4 ms·

eBPF: A curated list of projects related to eBPF

59 points by GordonS 5y ago

phendrenad2 5y ago
Based on the hype around eBPF, you'd think it was a new JS framework. I suspect that it's hype will dwindle as people realize that it's mostly invisible to them. Just pay for <random monitoring solution> and it'll plug into eBPF, without you having to say the words e, b, or even pf.
- sophacles 5y ago
  What if I also do networking on my computer? Will my monitoring solution magically do packet manipulation without my input? eBPF is not just for monitoring.
- tptacek 5y ago
  There's no programming environment you can't say this about.
- pclmulqdq 5y ago
  eBPF has basically democratized the performance that used to be reserved for DPDK applications and other weird user space things. It's a big deal.
daniel_rh 5y ago
I was just experimenting with eBPF and ran into a limitation: Is there a way to load the source IP into a register when working in userspace? When I SO_ATTACH_BPF to a SOCK_DGRAM it only makes the udp header accessible, per https://github.com/danielrh/bpf_buffer_per_source/blob/main/limited_per_source.c https://github.com/danielrh/bpf_buffer_per_source/blob/main/... I would love to be able to run logic based on both IP and port rather than being limited to port alone. Yet it's not worth the inconvenience/danger of running as root to operate with RAW sockets.
- lathiat 5y ago
  While I don't knwo the actual answer, a good place to look may be one of the eBPF load balancers like "Katran" from Facebook. I imagine it's needing to do that sort of thing. But no idea if it's attaching at the same level. I haven't really explained eBPF outside of tracing. https://github.com/facebookincubator/katran https://github.com/facebookincubator/katran
  - tptacek 5y ago
    Katran is XDP. The XDP eBPF hooks get packets before they hit the TCP/IP stack --- you can use XDP to route packets without ever creating skbuffs for them. The previous commenter is explicitly trying to use socket eBPF code, because they don't want their code to have to run as root. Katran won't be helpful for them.
daniel_rh 5y ago
Does anyone have experience with eBPF on aarch64? How well is it supported? On what kernel revisions was it phased in and well tested there?
- monocasa 5y ago
  It's as well supported as x86 these days. It's was phased in somewhere around 2014.
zamadatix 5y ago
Is eBPF directly able to perform simple modifications of the data or only analyze and customize forwarding? E.g. if I had a custom packet encapsulation format I wanted to remap into another encapsulation format of a similar type I'm pretty sure I can use XDP to forward packets that match a userspace program which can then zero-copy modify the contents but at that point it seems to have lost a lot of the luster compared to a kernel module as I'm hopping back and forth between kernelspace and userspace. I'm not sure if that is a limitation of just reading about XDP a lot because dropping packets/load balancing is more popular and I just need to look elsewhere in eBPF or if it's actually a limitation of eBPF itself.
- sophacles 5y ago
  Yes you can do modifications. (simple and not so simple!). For encapsulation you may want to look into lightweight tunnels. General transformation also often happens in the tc subsystem. The available documentation isn't that great yet, but there's good links in the OP about this.
- tptacek 5y ago
  We use XDP for our UDP forwarding data path, encapsulating and decapsulating packets along the way in a custom frame: https://fly.io/blog/bpf-xdp-packet-filters-and-udp/ https://fly.io/blog/bpf-xdp-packet-filters-and-udp/
  - kasey_junk 5y ago
    Do you ever worry about issues with your hosting company? Like missing out on router optimizations and the like on the underlying network because of your bespoke framing?
    - tptacek 5y ago
      Well, I wasn't a minute ago.
      - kasey_junk 5y ago
mike_d 5y ago
eBPF is amazing because it has such a broad scope and is relatively simple to implement. I'd recommend anyone interested in a starting point look at ebpfkit, the eBPF rootkit. https://github.com/Gui774ume/ebpfkit https://github.com/Gui774ume/ebpfkit

59 points by GordonS 5y ago

Based on the hype around eBPF, you'd think it was a new JS framework. I suspect that it's hype will dwindle as people realize that it's mostly invisible to them. Just pay for <random monitoring solution> and it'll plug into eBPF, without you having to say the words e, b, or even pf.

sophacles 5y ago
What if I also do networking on my computer? Will my monitoring solution magically do packet manipulation without my input? eBPF is not just for monitoring.
tptacek 5y ago
There's no programming environment you can't say this about.
pclmulqdq 5y ago
eBPF has basically democratized the performance that used to be reserved for DPDK applications and other weird user space things. It's a big deal.

daniel_rh 5y ago

I was just experimenting with eBPF and ran into a limitation: Is there a way to load the source IP into a register when working in userspace? When I SO_ATTACH_BPF to a SOCK_DGRAM it only makes the udp header accessible, per https://github.com/danielrh/bpf_buffer_per_source/blob/main/limited_per_source.c https://github.com/danielrh/bpf_buffer_per_source/blob/main/... I would love to be able to run logic based on both IP and port rather than being limited to port alone. Yet it's not worth the inconvenience/danger of running as root to operate with RAW sockets.

lathiat 5y ago
While I don't knwo the actual answer, a good place to look may be one of the eBPF load balancers like "Katran" from Facebook. I imagine it's needing to do that sort of thing. But no idea if it's attaching at the same level. I haven't really explained eBPF outside of tracing. https://github.com/facebookincubator/katran https://github.com/facebookincubator/katran
- tptacek 5y ago
  Katran is XDP. The XDP eBPF hooks get packets before they hit the TCP/IP stack --- you can use XDP to route packets without ever creating skbuffs for them. The previous commenter is explicitly trying to use socket eBPF code, because they don't want their code to have to run as root. Katran won't be helpful for them.

daniel_rh 5y ago

Does anyone have experience with eBPF on aarch64? How well is it supported? On what kernel revisions was it phased in and well tested there?

monocasa 5y ago
It's as well supported as x86 these days. It's was phased in somewhere around 2014.

zamadatix 5y ago

Is eBPF directly able to perform simple modifications of the data or only analyze and customize forwarding? E.g. if I had a custom packet encapsulation format I wanted to remap into another encapsulation format of a similar type I'm pretty sure I can use XDP to forward packets that match a userspace program which can then zero-copy modify the contents but at that point it seems to have lost a lot of the luster compared to a kernel module as I'm hopping back and forth between kernelspace and userspace. I'm not sure if that is a limitation of just reading about XDP a lot because dropping packets/load balancing is more popular and I just need to look elsewhere in eBPF or if it's actually a limitation of eBPF itself.

sophacles 5y ago
Yes you can do modifications. (simple and not so simple!). For encapsulation you may want to look into lightweight tunnels. General transformation also often happens in the tc subsystem. The available documentation isn't that great yet, but there's good links in the OP about this.
tptacek 5y ago
We use XDP for our UDP forwarding data path, encapsulating and decapsulating packets along the way in a custom frame: https://fly.io/blog/bpf-xdp-packet-filters-and-udp/ https://fly.io/blog/bpf-xdp-packet-filters-and-udp/
- kasey_junk 5y ago
  Do you ever worry about issues with your hosting company? Like missing out on router optimizations and the like on the underlying network because of your bespoke framing?
  - tptacek 5y ago
    Well, I wasn't a minute ago.
    - kasey_junk 5y ago

mike_d 5y ago

eBPF is amazing because it has such a broad scope and is relatively simple to implement. I'd recommend anyone interested in a starting point look at ebpfkit, the eBPF rootkit. https://github.com/Gui774ume/ebpfkit https://github.com/Gui774ume/ebpfkit