Skip to content

daemon: support Linux eBPF socket filters with new net.bpf_set(fd) and net.bpf_clear() bindings

Alex Forster requested to merge alexforster/so-attach-bpf into master

This change implements two new Lua bindings on the net module which allow Linux users to attach/detach loaded eBPF socket filters to Knot's active sockets.

In pseudocode, the implementation is essentially–

function net.bpf_set(bpffd)  -- bpffd: file descriptor of a loaded eBPF socket filter
    for endpoint in endpoints do
        sockfd = uv_fileno(endpoint)  -- sockfd: file descriptor of a listening socket
        setsockopt(sockfd, SOL_SOCKET, SO_ATTACH_BPF, bpffd, sizeof(int))
    end
end

function net.bpf_clear()
    for endpoint in endpoints do
        sockfd = uv_fileno(endpoint)  -- sockfd: file descriptor of a listening socket
        setsockopt(sockfd, SOL_SOCKET, SO_DETACH_BPF, NULL, 0)
    end
end

My intention is to make the smallest number of core changes needed to support eBPF socket filters with Knot. I do not provide a mechanism for loading eBPF programs, accessing maps, or pinning objects to bpffs, since I believe those operations are more appropriate for modules.

Edited by Alex Forster

Merge request reports