This is an old revision of the document!
Userspace netmap-powered JIT-compiled firewall
- Student: Daniel Peyrolón (dpl@freebsd.org)
- Mentor: David Chisnall (theraven@freebsd.org)
Project description
The objective of this project is to develop a netmap-powered firewall with JIT-compiling and Capsicum support. Doing this we will be able to change the firewalling rules while running and provide the userspace with a very efficient and secure firewall.
Also, a very important part of this project is the benchmarking itself.
Approach to solving the problem
The first thing to do is to understand how do both netmap-ipwf and bpdjit work. Once that's done, I will be able to start isolating the different rules of IPFW, and rewrite that as single and simple functions. Once that functions are written, I will add JIT support to that.
Deliverables
The final deliverable will be the final version of a JIT-compiled firewall that uses IPFW, used with netmap. This would allow to have a variable set of rules that change dynamically the behavior of the firewall.
Milestones
Aug 18th: Firm “pencils down” date.
- June 17: Start of coding
- We will start building the firewall, adapting netmap-ipfw and starting writing the routines that will be used when JIT-compiling the rules.
- July 29-August 2: Mid-term Evaluations
- By this point, we should have a working firewall without JIT-compiling, but a good set of routines to be used when JIT-compiling. The objective now would be to add JIT-compiling to the firewall, so it can parse some rules and change the behavior of the firewall. This process should be as simple as possible.
- September 16: End of coding (soft)
- By this point the firewall should be finished, and we would be able to JIT-compile the rules. It would be the time to test it, and quantify the gain of performance compared to the traditional ipfw/kernel net stack implementations.
- September 23: End of coding (hard)
Test Plan
The test plan for this project is to test individual rules and its working inside the JIT-compiler sepparatedly, and when finished, some real world testing, as well as stress tests to compare this system with other modern firewalls.
The Code
My code can be found here.