Download as PDF, PPTX
![What is BPF? SOURCE CODE [C] </> USER SPACE](https://image.slidesharecdn.com/ciliumcncfv0-170330100102/75/Linux-Native-HTTP-Aware-Network-Security-18-2048.jpg)
![What is BPF? SOURCE CODE [C] </> BYTE CODE [BPF] USER SPACE </>](https://image.slidesharecdn.com/ciliumcncfv0-170330100102/75/Linux-Native-HTTP-Aware-Network-Security-19-2048.jpg)
![What is BPF? SOURCE CODE [C] </> BYTE CODE [BPF] VERIFIER + JIT USER SPACE KERNEL </>](https://image.slidesharecdn.com/ciliumcncfv0-170330100102/75/Linux-Native-HTTP-Aware-Network-Security-20-2048.jpg)
![What is BPF? SOURCE CODE [C] </> BYTE CODE [BPF] VERIFIER + JIT USER SPACE KERNEL </> SANDBOX BPF](https://image.slidesharecdn.com/ciliumcncfv0-170330100102/75/Linux-Native-HTTP-Aware-Network-Security-21-2048.jpg)
![What is BPF? SOURCE CODE [C] </> BYTE CODE [BPF] VERIFIER + JIT USER SPACE KERNEL </> SANDBOX BPF Process Process](https://image.slidesharecdn.com/ciliumcncfv0-170330100102/75/Linux-Native-HTTP-Aware-Network-Security-22-2048.jpg)
![What is BPF? SOURCE CODE [C] </> BYTE CODE [BPF] VERIFIER + JIT USER SPACE KERNEL </> SANDBOX BPF Process SANDBOX BPF write() Process](https://image.slidesharecdn.com/ciliumcncfv0-170330100102/75/Linux-Native-HTTP-Aware-Network-Security-23-2048.jpg)
![What is BPF? SOURCE CODE [C] </> BYTE CODE [BPF] VERIFIER + JIT USER SPACE KERNEL </> SANDBOX BPF Process SANDBOX BPF write() Process EACCESS](https://image.slidesharecdn.com/ciliumcncfv0-170330100102/75/Linux-Native-HTTP-Aware-Network-Security-24-2048.jpg)
![75 140 205 240 325 365 370 365 410 412 425 445 450 460 460 490 495 505 515 525 545 565 0 100 200 300 400 500 600 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 BPF redirect() performance [GBit per core] Intel Xeon 3.5Ghz Sandy Bridge, 24 Cores, 1 TCP GSO flow per core, netperf -t TCP_SENDFILE, 10K Cilium policies](https://image.slidesharecdn.com/ciliumcncfv0-170330100102/75/Linux-Native-HTTP-Aware-Network-Security-32-2048.jpg)
Uploaded byThomas Graf
Linux Native, HTTP Aware Network Security
Thomas Graf, CTO and co-founder of Covalent, discusses the challenges of network security in a microservices architecture, highlighting the limitations of traditional methods like iptables. He emphasizes the need for modern approaches using BPF (Berkeley Packet Filter) to enhance security and optimize performance in dynamic environments. The document also briefly touches on Cilium, a project that utilizes BPF for improved container networking and security policies.
Linux Native, HTTP Aware Network Security
- 1. Title. Thomas Graf CTO &Co-Founder @ Covalent Linux-Native, HTTP-Aware Network Security
- 2. Application Architectures Delivery Frequency Operational Complexity Single Server App Yearly Low Distributed MicroservicesApp 10-100 x’s / day Extreme 3-Tier App Monthly Moderate CODE CONSISTENCY AT VELOCITY
- 3. Network Security has notevolved $ iptables -A INPUT -p tcp -s 15.15.15.3 --dport 80 -m conntrack --ctstate NEW -j ACCEPT The world still runs on iptables matching IPs and ports:
- 4. Your HTTP portsbe like …
- 5.
