gatekeeper
gatekeeper copied to clipboard
Have a BPF example for QUIC
Soon the QUIC protocol will become an Internet standard; one can track the status of all related RFCs here. Therefore, we need a BPF example for QUIC, so users can support it in their policies.
Questions to consider in the writing of the BPF example:
- How to avoid the analog of TCP SYN floods?
- The initial QUIC packets have a specific minimum length, so the BPF program could quickly verify this requirement.
- What else can be validated in the protocol? For example, is there a way to avoid the equivalent of a TCP SYN+ACK packet going to a listening socket?