4 ms·
That's pretty tidy. Is there any noticeable overhead in listening to all kernel sockets and hooking in your code when it matches a packet filter, compared to ju
by tetris11 4y ago
That's pretty tidy. Is there any noticeable overhead in listening to all kernel sockets and hooking in your code when it matches a packet filter, compared to just building it into the kernel?
- bjackman 4y agoIt's pretty damm fast. Everything is JITed and there's codegen for the "trampoline" logic so that there aren't even indirect branches to get to the program code. The "overhead" comes from the fact that writing nontrivial BPF programs is quite hard. Getting programs to pass the verifier can become a bit of an art. This does tend to get easier if your production environment has few and recent kernel versions. And then of course this "overhead" totally pays for itself in terms of reliability. It's really hard to accidentally break machines with BPF, while a kernel module in your prod environment is a time bomb :D (Deliberately breaking machines with BPF is very easy though. This sometimes seems to surprise people but if your attacker gets CAP_BPF it's probably game over).