eBPF Guide

TL;DR

EBPF allows insertion of bytecode in Linux kernel at runtime at various hookpoints. On insertion, the bytecode is vetted through a kernel verifier such that only instruction-set which fulfills certain constraints are allowed.

This tutorial will help you to build a sample ebpf programs and get familiarized with the tool set. For more info, you will find curated list of ebpf articles here.

Setting up env

ebpf depends on kernel-headers (most of the practical use-cases) and in my samples I use utility libbpf which is shipped as part of the kernel code. The compilation env depends on kernel source to be present/compiled successfully.

You can use your own method to get the kernel and compile it. However, this is what I do (and I usually experiment in a VM env):

1. Go to kernel.org and download a longterm kernel source/tarball.

2. Prepare the kernel:

   sudo apt-get install libncurses-dev flex bison openssl libssl-dev \
                dkms libelf-dev libudev-dev libpci-dev libiberty-dev \
                autoconf binutils-dev
   cd $SRC #SRC=Kernel base folder
   make defconfig
   # Make sure you have BPF enabled in the generated .config, on my system I have following
   CONFIG_CGROUP_BPF=y
   CONFIG_BPF=y
   CONFIG_BPF_SYSCALL=y
   CONFIG_BPF_JIT_ALWAYS_ON=y
   CONFIG_IPV6_SEG6_BPF=y
   CONFIG_NETFILTER_XT_MATCH_BPF=m
   CONFIG_BPFILTER=y
   CONFIG_BPFILTER_UMH=m
   CONFIG_NET_CLS_BPF=m
   CONFIG_NET_ACT_BPF=m
   CONFIG_BPF_JIT=y
   CONFIG_BPF_STREAM_PARSER=y
   CONFIG_LWTUNNEL_BPF=y
   CONFIG_HAVE_EBPF_JIT=y
   CONFIG_BPF_EVENTS=y
   CONFIG_BPF_KPROBE_OVERRIDE=y
   CONFIG_TEST_BPF=m

3. Compile the kernel:

   make -j $(nproc)
   sudo make modules_install
   sudo make headers_install
   sudo make install

4. Compile bpf related libs

cd $SRC #SRC=Kernel base folder
make -C samples/bpf
make -C tools/lib/bpf   #Compiles libbpf.a

5. Compile ebpf guide

cd ebpf-guide && make KRNDIR=$SRC where $SRC is kernel base dir

Note these steps were performed using linux-5.4.39.

FAQs

• eBPF vs kernel module
• GPL license and eBPF

Problem Statements:

Problem statement	Hookpoint	Loader
Block TCP port 8080	XDP	iproute2
Drop spoofed packets from local socks	tc-egress	tc
Localhost Network Bypass	sockops, strparser	libbpf