ConvertingIPFWRulesets [FreeBSD WIKI]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Userspace netmap-powered JIT-compiled firewall ======
  * Student: [[/DanielPeyrolon|Daniel Peyrolón]] (dpl@freebsd.org)
  * Mentor: [[/DavidChisnall|David Chisnall]] (theraven@freebsd.org)

===== Project description =====

The objective of this project is to develop a netmap-powered firewall with JIT-compiling and Capsicum support.
Doing this we will be able to change the firewalling rules while running and provide the userspace with a very efficient and secure firewall.

Also, a very important part of this project is the benchmarking itself.

===== Approach to solve the problem =====

*Understand bpdjit. ✔
*Understand netmap-ipfw. ✔
*Isolate and refactor the netmap-ipfw rules so that each rule is mapped ideally with a single function. ✔
*Add JIT-compiling of these functions inside netmap-ipfw. ✔
*Test and evaluate the final system. ✔

===== Deliverables =====

The final deliverable will be the final version of a JIT-compiled firewall that uses IPFW, used with netmap.
This would allow to have a variable set of rules that change dynamically the behavior of the firewall.

===== Milestones =====

*May 19th: Coding starts.
*Once the example (bpfjit), has been studied and understood, I will start adapting netmap-ipfw and refactored the routines for each separated rule.
*Jun 23th: Mid-term evaluations.
*By this point, we should  have a working firewall with a simple JIT compiling system, and a good set of routines to be used. Now we will optimize the implementation as much as possible.
*Aug 11th: Suggested "pencils down".
*By this point the firewall should be finished. It would be the time to test it, and quantify the gain of performance compared to the traditional ipfw/kernel net stack implementations.
*Aug 18th: Firm "pencils down" date.

===== Test Plan =====

The test plan for this project is to test individual rules and its working inside the JIT-compiler separately, and when finished, do some tests with real sets of rules.

===== The Code =====

My code can be found [[https://svnweb.freebsd.org/socsvn/soc2014/dpl/|here (svn)]], and [[https://github.com/dplbsd/netmap-ipfwjit|here (github)]]

===== Results =====

For now, I encountered a bug on netmap that prevented the filtration of any more than 1000 packets.
I benchmarked that in the worst case scenario (just one rule), and I got a 7x faster firewall.

The firewall is not completed yet (there are some rules to implement yet, but that is easy).
Before finishing it, I'll port it to the C LLVM API.

===== Useful links =====

*[[http://llvm.org/docs/LangRef.html|LLVM IR reference]]
*[[http://llvm.org/docs/doxygen/html/|LLVM API reference]]
*[[http://llvm.org/docs/ProgrammersManual.html|LLVM Programer's manual]]

*[[http://www.cl.cam.ac.uk/research/security/capsicum/|Capsicum official webpage]]
*[[http://www.cl.cam.ac.uk/teaching/1314/L25/|Modern Compiler Design]]

*[[http://people.freebsd.org/~theraven/bpfjit/|bpfjit]]
*[[https://code.google.com/p/netmap-ipfw/|netmap-ipfw]]
*[[http://info.iet.unipi.it/~luigi/netmap/|netmap]]