{"id":100138,"date":"2021-05-11T16:22:58","date_gmt":"2021-05-11T14:22:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-podgotovil-realizacziyu-ebpf-dlya-windows"},"modified":"2021-05-11T16:22:58","modified_gmt":"2021-05-11T14:22:59","slug":"microsoft-podgotovil-realizacziyu-ebpf-dlya-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/microsoft-podgotovil-realizacziyu-ebpf-dlya-windows","title":{"rendered":"Microsoft a preg\u0103tit implementarea eBPF pentru Windows","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Microsoft a publicat o implementare a subsistemului eBPF pentru Windows, care permite rularea de manipulatoare arbitrare, func\u021bion\u00e2nd la nivelul nucleului sistemului de operare. eBPF ofer\u0103 un interpret de bytecode \u00eencorporat \u00een nucleu, care permite crearea de manipulatoare de opera\u021biuni de re\u021bea ce pot fi \u00eenc\u0103rcate din spa\u021biul utilizatorului, control\u00e2nd accesul \u0219i monitoriz\u00e2nd func\u021bionarea sistemelor. eBPF este inclus \u00een nucleul Linux \u00eencep\u00e2nd cu versiunea 3.18 \u0219i permite procesarea pachetelor de re\u021bea de intrare\/ie\u0219ire, redirec\u021bionarea pachetelor, gestionarea l\u0103\u021bimii de band\u0103, interceptarea apelurilor de sistem, controlul accesului \u0219i efectuarea de urm\u0103riri. Datorit\u0103 utiliz\u0103rii compil\u0103rii JIT, bytecode-ul este tradus \u00een instruc\u021biuni ma\u0219in\u0103 pe parcurs \u0219i este executat cu performan\u021ba unui cod compilat. Codurile surs\u0103 eBPF pentru Windows sunt deschise sub licen\u021ba MIT. <\/p>\n

eBPF pentru Windows poate fi utilizat cu deja existentele instrumente de lucru eBPF \u0219i ofer\u0103 un API standardizat, aplicabil pentru aplica\u021biile eBPF \u00een Linux. Printre altele, proiectul permite compilarea codului scris \u00een C \u00een bytecode eBPF cu ajutorul compilatorului standard eBPF bazat pe Clang \u0219i rularea manipulatoarelor eBPF deja create pentru Linux pe nucleul Windows, oferind un strat special de compatibilitate \u0219i sus\u021bin\u00e2nd API-ul standard Libbpf pentru compatibilitatea cu aplica\u021biile care interac\u021bioneaz\u0103 cu programele eBPF. De asemenea, sunt oferite straturi care furnizeaz\u0103 hook-uri asem\u0103n\u0103toare Linux pentru XDP (eXpress Data Path) \u0219i socket bind, abstractiz\u00e2nd accesul la stiva de re\u021bea \u0219i la driverele de re\u021bea Windows. Printre planuri se men\u021bioneaz\u0103 asigurarea compatibilit\u0103\u021bii complete la nivelul codurilor surs\u0103 cu manipulatoarele eBPF standard din Linux.

\"Microsoft<\/center> <\/p>\n

Principala diferent\u0103 a implement\u0103rii eBPF pentru Windows este utilizarea unui vericator alternativ de bytecode, propus ini\u021bial de angaja\u021bi ai companiei VMware \u0219i cercet\u0103tori din universit\u0103\u021bi canadiene \u0219i israeliene. Verificatorul este rulat \u00eentr-un proces izolat separat \u00een spa\u021biul utilizatorului \u0219i este aplicat \u00eenainte de executarea programelor BPF, cu scopul de a identifica erorile \u0219i de a bloca posibile activit\u0103\u021bi mali\u021bioase. <\/p>\n

Pentru verificarea \u00een eBPF pentru Windows se folose\u0219te o metod\u0103 de analiz\u0103 static\u0103, bazat\u0103 pe interpretare abstract\u0103 (Abstract Interpretation), care, comparativ cu verificatorul eBPF pentru Linux, prezint\u0103 un nivel mai sc\u0103zut de alarme false, sus\u021bine analiza buclelor \u0219i asigur\u0103 o scalabilitate bun\u0103. Metoda ia \u00een considerare numeroase tipare de execu\u021bie, ob\u021binute prin analiza programelor eBPF existente. <\/p>\n

Dup\u0103 verificare, bytecode-ul este transmis interpretatorului care func\u021bioneaz\u0103 la nivel de kernel sau este trimis printr-un compilator JIT, cu execu\u021bia ulterioar\u0103 a codului machine rezultat cu privilegii de kernel. Pentru izolarea handler-elor eBPF la nivel de kernel, se folose\u0219te mecanismul HVCI (HyperVisor-enforced Code Integrity), care utilizeaz\u0103 instrumente de virtualizare pentru a proteja procesele din kernel \u0219i asigur\u0103 verificarea integrit\u0103\u021bii codului executabil prin semn\u0103tur\u0103 digital\u0103. O limitare a HVCI este capacitatea de a verifica doar programele eBPF interpretabile \u0219i imposibilitatea de a fi folosit \u00eempreun\u0103 cu JIT (se ofer\u0103 alegerea \u2014 fie performan\u021b\u0103, fie protec\u021bie suplimentar\u0103).
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b eBPF \u0434\u043b\u044f Windows, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. eBPF \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0432 \u044f\u0434\u0440\u043e \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440 \u0431\u0430\u0439\u0442\u043a\u043e\u0434\u0430, \u0434\u0430\u044e\u0449\u0438\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0435 \u0438\u0437 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u0438\u0441\u0442\u0435\u043c. eBPF \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 3.18 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0435\/\u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100139,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100138","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Microsoft a preg\u0103tit implementarea eBPF pentru Windows | ProHoster","description":"Compania Microsoft a publicat o implementare a subsistemului eBPF pentru Windows, care permite rularea handler-elor arbitrare ce func\u021bioneaz\u0103 la nivel de kernel al sistemului de operare.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/microsoft-podgotovil-realizacziyu-ebpf-dlya-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Microsoft \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e eBPF \u0434\u043b\u044f Windows | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b eBPF \u0434\u043b\u044f Windows, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/microsoft-podgotovil-realizacziyu-ebpf-dlya-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-11T14:22:59+00:00","article:modified_time":"2021-05-11T14:22:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100138","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-11 22:29:58","updated":"2022-09-29 09:29:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100138","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=100138"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100138\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/100139"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=100138"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=100138"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=100138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}