (696 MB\/s).
\n

\"Spolo\u010dnos\u0165<\/a><\/noindex><\/center>
\n
\"Spolo\u010dnos\u0165<\/a><\/noindex><\/center>
\n
\"Spolo\u010dnos\u0165<\/a><\/noindex><\/center><\/p>\n

Pri testovan\u00ed z\u00e1\u0165a\u017ee na re\u00e1lnych serveroch nov\u00e1 implement\u00e1cia uk\u00e1zala v\u00fdkon ve\u013emi bl\u00edzky konfigur\u00e1cii, ktor\u00e1 funguje bez \u0161ifrovania, a zapnutie \u0161ifrovania na serveroch s cachingom Cloudflare nijako neovplyvnilo r\u00fdchlos\u0165 odozvy. V bud\u00facnosti pl\u00e1nuje Cloudflare poskytn\u00fa\u0165 pripraven\u00e9 opravy do hlavn\u00e9ho jadra Linuxu, ale predt\u00fdm ich bude potrebn\u00e9 prepracova\u0165, preto\u017ee s\u00fa optimalizovan\u00e9 pre konkr\u00e9tnu z\u00e1\u0165a\u017e a nepokr\u00fdvaj\u00fa v\u0161etky oblasti pou\u017eitia, napr\u00edklad \u0161ifrovanie na slab\u0161\u00edch vstavan\u00fdch zariadeniach.<\/p>\n

\"Spolo\u010dnos\u0165<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Cloudflare \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0434\u0438\u0441\u043a\u043e\u0432\u043e\u0433\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u044f\u0434\u0440\u0435 Linux. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0431\u044b\u043b\u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b dm-crypt \u0438 Crypto API, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0438\u0435 \u0432 \u0441\u0438\u043d\u0442\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0442\u0435\u0441\u0442\u0435 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0432 \u0434\u0432\u0430 \u0440\u0430\u0437\u0430 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u043d\u0443\u044e \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0447\u0442\u0435\u043d\u0438\u0438 \u0438 \u0437\u0430\u043f\u0438\u0441\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0434\u0432\u0430 \u0440\u0430\u0437\u0430 \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0438. \u041f\u0440\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043d\u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":75940,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-75939","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Firma Cloudflare pripravila opravy, ktor\u00e9 radik\u00e1lne zr\u00fdch\u013euj\u00fa diskov\u00e9 \u0161ifrovanie v Linuxe | ProHoster","description":"V\u00fdvoj\u00e1ri z firmy Cloudflare informovali o realiz\u00e1cii pr\u00e1ce na optimaliz\u00e1cii v\u00fdkonu.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/kompaniya-cloudflare-podgotovila-patchi-kardinalno-uskoryayushhie-diskovoe-shifrovanie-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0430 \u043f\u0430\u0442\u0447\u0438, \u043a\u0430\u0440\u0434\u0438\u043d\u0430\u043b\u044c\u043d\u043e \u0443\u0441\u043a\u043e\u0440\u044f\u044e\u0449\u0438\u0435 \u0434\u0438\u0441\u043a\u043e\u0432\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Cloudflare \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/kompaniya-cloudflare-podgotovila-patchi-kardinalno-uskoryayushhie-diskovoe-shifrovanie-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-29T17:42:19+00:00","article:modified_time":"2020-03-29T17:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"75939","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:46:22","updated":"2022-10-01 10:55:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/75939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=75939"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/75939\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/75940"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=75939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=75939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=75939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}