Speaker
Description
Recent advances in the Linux kernel have enabled increasingly complex kernel offloads with eBPF. Despite this, parsing application-layer protocols, e.g. HTTP, remains a challenge. The reason for this is the self-describing structure of such protocols, which typically requires more state and more complex control flow than a transport-layer protocol. This is unfortunate because supporting L7 protocols in eBPF opens up new opportunities to optimize many applications that were previously deemed too complex, e.g. web servers, web application firewalls, or L7 service proxies.
This talk introduces HTTBPF, a novel architecture to parse HTTP directly in eBPF, without the need for kernel modules. To circumvent eBPF’s stringent limitations, it constructs Aho-Corasick-like DFAs in user space, and leverages them in kernel space to identify and extract relevant headers from the message buffer. We fully implement HTTBPF, with support for HTTP/1.1 and HTTP/2, and show its advantage by serving HTTP requests directly from eBPF.