Nov 13 – 15, 2018
America/Vancouver timezone

Combining kTLS and BPF for Introspection and Policy Enforcement

Nov 14, 2018, 9:55 AM
Junior/Ballroom-C (Sheraton Vancouver Wall Center)


Sheraton Vancouver Wall Center



Daniel Borkmann (Cilium) John Fastabend (Cilium)


This talk is divided into two parts, first we present on kTLS, the current kernel's
sockmap BPF architecture for L7 policy enforcement, as well as the kernel's ULP and
strparser framework which is utilized by both in order to hook into socket callbacks
and determine message boundaries for subsequent processing.

We further elaborate on the challenges we face when trying to combine kTLS with the
power of BPF for the eventual goal of allowing in-kernel introspection and policy
enforcement of application data before encryption. Besides others, this includes a
discussion on various approaches to address the shortcomings of the current ULP layer,
optimizations for strparser, and the consolidation of scatter/gather processing for
kTLS and sockmap as well as future work on top of that.

Presentation materials

Platinum sponsors

Gold sponsors

Silver sponsors

Catchbox sponsor
T-Shirt sponsor