This is an old revision of the document!
Userspace netmap-powered JIT-compiled firewall
- Student: Daniel Peyrolón (dpl@freebsd.org)
- Mentor: David Chisnall (theraven@freebsd.org)
Project description
The objective of this project is to develop a netmap-powered firewall with JIT-compiling and Capsicum support. Doing this we will be able to change the firewalling rules while running and provide the userspace with a very efficient and secure firewall.
Also, a very important part of this project is the benchmarking itself.
Approach to solve the problem
*Understand bpdjit. *Understand netmap-ipfw. *Isolate and refactor the netmap-ipfw rules so that each rule is mapped ideally with a single function *Add JIT-compiling of these functions inside netmap-ipfw. *Test and evaluate the final system.
Deliverables
The final deliverable will be the final version of a JIT-compiled firewall that uses IPFW, used with netmap. This would allow to have a variable set of rules that change dynamically the behavior of the firewall.
Milestones
Aug 18th: Firm “pencils down” date.
- June 17: Start of coding
- We will start building the firewall, adapting netmap-ipfw and starting writing the routines that will be used when JIT-compiling the rules.
- July 29-August 2: Mid-term Evaluations
- By this point, we should have a working firewall without JIT-compiling, but a good set of routines to be used when JIT-compiling. The objective now would be to add JIT-compiling to the firewall, so it can parse some rules and change the behavior of the firewall. This process should be as simple as possible.
- September 16: End of coding (soft)
- By this point the firewall should be finished, and we would be able to JIT-compile the rules. It would be the time to test it, and quantify the gain of performance compared to the traditional ipfw/kernel net stack implementations.
- September 23: End of coding (hard)
Test Plan
The test plan for this project is to test individual rules and its working inside the JIT-compiler separately, and when finished, do some tests with real sets of rules.
The Code
My code can be found here.