{"id":100138,"date":"2021-05-11T16:22:58","date_gmt":"2021-05-11T14:22:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-podgotovil-realizacziyu-ebpf-dlya-windows"},"modified":"2021-05-11T16:22:58","modified_gmt":"2021-05-11T14:22:59","slug":"microsoft-podgotovil-realizacziyu-ebpf-dlya-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/microsoft-podgotovil-realizacziyu-ebpf-dlya-windows","title":{"rendered":"A Microsoft elk\u00e9sz\u00edtette az eBPF megval\u00f3s\u00edt\u00e1s\u00e1t Windows-ra","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Microsoft k\u00f6zz\u00e9tette az eBPF alrendszer Windows-ra t\u00f6rt\u00e9n\u0151 implement\u00e1ci\u00f3j\u00e1t, amely lehet\u0151v\u00e9 teszi tetsz\u0151leges feldolgoz\u00f3k v\u00e9grehajt\u00e1s\u00e1t az oper\u00e1ci\u00f3s rendszer kernel szintj\u00e9n. Az eBPF be\u00e9p\u00edtett bytecode \u00e9rtelmez\u0151t tartalmaz a kernelben, amely lehet\u0151v\u00e9 teszi a felhaszn\u00e1l\u00f3i t\u00e9rb\u0151l bet\u00f6lthet\u0151 h\u00e1l\u00f3zati m\u0171veletek feldolgoz\u00f3inak l\u00e9trehoz\u00e1s\u00e1t, a hozz\u00e1f\u00e9r\u00e9s ellen\u0151rz\u00e9s\u00e9t \u00e9s a rendszerek m\u0171k\u00f6d\u00e9s\u00e9nek nyomon k\u00f6vet\u00e9s\u00e9t. Az eBPF a Linux kernel r\u00e9sz\u00e9t k\u00e9pezi a 3.18-as kiad\u00e1s \u00f3ta, \u00e9s k\u00e9pes kezelni a bej\u00f6v\u0151\/kimen\u0151 h\u00e1l\u00f3zati csomagokat, \u00e1tir\u00e1ny\u00edtani a csomagokat, kezelni a s\u00e1vsz\u00e9less\u00e9get, elfogni a rendszerh\u00edv\u00e1sokat, ellen\u0151rizni a hozz\u00e1f\u00e9r\u00e9st \u00e9s v\u00e9grehajtani a nyomk\u00f6vet\u00e9st. A JIT-\u00f6ssze\u00e1ll\u00edt\u00e1snak k\u00f6sz\u00f6nhet\u0151en a bytecode fut\u00e1sid\u0151ben g\u00e9pi utas\u00edt\u00e1sokk\u00e1 alak\u00edt\u00f3dik, amelyek a leford\u00edtott k\u00f3d teljes\u00edtm\u00e9ny\u00e9vel hajthat\u00f3k v\u00e9gre. Az eBPF forr\u00e1sk\u00f3dok Windows-ra ny\u00edltak, MIT-licenc alatt. <\/p>\n

Az eBPF Windows-ra a m\u00e1r l\u00e9tez\u0151 eBPF eszk\u00f6z\u00f6kkel alkalmazhat\u00f3, \u00e9s egy tipikus API-t ny\u00fajt, amelyet az eBPF alkalmaz\u00e1sokhoz haszn\u00e1lnak Linux alatt. A projekt lehet\u0151v\u00e9 teszi, hogy a C nyelven \u00edrt k\u00f3dot eBPF bytecode-d\u00e1 ford\u00edtsuk a Clang alap\u00fa eBPF ford\u00edt\u00f3 seg\u00edts\u00e9g\u00e9vel, \u00e9s m\u00e1r elk\u00e9sz\u00edtett Linux-ra \u00edrt eBPF feldolgoz\u00f3kat futtathatunk a Windows kernel\u00e9n, biztos\u00edtva egy speci\u00e1lis kompatibilit\u00e1si h\u00e1ts\u00f3 r\u00e9teget \u00e9s t\u00e1mogathatva a Libbpf API-t az eBPF programokkal interakci\u00f3ban \u00e1ll\u00f3 alkalmaz\u00e1sok sz\u00e1m\u00e1ra. K\u00edn\u00e1lat\u00e1ban Linux-szer\u0171 hook-okat biztos\u00edt\u00f3 h\u00e1ts\u00f3 r\u00e9tegek is tal\u00e1lhat\u00f3k az XDP (eXpress Data Path) \u00e9s a socket bind sz\u00e1m\u00e1ra, amelyek absztrakt\u00e1lj\u00e1k a Windows h\u00e1l\u00f3zati stack-j\u00e9hez \u00e9s h\u00e1l\u00f3zati illeszt\u0151programjaihoz val\u00f3 hozz\u00e1f\u00e9r\u00e9st. A j\u00f6v\u0151beni tervek k\u00f6z\u00f6tt szerepel a forr\u00e1sk\u00f3dok szintj\u00e9n a tipikus eBPF processzorokkal val\u00f3 teljes k\u00f6r\u0171 kompatibilit\u00e1s biztos\u00edt\u00e1sa.

