4 ms·
Is it possible to do stateful stuff like NAT in eBPF without having to reimplement conntrack? I think cilium does it but has to reimplement in using maps.
by nimish 5y ago
Is it possible to do stateful stuff like NAT in eBPF without having to reimplement conntrack? I think cilium does it but has to reimplement in using maps.
- ilovecaching 5y agoNot in an XDP program, it runs almost immediately after a packet has been rxed, and yes, Cilium does this by reimplementing similar logic in BPF. You could request new helpers for a SCHED_CLS type program though. The helpers don't exist today, but eBPF is use case driven, and if there is a good use case for it, it can go onto the roadmap.
- nimish 5y agoThanks! I did find this: https://lists.linuxfoundation.org/pipermail/iovisor-dev/2017-September/001023.html https://lists.linuxfoundation.org/pipermail/iovisor-dev/2017... and some references to bpf_skb_ct_lookup/bpf_xdp_ct_lookup -- are these fully baked?