midy177/mule-proxy

fast proxy: eBPF data plane, Go control plane

mule-proxy: hybrid Go + eBPF L4 proxy

Mule attempts to provide the best of both worlds:

• full expressivity of Go for connection establishment (and rejection decisions)
• pure kernel-space proxying for established connections using the eBPF sockhash infrastructure

Performance:

These benchmarks establish a TLS connection over the loopback interface and performs HTTP requests over the established connection:

cpu: Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz
BenchmarkNewConnBaseline-8       	  102624	     58409 ns/op	    4861 B/op	      60 allocs/op
BenchmarkNewConnMule-8           	   86451	     69386 ns/op	    4861 B/op	      60 allocs/op
BenchmarkNewConnGo-8             	   72558	     85488 ns/op	    4860 B/op	      60 allocs/op

On Intel systems (with a kernel patch applied to reduce the added latency of eBPF redirects from ~15 microseconds to ~10 microseconds), proxying a TLS connection with a naive Go L4 Proxy incurs a 40% overhead - mule reduces this overhead to 16%. Cilium has a blog post describing a (more complicated and full featured) similar L4 proxy suggesting an eBPF-based approach has the potential for significant CPU reduction over a userspace (like haproxy) or IPVS-based implementation.