Hacker News Reader

Comment by foodstances | Hacker News Reader

Is it more complex? Well, you decide. Is kernel mode C "more complex" than p0f-to-bpf compiler in python?

Obviously C code running in a kernel is "more complex" than a Python script.

I was talking about how users would actually use this p0f BPF tool. Compare this:

    ./bpfgen p0f -- 4:64:0:*:mss*10,6:mss,sok,ts,nop,ws:df,id+:0
    sudo iptables -A INPUT -p tcp --dport 80 -m bpf --bytecode "39,0 0 0 0,48 0 0 8,37 [...]"

with how you would actually use the "complex" C code in pf:

    block in proto tcp from any os Windows

View on HN

That's not what we are doing with this. We are dealing with DDoS SYN floods, not "block Windows".

You mean like:

  pass in proto tcp from any to any port www synproxy state

I'm being a little tongue-in-cheek, though. It seems your solution is either a superset of the above, or perhaps just an alternative. And compiling p0f to BPF is definitely an interesting topic and quite noteworthy.

Though, I would dispute the notion that compiling to BPF is either simpler or more secure. The BPF JIT has been responsible for several kernel exploits recently. The original BPF was much simpler but irrelevant at this point. While I believe the design of the contemporary incarnation in Linux is still provably correct, the implementation manifestly still has bugs. And from a user perspective it's really difficult to beat the syntax of PF's pf.conf. pf.conf can't be emulated by using a front-end configuration generator for iptables + company as the semantics of many tasks require implementation logic in the kernel, whether as extensions to BPF or to the networking subsystem.

Reply on news.ycombinator.com