SUMMIT China 2023 ## Unleashing the Magic: Harnessing eBPF for Traffic Redirection in Istio Ambient Mode Chun Li & Iris Ding, Intel ## Outline • What is ambient mesh • How ambient mesh works • How reinforces ambient mesh • Next(lesson learned)... ## Background • Ambient mesh is a new Istio data plane mode • Launched in Sep. 2022. announcement • Currently in alpha status, moving forward to beta phase 1. Follow the instructions in Getting Started with Ambient Mesh 2. In istio install stage set the mode to ebpf by ' --set values.cni.ambient.redirectMode="ebpf", e.g.: istioctl install --set

the tokens print axioms : display assumed axioms print options : display options set by user or emacs mode print prefix : display all declarations in the namespace print coercions : display simplifier subst : substitution lemma, used for calc-expressions and simplifier ## Proof Elements ## Term Mode take, assume : syntactic sugar for lambda let : introduce local definitions have : introduce auxiliary name. ## Tactic Mode At any point in a proof or definition you can switch to tactic mode and apply tactics to finish that part of the proof or definition. begin ... end : enter tactic mode, and blocking

4.1 Automatic Proof Search (Auto) 111 4.2 Command-line options 114 4.3 Compilers 118 4.4 Emacs Mode 120 4.5 Literate Programming 125 4.6 Generating HTML 127 4.7 Generating LaTeX 127 4.8 Library Alex: https://www.haskell.org/alex/ • Happy: https://www.haskell.org/happy/ • GNU Emacs: http://www.gnu.org/software/emacs/ You should also make sure that programs installed by cabal-install are on your shell's search path. For instructions on installing a suitable version of Emacs under Windows, see Installing Emacs under Windows. Non-Windows users need to ensure that the development files for

CONTENTS 1 Using Lean 1 1.1 Using Lean Online 1 1.2 Using Lean with VSCode 1 1.3 Using Lean with Emacs 2 1.4 Using the Package Manager 3 2 Lexical Structure 7 2.1 Symbols and Commands 7 2.2 Identifiers 41 5.6 Instructions .42 5.7 Notation Declarations .43 6 Tactics .45 6.1 Tactic Mode .45 6.2 Basic Tactics .46 6.3 Equality and Other Relations .49 6.4 Structured Tactic Proofs message window which shows you error messages, warnings, output, and goal information when in tactic mode. Typing an underscore in an expression asks Lean to infer a suitable value for the expression and

'./src/index.html'}) } }; ## 核心概念之 Mode Mode 用来指定当前的构建环境是：production、development 还是 none 设置 mode 可以使用 webpack 内置的函数，默认值为 production ## Mode 的内置函数功能 |选项|描述| |---|---| |development|设置 process

Package • Packing Obfuscated Scripts • Improving Security Further • Advanced Topics ○ Using Super Mode Obfuscating Many Packages Solve Conflicts With Other Obfuscated Libraries Distributing Obfuscated File ○ Bundle obfuscated scripts with customized spec file ○ Improving The Security By Restrict Mode ☐ Using Plugin To Improve Security. ☐ Call pyarmor From Python Script ☐ Check license periodically of Obfuscated Scripts - Super Mode - Advanced Mode - Obfuscating Code Mode - Wrap Mode - Obfuscating module Mode - Restrict Mode - The Performance of Obfuscated Scripts

Packing Obfuscated Scripts 8 2.8 Improving Security Further 8 3 Advanced Topics 11 3.1 Using Super Mode 11 3.2 How to use outer license file 12 3.3 Obfuscating Many Packages 12 3.4 Solve Conflicts 12 Bundle obfuscated scripts with customized spec file 20 3.13 Improving The Security By Restrict Mode 21 3.14 Using Plugin To Improve Security 22 3.15 Call pyarmor From Python Script 24 3.16 Check How to protect data files ..... 30 3.26 How to remove docstrings ..... 31 3.27 Using restrict mode with threading and multiprocessing ..... 31 4 Examples ..... 33 4.1 Obfuscating and Packing

10 Bundle obfuscated scripts with customized spec file 16 3.11 Improving The Security By Restrict Mode 17 3.12 Checking Imported Function Is Obfuscated 18 3.13 Call pyarmor From Python Script 19 Modes of Obfuscated Scripts 67 11.1 Advanced Mode 67 11.2 Obfuscating Code Mode 68 11.3 Wrap Mode 68 11.4 Obfuscating module Mode 69 11.5 Restrict Mode 69 12 The Performance of Obfuscated Scripts number stands for the features: • 0: No anti-debug, JIT, advanced mode features, high speed • 7: Include anti-debug, JIT, advanced mode features, high security It’s possible to obfuscate the scripts with

a command-line option (-Xnormalize-constructor-calls=MODE) that tells the compiler to generate more Java-like bytecode for such constructs. Here MODE is one of: — disable (default) – generate bytecode (Any, Any, ... /* 42 more */, Any) -> Any) { block(Any(), Any(), ..., Any()) } ## Progressive mode Kotlin cares a lot about stability and backward compatibility of code: Kotlin compatibility policy correct. So, Kotlin 1.3 introduces progressive compiler mode, which can be enabled by passing the argument -progressive to the compiler. In progressive mode, some fixes in language semantics can arrive immediately