ebpf

Bilingual

How Do I Profile eBPF Code?
2 months ago
- Measure performance impact of eBPF code using a simple C test harness that times file open operations via syscall(SYS_openat) under warm cache conditions.
- Enable BPF JIT and expose symbols via sysctl commands so perf can resolve eBPF program names instead of unknown addresses.
- Run baseline test without eBPF, then profile with eBPF using perf record with options like taskset, chrt, frame pointers, and 997 samples per second.
- Analyze perf report to identify bottlenecks, such as the bpf_lsm_file_open hook and its tail calls, which can dominate overhead.
- Focus on the profiling method; actual overhead depends on the eBPF hook's implementation and can be optimized via caching or better algorithms.
Linux kernel will support $ORIGIN, sort of
2 months ago
- The goal is to support relocatable binaries in Nix by allowing $ORIGIN in PT_INTERP and shebang.
- Christian Brauner suggested using eBPF for programmable interpreter selection via binfmt_misc, rather than a kernel patch.
- An eBPF program can match ELF files and dynamically determine the interpreter path, supporting $ORIGIN.
- A new binfmt_misc flag 'L' enables loader substitution, making the interpreter override transparent and preserving process identity.
- Future plans include a NixOS module that registers the BPF handler at boot, gated on a new PT_INTERP_NIX segment for opt-in.
We Put an L7 Firewall in the Kernel
2 months ago
- The firewall uses eBPF in the kernel to make HTTP/2 header decisions in nanoseconds, avoiding userspace proxy delays.
- Policy is written as JavaScript apps, allowing updates via git push without rebuilds, redeploys, or restarts.
- Matches on HTTP/2 headers like :authority, User-Agent, and source address using boolean logic rules.
- Uses XDP hook for early packet filtering, dropping packets before kernel socket allocation for minimal cost.
- Compiles banned User-Agent substrings into a single Aho-Corasick automaton for linear-time scanning, scalable to thousands of patterns.
- Handles HPACK compression by tracking the dynamic table live, ensuring header visibility across requests.
- Exposes real-time metrics via Prometheus and Grafana, including evasion attempts like fragmented headers.
- Deploys as a Docker container, currently tested in production with enterprise traffic.
Reimplementing pf as an eBPF/XDP dataplane on Linux
2 months ago
- PFL is an experimental project aiming to translate pf's firewall language and stateful semantics to Linux's XDP (eXpress Data Path) for efficient packet processing.
- Built on FreeBSD's pfSense legacy, PFL uses Rust for the control plane (pfld) and eBPF dataplane, leveraging XDP's driver-level execution for high packet rates.
- Key architectural features include a tail-call graph pipeline to comply with eBPF verifier constraints, LRU hash maps for connection state, and per-CPU counters.
- PFL achieves significant pf feature parity including filtering, NAT (v4/v6), NAT64, normalization, policy routing, and DoS resistance with SYN cookies.
- Limitations include no full fragment reassembly (due to XDP model) and preliminary performance results (better median latency but higher tail latency and CPU use vs nftables in VM tests).
- Future work includes bare-metal evaluation on Arm appliances, egress fast-path optimization, high availability via pflsync, and protocol depth improvements.
- PFL distinguishes itself by maintaining fidelity to pf language while operating in-kernel with XDP, leaving the host interface usable, unlike userspace alternatives like VPP.

How Do I Profile eBPF Code?

Linux kernel will support $ORIGIN, sort of

We Put an L7 Firewall in the Kernel

Reimplementing pf as an eBPF/XDP dataplane on Linux