Bilingual

Reimplementing pf as an eBPF/XDP dataplane on Linux
10 days ago
- PFL is an experimental project aiming to translate pf's firewall language and stateful semantics to Linux's XDP (eXpress Data Path) for efficient packet processing.
- Built on FreeBSD's pfSense legacy, PFL uses Rust for the control plane (pfld) and eBPF dataplane, leveraging XDP's driver-level execution for high packet rates.
- Key architectural features include a tail-call graph pipeline to comply with eBPF verifier constraints, LRU hash maps for connection state, and per-CPU counters.
- PFL achieves significant pf feature parity including filtering, NAT (v4/v6), NAT64, normalization, policy routing, and DoS resistance with SYN cookies.
- Limitations include no full fragment reassembly (due to XDP model) and preliminary performance results (better median latency but higher tail latency and CPU use vs nftables in VM tests).
- Future work includes bare-metal evaluation on Arm appliances, egress fast-path optimization, high availability via pflsync, and protocol depth improvements.
- PFL distinguishes itself by maintaining fidelity to pf language while operating in-kernel with XDP, leaving the host interface usable, unlike userspace alternatives like VPP.
We Put an L7 Firewall in the Kernel
11 days ago
- The firewall uses eBPF in the kernel to make HTTP/2 header decisions in nanoseconds, avoiding userspace proxy delays.
- Policy is written as JavaScript apps, allowing updates via git push without rebuilds, redeploys, or restarts.
- Matches on HTTP/2 headers like :authority, User-Agent, and source address using boolean logic rules.
- Uses XDP hook for early packet filtering, dropping packets before kernel socket allocation for minimal cost.
- Compiles banned User-Agent substrings into a single Aho-Corasick automaton for linear-time scanning, scalable to thousands of patterns.
- Handles HPACK compression by tracking the dynamic table live, ensuring header visibility across requests.
- Exposes real-time metrics via Prometheus and Grafana, including evasion attempts like fragmented headers.
- Deploys as a Docker container, currently tested in production with enterprise traffic.
Linux kernel will support $ORIGIN, sort of
11 hours ago
- The goal is to support relocatable binaries in Nix by allowing $ORIGIN in PT_INTERP and shebang.
- Christian Brauner suggested using eBPF for programmable interpreter selection via binfmt_misc, rather than a kernel patch.
- An eBPF program can match ELF files and dynamically determine the interpreter path, supporting $ORIGIN.
- A new binfmt_misc flag 'L' enables loader substitution, making the interpreter override transparent and preserving process identity.
- Future plans include a NixOS module that registers the BPF handler at boot, gated on a new PT_INTERP_NIX segment for opt-in.

Hasty Briefsbeta

#ebpf

Reimplementing pf as an eBPF/XDP dataplane on Linux

We Put an L7 Firewall in the Kernel

Linux kernel will support $ORIGIN, sort of