Building a Lightning Fast Firewall with Java & eBPF
summary
Claims a Java-driven XDP firewall that drops packets in-kernel with eBPF, using hello-ebpf and Project Panama to compile Java-ish code into C then into BPF bytecode, loaded as root and JIT-compiled by the kernel verifier. Demo ties a Spring endpoint to an eBPF map for rules, blocks google.com, and shows a packet-handler that drops every third packet; authors cite IPtables ~1.6M req/s and push eBPF as a 10x improvement via XDP offload and zero-copy packet paths.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:43Application layer filtering
- 4:24Kernel-level networking
- 6:21Constraints of traditional tools
- 10:17The power of eBPF
- 16:11Data sharing with eBPF maps
- 19:22Tracing and security use cases
- 24:53The eBPF ecosystem and Java
- 28:55Live coding demos
- 39:38Implementing a Java firewall
- 45:30Future outlook and conclusion
related talks
40mhello-ebpf: Writing eBPF Programs Directly in Java
32meBPF: BPF kernel infrastructure
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
37mEfficient and Flexible Virtual Machine Networking Through eBPF
48mInto the hive of eBPF!
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
14mWill eBPF Save Us From the Next Global Outage?
33mThe Future of eBPF in Cloud Native