Combining kTLS and BPF for Introspection and Policy Enforcement

Explore a technical talk from the Linux Plumbers Conference that delves into combining kernel TLS (kTLS) and Berkeley Packet Filter (BPF) for introspection and policy enforcement. Learn about the current kernel's sockmap BPF architecture for L7 policy enforcement, as well as the ULP and strparser framework used for socket callbacks and message boundary determination. Discover the challenges faced when integrating kTLS with BPF to enable in-kernel introspection and policy enforcement of application data before encryption. Gain insights into various approaches to address ULP layer shortcomings, optimizations for strparser, and the consolidation of scatter/gather processing for kTLS and sockmap. Understand the potential future developments in this area of kernel networking and security.

LPC2018 - Combining kTLS and BPF for Introspection and Policy Enforcement