Write your own Firewall with Java & eBPF
summary
Claims a runnable high-throughput firewall built by combining Java and eBPF that actually loads BPF bytecode from Java, attaches to XDP and drops packets at the NIC, uses hello-ebpf and Java FFI via Project Panama, compiles Java annotations into C/Clang-produced eBPF, stores rules in kernel maps, demonstrates a live demo that drops every third packet and cites iptables ~1.6M pps for comparison while noting hardware offload and verifier safety constraints.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 1:05Why build firewall in Java & eBPF
- 3:59Traditional firewall limits
- 6:47eBPF future for kernel
- 9:56What is eBPF
- 14:10eBPF vs kernel modules
- 15:33eBPF maps
- 18:46eBPF hooks
- 21:14eBPF security
- 22:17eBPF tools
- 23:20Java support for eBPF
- 24:24Demo setup
- 25:29Simple eBPF firewall in Java
- 28:20Compile & load eBPF
- 31:12Attach to interface
- 32:17Test with ping
- 34:04Java to eBPF C
- 35:33Java benefits for eBPF
- 36:58eBPF real-world apps
- 37:42Conclusion
- 38:43Q&A
related talks
58mBuild a lightning fast Firewall with Java & eBPF
47mBuilding a lightning fast Firewall with Java & eBPF
32mDemystifying eBPF - eBPF Firewall from scratch
47mInto the Heart of the eBPF Hive!
33meBPF: exploring use case of BPF kernel infrastructure
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
35mEbpf with Rust: The Journey of a Package
14mWriting Custom eBPF Programs for O11y: What You Need to Know