from the Data Deluge? A case for file filtering in eBPF Giulia Frascaria October 28, 2020 1 The data deluge on modern storage 2 Compute node CPU Network Storage node Flash The data deluge on CPU Network Storage node Flash Data DoS in reverse! 11 Compute node CPU Network Storage node Flash Data So similar yet so different ● DoS is malicious ● Data transfer is business-critical ● We 12 So similar yet so different ● DoS is malicious ● Data transfer is business-critical ● We can blindly drop DoS 13 But could we reduce data transfer size? eBPF filter-reduce 14 Filter Reduce input

expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.6.5 Extracting data from text file table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 2.4.4 Searching on the package meta data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 2.5 Debian package management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 2.5.1 Archive meta data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 Référence Debian xiii 9.8.2 Manipulation des fichiers sans monter le disque . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 7.9 Liste de programmes en rapport avec la manipulation du presse-papiers « caractères » . . . . . . . . . . . . . . . 135 8.1 Liste des paquets IBus -l » avec la valeur de style pour l’heure . . . . . . . . . . . . 149 9.6 Liste des outils de manipulation d’images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 9.7

likely degrade performance. Operating System Caching Almost all modern operating systems cache file-data in memory managed directly by the kernel. This is a powerful feature, and for the most part operating header" file, which includes meta- information about the URL, such as when it is due to expire and a ".data" file which is a verbatim copy of the content to be served. In the case of a content negotiated via a ".vary" directory will be created for the URL in question. This directory will have multiple ".data" files corresponding to the differently negotiated content. Maintaining the Disk Cache Although

likely degrade performance. Operating System Caching Almost all modern operating systems cache file-data in memory managed directly by the kernel. This is a powerful feature, and for the most part operating header" file, which includes meta-information about the URL, such as when it is due to expire and a ".data" file which is a verbatim copy of the content to be served. In the case of a content negotiated via a ".vary" directory will be created for the URL in question. This directory will have multiple ".data" files corresponding to the differently negotiated content. Maintaining the Disk Cache Although

likely degrade performance. Operating System Caching Almost all modern operating systems cache file-data in memory managed directly by the kernel. This is a powerful feature, and for the most part operating header" file, which includes meta-information about the URL, such as when it is due to expire and a ".data" file which is a verbatim copy of the content to be served. In the case of a content negotiated via a ".vary" directory will be created for the URL in question. This directory will have multiple ".data" files corresponding to the differently negotiated content. Maintaining the Disk Cache Although

likely degrade performance. Operating System Caching Almost all modern operating systems cache file-data in memory managed directly by the kernel. This is a powerful feature, and for the most part operating header" file, which includes meta-information about the URL, such as when it is due to expire and a ".data" file which is a verbatim copy of the content to be served. In the case of a content negotiated via a ".vary" directory will be created for the URL in question. This directory will have multiple ".data" files corresponding to the differently negotiated content. Maintaining the Disk Cache Although

likely degrade performance. Operating System Caching Almost all modern operating systems cache file-data in memory managed directly by the kernel. This is a powerful feature, and for the most part operating header" file, which includes meta-information about the URL, such as when it is due to expire and a ".data" file which is a verbatim copy of the content to be served. In the case of a content negotiated via a ".vary" directory will be created for the URL in question. This directory will have multiple ".data" files corresponding to the differently negotiated content. Maintaining the Disk Cache Although

overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data. 13http://httpd.apache.org/lists operating system environment under which the server itself runs, you must use the standard environment manipulation mechanisms provided by your operating system shell. Setting Environment Variables Related Modules BROWSERMATCHNOCASE PASSENV REWRITERULE SETENV SETENVIF SETENVIFNOCASE UNSETENV Basic Environment Manipulation The most basic way to set an environment variable in Apache is using the unconditional SETENV

likely degrade performance. Operating System Caching Almost all modern operating systems cache file-data in memory managed directly by the kernel. This is a powerful feature, and for the most part operating header" file, which includes meta-information about the URL, such as when it is due to expire and a ".data" file which is a verbatim copy of the content to be served. In the case of a content negotiated via a ".vary" directory will be created for the URL in question. This directory will have multiple ".data" files corresponding to the differently negotiated content. Maintaining the Disk Cache Although