Differences

This shows you the differences between two versions of the page.

--- summerofcode2014:convertingipfwrulesets [2014/05/27 20:19] – DanielPeyrolon
+++ summerofcode2014:convertingipfwrulesets [2014/09/25 08:45] (current) – DanielPeyrolon
@@ Line 12: / Line 12: @@
 ===== Approach to solve the problem =====
-*Understand bpdjit.
+*Understand bpdjit. ✔
-*Understand netmap-ipfw.
+*Understand netmap-ipfw. ✔
-*Isolate and refactor the netmap-ipfw rules so that each rule is mapped ideally with a single function
+*Isolate and refactor the netmap-ipfw rules so that each rule is mapped ideally with a single function. ✔
-*Add JIT-compiling of these functions inside netmap-ipfw.
+*Add JIT-compiling of these functions inside netmap-ipfw. ✔
-*Test and evaluate the final system.
+*Test and evaluate the final system. ✔
 ===== Deliverables =====
@@ Line 26: / Line 26: @@
 *May 19th: Coding starts.
-*I will start building a firewall, or adapting netmap-ipfw and start writing the routines that will be used when JIT-compiling the rules.
+*Once the example (bpfjit), has been studied and understood, I will start adapting netmap-ipfw and refactored the routines for each separated rule.
 *Jun 23th: Mid-term evaluations.
-*By this point, we should  have a working firewall without  JIT-compiling, but a good set of routines to be used when JIT-compiling. The objective now would be to add JIT-compiling to the firewall, so it can parse some rules and change the behavior of the firewall. This process should be as simple as possible.
+*By this point, we should  have a working firewall with a simple JIT compiling system, and a good set of routines to be used. Now we will optimize the implementation as much as possible.
 *Aug 11th: Suggested "pencils down".
-*By this point the firewall should be finished, and we would be able to JIT-compile the rules. It would be the time to test it, and quantify the gain of performance compared to the traditional ipfw/kernel net stack implementations.
+*By this point the firewall should be finished. It would be the time to test it, and quantify the gain of performance compared to the traditional ipfw/kernel net stack implementations.
 *Aug 18th: Firm "pencils down" date.
@@ Line 39: / Line 39: @@
 ===== The Code =====
-My code can be found [[https://svnweb.freebsd.org/socsvn/soc2014/dpl/|here]].
+My code can be found [[https://svnweb.freebsd.org/socsvn/soc2014/dpl/|here (svn)]], and [[https://github.com/dplbsd/netmap-ipfwjit|here (github)]]
+===== Results =====
+For now, I encountered a bug on netmap that prevented the filtration of any more than 1000 packets.
+I benchmarked that in the worst case scenario (just one rule), and I got a 7x faster firewall.
+The firewall is not completed yet (there are some rules to implement yet, but that is easy).
+Before finishing it, I'll port it to the C LLVM API.
 ===== Useful links =====
-*[[http://llvm.org/docs/LangRef.html|LLVM reference]]
+*[[http://llvm.org/docs/LangRef.html|LLVM IR reference]]
+*[[http://llvm.org/docs/doxygen/html/|LLVM API reference]]
+*[[http://llvm.org/docs/ProgrammersManual.html|LLVM Programer's manual]]
 *[[http://www.cl.cam.ac.uk/research/security/capsicum/|Capsicum official webpage]]
 *[[http://www.cl.cam.ac.uk/teaching/1314/L25/|Modern Compiler Design]]
 *[[http://people.freebsd.org/~theraven/bpfjit/|bpfjit]]
-*[[https://code.google.com/p/netmap-ipfw/]]
+*[[https://code.google.com/p/netmap-ipfw/|netmap-ipfw]]
 *[[http://info.iet.unipi.it/~luigi/netmap/|netmap]]