\"A<\/center> <\/p>\n

Az eBPF Windows-ra t\u00f6rt\u00e9n\u0151 implement\u00e1ci\u00f3j\u00e1nak kulcsfontoss\u00e1g\u00fa k\u00fcl\u00f6nbs\u00e9ge egy alternat\u00edv bytecode ellen\u0151rz\u0151 alkalmaz\u00e1sa, amelyet eredetileg a VMware munkat\u00e1rsai \u00e9s kanadai, valamint izraeli egyetemek kutat\u00f3i javasoltak. Az ellen\u0151rz\u0151 egy k\u00fcl\u00f6n, elszigetelt folyamatban fut a felhaszn\u00e1l\u00f3i t\u00e9rben, \u00e9s a BPF programok v\u00e9grehajt\u00e1sa el\u0151tt alkalmazz\u00e1k a hib\u00e1k azonos\u00edt\u00e1sa \u00e9s a lehets\u00e9ges k\u00e1rt\u00e9kony tev\u00e9kenys\u00e9gek blokkol\u00e1sa \u00e9rdek\u00e9ben. <\/p>\n

A Windows eBPF verification uses a static analysis method based on Abstract Interpretation, which shows a lower rate of false positives compared to the eBPF verifier for Linux, supports loop analysis, and provides good scalability. The method takes into account numerous execution pattern templates derived from analyzing existing eBPF programs. <\/p>\n

A Bytecode verifik\u00e1l\u00e1sa ut\u00e1n a bytecode \u00e1tker\u00fcl egy, a kernel szintj\u00e9n m\u0171k\u00f6d\u0151 \u00e9rtelmez\u0151h\u00f6z, vagy JIT (Just-In-Time) ford\u00edt\u00f3n kereszt\u00fcl futtatj\u00e1k a l\u00e9trej\u00f6v\u0151 g\u00e9pi k\u00f3dot kernel jogosults\u00e1gokkal. Az eBPF kezel\u0151k kernel szint\u0171 elszigetel\u00e9s\u00e9hez HVCI (HyperVisor-vez\u00e9relt K\u00f3dintegrit\u00e1s) mechanizmust alkalmaznak, amely a virtualiz\u00e1ci\u00f3s eszk\u00f6z\u00f6ket haszn\u00e1lja a kernelben fut\u00f3 folyamatok v\u00e9delm\u00e9re, biztos\u00edtva a v\u00e9grehajtott k\u00f3d digit\u00e1lis al\u00e1\u00edr\u00e1s \u00e1ltali integrit\u00e1s\u00e1nak meger\u0151s\u00edt\u00e9s\u00e9t. A HVCI korl\u00e1toz\u00e1sa, hogy csak az \u00e9rtelmezhet\u0151 eBPF programok verifik\u00e1l\u00e1s\u00e1ra van lehet\u0151s\u00e9g, \u00edgy nem haszn\u00e1lhat\u00f3 egyidej\u0171leg JIT-tel (a v\u00e1laszt\u00e1s a k\u00f6vetkez\u0151: vagy teljes\u00edtm\u00e9ny, vagy tov\u00e1bbi v\u00e9delem).
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b eBPF \u0434\u043b\u044f Windows, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. eBPF \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0432 \u044f\u0434\u0440\u043e \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440 \u0431\u0430\u0439\u0442\u043a\u043e\u0434\u0430, \u0434\u0430\u044e\u0449\u0438\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0435 \u0438\u0437 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u0438\u0441\u0442\u0435\u043c. eBPF \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 3.18 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0435\/\u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100139,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100138","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Microsoft has prepared eBPF implementation for Windows | ProHoster","description":"Microsoft has released an implementation of the eBPF subsystem for Windows, allowing the execution of arbitrary handlers operating at the operating system's kernel level.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/microsoft-podgotovil-realizacziyu-ebpf-dlya-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Microsoft \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e eBPF \u0434\u043b\u044f Windows | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b eBPF \u0434\u043b\u044f Windows, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/microsoft-podgotovil-realizacziyu-ebpf-dlya-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-11T14:22:59+00:00","article:modified_time":"2021-05-11T14:22:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100138","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-11 22:29:58","updated":"2022-09-29 09:29:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100138","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=100138"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100138\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/100139"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=100138"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=100138"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=100138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}