TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

BPF port-based firewall for systemd services

103 点作者 Klasiaster超过 5 年前

7 条评论

ldng超过 5 年前
Maybe someone can enlighten me because I&#x27;m failing to see the relevance of SystemD here.<p>So the idea is, instead of having a central firewall managing all the host rules, each service define it&#x27;s own firewall policy ? How do I override a policy ?<p>I maybe missing something but somehow I&#x27;m not sure it&#x27;s the right place to do this.<p>I&#x27;ll end up joining the camp of SystemD does too much and breaks a lot of POSIX semantics making Linux systems hard to debug.<p>Lately it&#x27;s been getting more and more in my way. Things that I have problems with lately, DNS, cgroup and namespace. Every time I&#x27;ve lost a considerable amount of time because of poorly documented and mostly unexpected SystemD behavior. Color me annoyed.<p>Edit: Hum, well, wasn&#x27;t supposed to but it end up into a rant
评论 #20843817 未加载
评论 #20843081 未加载
评论 #20843053 未加载
评论 #20844146 未加载
arianvanp超过 5 年前
This approach is very similar to what <a href="https:&#x2F;&#x2F;github.com&#x2F;cilium&#x2F;cilium" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;cilium&#x2F;cilium</a> is doing for containers right? I wonder if it would be easy to reuse the battle-tested bpf programs that cilium provides and load them into systemd units.<p>There is more crazy shit that we can do. Like set up entire service meshes with load balancers for your systemd units. Very neat.
评论 #20840159 未加载
nailer超过 5 年前
If you&#x27;re wondering what BPF is: <a href="https:&#x2F;&#x2F;linux-audit.com&#x2F;bpfilter-next-generation-linux-firewall&#x2F;" rel="nofollow">https:&#x2F;&#x2F;linux-audit.com&#x2F;bpfilter-next-generation-linux-firew...</a> and <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Berkeley_Packet_Filter" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Berkeley_Packet_Filter</a>
评论 #20840800 未加载
justicezyx超过 5 年前
Isn&#x27;t the BPF program has to be attached with root privilege? If so, the idea that to have per service is not enforceable anyway, right? As potential my filter can affect any other process running on the host.
ausjke超过 5 年前
what&#x27;s the user case for this and how does this complements iptables? why do I need this?<p>BPF is very interesting, I remember one thing is that it&#x27;s of very small size and has no loops, but I don&#x27;t understand its use case for firewall yet.
评论 #20845166 未加载
评论 #20843250 未加载
评论 #20843423 未加载
cat199超过 5 年前
sooo.. tcpwrappers?
skywhopper超过 5 年前
Compiling dynamically generated C programs on demand to provide packet filtering? It&#x27;s clever but not in a good way. This is a really dangerous approach to solving this problem.
评论 #20839962 未加载
评论 #20839974 未加载
评论 #20840090 未加载
评论 #20839966 未加载
评论 #20841098 未加载
评论 #20839972 未加载