- 6. L3/L4 Network Security for microservices Pod “Frontend” Pod “Store” API GET/store/myItem HTTP/1.1
- 7. L3/L4 Network Security for microservices Pod “Frontend” Pod “Store” API GET/store/myItem HTTP/1.1 FROM frontend ALLOW tcp:80
- 8. L3/L4 Network Security for microservices Pod “Frontend” Pod “Store” GET/store/{id} API GET /store/myItem HTTP/1.1 FROM frontend ALLOW tcp:80
- 9. L3/L4 Network Security for microservices Pod “Frontend” Pod “Store” GET/healthz GET /store/{id} PUT /store/{id} PUT /config API GET /store/myItem HTTP/1.1 FROM frontend ALLOW tcp:80
- 10. L3/L4 Network Security for microservices Pod “Frontend” Pod “Store” GET/healthz GET /store/{id} PUT /store/{id} PUT /config API attacksurface GET /store/myItem HTTP/1.1 FROM frontend ALLOW tcp:80
- 11. L3/L4 Network Security for microservices Pod “Frontend” Pod “Store” GET/healthz GET /store/{id} PUT /store/{id} PUT /config API exposed exposed exposed FROM frontend ALLOW tcp:80 GET /store/myItem HTTP/1.1 OK
- 12. L4 security has becomemeaningless in the age of microservices
- 13. L3/L4 Network Security for microservices Pod “Frontend” Pod “Store” GET/healthz GET /store/{id} PUT /store/{id} PUT /config API GET /store/myItem HTTP/1.1
- 14. L3/L4 Network Security for microservices Pod “Frontend” Pod “Store” GET/healthz GET /store/{id} PUT /store/{id} PUT /config API FROM frontend ALLOW GET /store/.* GET /store/myItem HTTP/1.1
- 15.
- 16.
- 17. What is BPF? .insns= { BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0), BPF_LD_MAP_FD(BPF_REG_1, 0), BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem), BPF_MOV64_REG(BPF_REG_1, BPF_REG_10), BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152), BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0), BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0), BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42), BPF_EXIT_INSN(), }
- 18. What is BPF? SOURCECODE [C] </> USER SPACE
- 19. What is BPF? SOURCECODE [C] </> BYTE CODE [BPF] USER SPACE </>
- 20. What is BPF? SOURCECODE [C] </> BYTE CODE [BPF] VERIFIER + JIT USER SPACE KERNEL </>
- 21. What is BPF? SOURCECODE [C] </> BYTE CODE [BPF] VERIFIER + JIT USER SPACE KERNEL </> SANDBOX BPF
- 22. What is BPF? SOURCECODE [C] </> BYTE CODE [BPF] VERIFIER + JIT USER SPACE KERNEL </> SANDBOX BPF Process Process
- 23. What is BPF? SOURCECODE [C] </> BYTE CODE [BPF] VERIFIER + JIT USER SPACE KERNEL </> SANDBOX BPF Process SANDBOX BPF write() Process
- 24. What is BPF? SOURCECODE [C] </> BYTE CODE [BPF] VERIFIER + JIT USER SPACE KERNEL </> SANDBOX BPF Process SANDBOX BPF write() Process EACCESS
- 25. How does BPFrelate to HTTP? Process GET /foo
- 26. SANDBOX BPF Process GET /foo Howdoes BPF relate to HTTP?
- 27. SANDBOX BPF Process Proxy rules GET /foo redirect Howdoes BPF relate to HTTP?
- 28. SANDBOX BPF Process Proxy rules GET /foo redirect reinject Howdoes BPF relate to HTTP?
- 29. SANDBOX BPF Process Proxy rules GET /foo redirect 403 Access Denied Howdoes BPF relate to HTTP?
- 30.
- 31. • Generate networkingcode at Container Startup + Tailored to each container + Include Minimal Code Required Faster Smaller Attack Surface • Constant Config (IP, MAC, Ports, …), Compiler Optimization • Regeneration at Runtime Without Breaking Connections BPF CODE GENERATION AT CONTAINER STARTUP
- 32. 75 140 205 240 325 365 370 365 410412 425 445 450 460 460 490 495 505 515 525 545 565 0 100 200 300 400 500 600 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 BPF redirect() performance [GBit per core] Intel Xeon 3.5Ghz Sandy Bridge, 24 Cores, 1 TCP GSO flow per core, netperf -t TCP_SENDFILE, 10K Cilium policies
- 33. Thank You Learn More: cilium.io Code: github.com/cilium/cilium Followus: @ciliumproject KubeCon booth: S19