L3AF Roadmap Discussion

[jniesz]

As discussed in the TSC call we are mapping out the 1 year roadmap for L3AF. The next release of L3AF is planned for in 1-2 months and will target the below features / enhancements. Beyond the next release I am starting this discussion to gather feedback from the community on the 1-year road map items. Please use this discussion to suggest features that you would like to see in L3AF.

l3afd v1.0.0 (Complete)

• mTLS (trust based on CA and SAN)
• Support for multiple eBPF package repositories with ability to define a separate repo for each eBPF program via API
• Support for storing secret key(s) in different secret stores (local, cloud provider, vault)
• L3AFD running on Azure VM in Linux
• CI/CD improvements (CodeQL, OpenSSF scorecard, Dependabot, staticcheck)

Post Next Release (1 Year)

• Role Based Access Control (RBAC) - JWT token based auth
• L3AFD running on Azure VM in Windows
• XDP Support for Windows
• Improved Chaining (XDP dispatcher, libxdp go library, compatibility with Cilium chaining)
• Loading eBPF byte-code directly from l3afd
• Running user space programs using hashicorp go-plugin
• Upgrade L3AF eBPF programs to the latest libbpf library
• Support BPF CO-RE to improve eBPF compatibility on Linux
• eBPF package signing, eBPF program (byte code) signing, Hyper-V signing
• Observability enhancements (loading kprobes, uprobes, tracepoints, and exporting them as prometheus endpoint)
• Feature to support continuous enforcement / monitor of eBPF programs to ensure they are not unloaded and no additional eBPF programs are loaded
• CI/CD Improvements (LFX security)
• L3AF eBPF Package repository (MVP)

[jniesz]

l3afd v2.0.0 (6 Months)

• Improve eBPF loading and chaining
  • Native loading of eBPF program(s) into the kernel using go library (Cilium/eBPF)
  • Implement Chaining using tailf with Cilium library
• Role Based Access Control (RBAC) - JWT token based with pub/private key auth
  • Support for admin or read-only roles
• XDP support for Windows
• L3AFD running on Azure Windows VM

eBPF-Package-Repository v1.0.0 (6 Months)

• Open source traffic mirroring program
• Modify existing eBPF programs (tc-root, xdp-root, ratelimiting, connection limiting) for l3afd v2.0.0 native go chaining
• Remove hard coding of map paths in eBPF programs
• Support BPF CO-RE to improve eBPF compatibility on Linux

Post Next Release (1 Year)

• Remove hard coding of program type and attach type when loading eBPF programs
• Support for kprobe, uprobe, tracepoint, cgroup_sock_addr, cgroup_sock_ops programs

[sanfern]

l3afd v2.1.0 (6 Months)

• Support graceful restart of l3afd
• Improve unit testing for l3afd
• Improve map arguments for l3afd - Remove hard coded key (i.e. 0), allow user input
• Enable l3afd to run in a container to support cloud-native environments. Setup dev env with container
• Investigate running eBPF programs inside a k8s POD
• Development of xdp-dispatcher library (i.e. libxdp) in Go or Rust.
• Integrate with OpenTelemetry OTEL protocol and Prometheus format for exporting metrics
• Loading signed ebpf programs
• Deprecate loading ebpf programs from user program

eBPF-Package-Repository v2.1.0 (6 Months)

• Fix interface name validation checks to support hyphens
• CI/CD Improvements - Build only the program that has been modified.
• Support BPF CO-RE to improve eBPF compatibility on Linux
• IPv6 Support for BPF programs
• eBPF package signing support

Post Next Release (1 Year)

• XDP support for Windows
• L3AFD running on Azure Windows VM
• End-to-End testing for Windows
• eBPF package signing, eBPF program (byte code) signing, Hyper-V signing
• Remove hard coding of program type and attach type when loading eBPF programs
• Support for kprobe, uprobe, tracepoint, cgroup_sock_addr, cgroup_sock_ops programs

[sanfern]

l3afd v2.2 (6 Months)

• Support for kretprobe, uprobe, uretprobe, cgroup_sock_addr, cgroup_sock_ops programs
• Investigate running eBPF programs inside a k8s POD
• Loading tc programs using tcx
• eBPF Program metrics enhancements
• Kernel v6.8 support
• Improve unit testing for l3afd
• Loading signed ebpf programs
• Deprecate loading ebpf programs from user program
• Monitor CPU of ebpf program
• Integration with external AI reviewer.
• Integrate with OpenTelemetry OTEL protocol and Prometheus format for exporting metrics

eBPF-Package-Repository v2.2 (6 Months)

• Building eBPF programs without kernel source
• eBPF package signing support
• Monitor SSL/TLS certs
• Monitor SNI headers
• Seccomp BPF filter support
• BPF-LSM support
• System metrics for CPU, Memory and Network.
• Runtime code profilers

Post Next Release (1 Year)

• Development of xdp-dispatcher library (i.e. libxdp) in Go.
• IPv6 Support for BPF programs
• Integrate with OpenTelemetry OTEL protocol and Prometheus format for exporting metrics
• Integration with external AI tools
• Runtime code profilers