summerofcode2014:convertingipfwrulesets

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
summerofcode2014:convertingipfwrulesets [2014/05/27 20:09] – DanielPeyrolonsummerofcode2014:convertingipfwrulesets [2014/09/25 08:45] (current) – DanielPeyrolon
Line 12: Line 12:
 ===== Approach to solve the problem ===== ===== Approach to solve the problem =====
  
-*Understand bpdjit. +*Understand bpdjit. ✔ 
-*Understand netmap-ipfw. +*Understand netmap-ipfw. ✔ 
-*Isolate and refactor the netmap-ipfw rules so that each rule is mapped ideally with a single function +*Isolate and refactor the netmap-ipfw rules so that each rule is mapped ideally with a single function. ✔ 
-*Add JIT-compiling of these functions inside netmap-ipfw. +*Add JIT-compiling of these functions inside netmap-ipfw. ✔ 
-*Test and evaluate the final system.+*Test and evaluate the final system. ✔
  
 ===== Deliverables ===== ===== Deliverables =====
Line 25: Line 25:
 ===== Milestones ===== ===== Milestones =====
  
-Aug 18th: Firm "pencils down" date. +*May 19th: Coding starts. 
-  * June 17: Start of coding  +*Once the example (bpfjit), has been studied and understood, I will start adapting netmap-ipfw and refactored the routines for each separated rule. 
-    * We will start building the firewall, adapting netmap-ipfw and starting writing the routines that will be used when JIT-compiling the rules. +*Jun 23th: Mid-term evaluations. 
-  * July 29-August 2: Mid-term Evaluations  +*By this point, we should  have a working firewall with a simple JIT compiling system, and a good set of routines to be used. Now we will optimize the implementation as much as possible. 
-    * By this point, we should  have a working firewall without  JIT-compiling, but a good set of routines to be used when JIT-compiling. The objective now would be to add JIT-compiling to the firewall, so it can parse some rules and change the behavior of the firewall. This process should be as simple as possible. +*Aug 11th: Suggested "pencils down". 
-  * September 16: End of coding (soft) +*By this point the firewall should be finished. It would be the time to test it, and quantify the gain of performance compared to the traditional ipfw/kernel net stack implementations. 
-    * By this point the firewall should be finished, and we would be able to JIT-compile the rules. It would be the time to test it, and quantify the gain of performance compared to the traditional ipfw/kernel net stack implementations. +*Aug 18th: Firm "pencils down" date.
-  * September 23: End of coding (hard) +
  
 ===== Test Plan ===== ===== Test Plan =====
  
-The test plan for this project is to test individual rules and its working inside the JIT-compiler separatedly, and when finished, some real world testing, as well as stress tests to compare this system with other modern firewalls.+The test plan for this project is to test individual rules and its working inside the JIT-compiler separately, and when finished, do some tests with real sets of rules.
  
 ===== The Code ===== ===== The Code =====
  
-My code can be found [[https://svnweb.freebsd.org/socsvn/soc2014/dpl/|here]].+My code can be found [[https://svnweb.freebsd.org/socsvn/soc2014/dpl/|here (svn)]], and [[https://github.com/dplbsd/netmap-ipfwjit|here (github)]] 
 + 
 +===== Results ===== 
 + 
 +For now, I encountered a bug on netmap that prevented the filtration of any more than 1000 packets. 
 +I benchmarked that in the worst case scenario (just one rule), and I got a 7x faster firewall. 
 + 
 +The firewall is not completed yet (there are some rules to implement yet, but that is easy). 
 +Before finishing it, I'll port it to the C LLVM API.
  
 ===== Useful links ===== ===== Useful links =====
  
-*[[http://llvm.org/docs/LangRef.html|LLVM reference]]+*[[http://llvm.org/docs/LangRef.html|LLVM IR reference]] 
 +*[[http://llvm.org/docs/doxygen/html/|LLVM API reference]] 
 +*[[http://llvm.org/docs/ProgrammersManual.html|LLVM Programer's manual]] 
 *[[http://www.cl.cam.ac.uk/research/security/capsicum/|Capsicum official webpage]] *[[http://www.cl.cam.ac.uk/research/security/capsicum/|Capsicum official webpage]]
 *[[http://www.cl.cam.ac.uk/teaching/1314/L25/|Modern Compiler Design]] *[[http://www.cl.cam.ac.uk/teaching/1314/L25/|Modern Compiler Design]]
 +
 *[[http://people.freebsd.org/~theraven/bpfjit/|bpfjit]] *[[http://people.freebsd.org/~theraven/bpfjit/|bpfjit]]
-*[[https://code.google.com/p/netmap-ipfw/]]+*[[https://code.google.com/p/netmap-ipfw/|netmap-ipfw]]
 *[[http://info.iet.unipi.it/~luigi/netmap/|netmap]] *[[http://info.iet.unipi.it/~luigi/netmap/|netmap]]
  
  • summerofcode2014/convertingipfwrulesets.1401221393.txt.gz
  • Last modified: 2014/05/27 20:09
  • by DanielPeyrolon