SYN Proxy at Scale with BPF
summary
A stateless SYN proxy is implemented to protect multi‑terabit services by validating custom SYN cookies at the edge and avoiding per‑connection state in the proxy. The team built a kernel module that rewrites ISNs to glue client and backend handshakes (works but is unsafe and hard to maintain) and prototypes a BPF path that exposes a kfunc to allocate request_sock and accepts a packed TCP cookie attribute from BPF, using a rolling salt shared across nodes so any proxy validates cookies; QPS/latency numbers are not yet measured.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 0:45SYN cookies in Linux
- 7:00SYN proxy challenges
- 10:38Stateless SYN proxy design
- 14:15BPF for SYN cookie validation
- 21:01Summary and conclusion
- 21:45Q&A
related talks
34mHow Many Proxies Do You Need?
28mProxy Service: A New Network Traffic Abstraction in Kubernetes
24mSpeedrun Through Splicing Sockets with Sockmap
39mThe evolution of service mesh with eBPF
32meBPF: BPF kernel infrastructure
41mPanel Discussion - The Future of Service Mesh: Is eBPF a Silver Lining or a Silver Bullet
35mLiberating Kubernetes From Kube-proxy and Iptables
47mSpeedrun through Splicing Sockets with Sockmap