This is an old revision of the document!
WIP
Userspace netmap-powered JIT-compiled firewall
- Student: Daniel Peyrolón (dpl@freebsd.org)
- Mentor: David Chisnall (theraven@freebsd.org)
Project description
The objective of this project is to develop a netmap-powered firewall with JIT-compiling and Capsicum support. Doing this we will be able to change the firewalling rules while running and provide the userspace with a very efficient and secure firewall.
Also, a very important part of this project is the benchmarking itself.
Approach to solving the problem
(Details as to how you intend to approach the problem, if applicable. May include ideas as to how to break the problem down into smaller parts, or notes on research you need to do before settling on your final approach to solving the problem)
Deliverables
(List of features you plan to implement)
Milestones
Aug 18th: Firm “pencils down” date.
- June 17: Start of coding
- We will start building the firewall, adapting netmap-ipfw and starting writing the routines that will be used when JIT-compiling the rules.
- July 29-August 2: Mid-term Evaluations
- By this point, we should have a working firewall without JIT-compiling, but a good set of routines to be used when JIT-compiling. The objective now would be to add JIT-compiling to the firewall, so it can parse some rules and change the behavior of the firewall. This process should be as simple as possible.
- September 16: End of coding (soft)
- By this point the firewall should be finished, and we would be able to JIT-compile the rules. It would be the time to test it, and quantify the gain of performance compared to the traditional ipfw/kernel net stack implementations.
- September 23: End of coding (hard)
Test Plan
(List of steps you plan to use to test your work, as discussed with your mentor)