The Linux network stack extension for DDoS mitigation and web security

on YouTube ↗42m

" summary

An open source, in-kernel HTTP accelerator-plus-firewall called Tempesta FW kernel module implements HTTPtables (nftables-aware rules), JavaScript and cookie challenges, rate limits and SIMD/AVX2 HTTP string engines; benchmarks show ~1.8M req/s on cheap hardware, ~3× faster than nginx and up to 3–6× in long-header corners. A kernel TLS stack TempestaTLS fork of mbedTLS uses memory pools, skb fragment zero-copy and optimized handshake state to reduce copies and beat userland OpenSSL handshakes in DDoS-like workloads.

AI-written summary · about

" chapters (32)

1. 0:00Start
2. 1:18Problem: HTTP filtration
3. 3:11Web Application Firewall (WAF) acceleration
4. 6:12Other DDoS filters: firewall & NIDS
5. 8:51The problem in general: flat profile
6. 9:55System calls: one HTTP request (KPTI: each syscall = 2 L1 caches invalidations)
7. 10:42Naive HTTP parser
8. 11:58Why HTTP strings matter?
9. 13:50HTTP strings are special
10. 15:12Fast & secure HTTP parser SCALE 17x: http-string-processing-algorithms
11. 16:05Even flexible: custom allowed alphabets ⚫ Custom BM tables to filter injection attacks
12. 17:05Slow network async I/O
13. 18:12Slow network I/O: proxying
14. 19:03Synchronous sockets: HTTPS/TCP/IP stack
15. 20:03skb page allocator: zero-copy HTTP messages adjustment Add/remove/update HTTP headers w/o copies
16. 21:29Slow TLS: copying
17. 22:59Slow TLS: Linux kernel TLS & DDoS
18. 24:29Slow TLS: libraries' performance issues
19. 26:275 . Slow TLS: record size & TCP
20. 27:325 . Slow TLS: TCP & dynamic record size
21. 28:25Tempesta TLS: memory pools & profiles
22. 29:30Slow web cache: filesystem database
23. 30:20Web cache: TempestaDB
24. 30:50The HTTPS/TCP/IP stack (Interbreed an HTTP accelerator and a firewall)
25. 31:38DDoS mitigation: sticky cookie
26. 32:36DDoS mitigation: JavaScript challenge
27. 34:38DDoS mitigation: limits
28. 35:21Web Application Security (WAF acceleration)
29. 36:22HTTP tables ►HTTP load balancer and a firewall (-nftables)
30. 37:55Performance comparison w/ Nginx
31. 38:31Performance analysis: kernel bypass
32. 40:10An HTTP proxy in kernel?

" related talks

• 40mTempesta FW: FrameWork and FireWall for WAF and DDoS mitigationAleksandr Krizhanovskiy · HighLoad++ 2014
• 40mTempesta FW: FrameWork and FireWall for WAF and DDoS MitigationAleksandr Krizhanovskiy · HighLoad++ 2014
• 43mMathematics and development of fast TLS handshakesAlexander Krizhanovsky · linux.conf.au 2021
• 30mMathematics and development of fast TLS handshakesAlexander Krizhanovsky · DevConf.CZ 2021
• 53mTempesta FW challenges, internals, use casesAleksandr Krizhanovskiy · HighLoad++ 2015
• 46mLinux kernel TLS and HTTPSAleksandr Krizhanovskiy · HighLoad++ 2017
• 30mLessons From Defending The IndefensibleMarek Majkowski · Black Hat Europe 2015
• 42mAccelerating Envoy with the Linux KernelThomas Graf · KubeCon + CloudNativeCon Europe 2018