This talk will start with a deep dive and hands on examples of BPF, possibly the most promising low level technology to address challenges in application and network security, tracing, and visibility. We will discuss how BPF evolved from a simple bytecode language to filter raw sockets for tcpdump to the a JITable virtual machine capable of universally extending and instrumenting both the Linux kernel and user space applications. The introduction is followed by a concrete example of how the Cilium open source project applies BPF to solve networking, security, and load balancing for highly distributed applications. We will discuss and demonstrate how Cilium with the help of BPF can be combined with distributed system orchestration such as Docker to simplify security, operations, and troubleshooting of distributed applications.
16. Network Security
has not evolved
$ iptables -A INPUT -p tcp
-s 15.15.15.3 --dport 80
-m conntrack --ctstate NEW
-j ACCEPT
The world still runs on iptables
matching IPs and ports:
21. GET /healthz
GET /jobs/{id}
PUT /jobs/{id}
POST /jobs
API
GET /jobs/331
Gordon Job Postings
Example: Security for Microservices
22. L3/L4
GET /healthz
GET /jobs/{id}
PUT /jobs/{id}
POST /jobs
API
iptables -s 10.1.1.1
-p tcp --dport 80
-j ACCEPT
GET /jobs/331
Gordon Job Postings
Example: Security for Microservices
23. L3/L4
GET /healthz
GET /jobs/{id}
PUT /jobs/{id}
POST /jobs
API
exposed
exposed
exposed
GET /jobs/331
Gordon Job Postings
Example: Security for Microservices
iptables -s 10.1.1.1
-p tcp --dport 80
-j ACCEPT
25. GET /healthz
GET /jobs/{id}
PUT /jobs/{id}
POST /jobs
API
GET /jobs/331
Gordon Job Postings
Example: Security for Microservices
26. L3/L4
GET /healthz
GET /jobs/{id}
PUT /jobs/{id}
POST /jobs
API
FROM Gordon
ALLOW GET /jobs/.*
GET /jobs/331
Gordon Job Postings
Example: Security for Microservices
52. BPF: Leverage user space tool chain
USER SPACE
KERNEL
connect()
VERIFIER +
JIT
SOURCE CODE [C]
</>
BYTE CODE [BPF]
</>
53. BPF: Attach program to connect() syscall (LSM)
USER SPACE
KERNEL
connect()
VERIFIER +
JIT
SOURCE CODE [C]
</>
BYTE CODE [BPF]
</>
BPF
LSM Hook
54. BPF: Return EACCESS – No packets created at all
USER SPACE
KERNEL
connect()
EACCESS
VERIFIER +
JIT
SOURCE CODE [C]
</>
BYTE CODE [BPF]
</>
BPF
LSM Hook