The eBPF Ecosystem: Tools, Frameworks, and Production Solutions#

1
// Simplified Katran logic
2
SEC("xdp")
3
int katran_lb(struct xdp_md *ctx) {
4
    void *data_end = (void *)(long)ctx->data_end;
5
    void *data = (void *)(long)ctx->data;
6

7
    // Parse headers
8
    struct parsing_context pctx = {};
9
    if (parse_packet(data, data_end, &pctx) < 0)
10
        return XDP_PASS;
11

12
    // Lookup VIP
13
    struct vip_key vkey = {
14
        .address = pctx.dst,
15
        .port = pctx.port,
16
        .proto = pctx.proto
17
    };
18

19
    struct vip_meta *vmeta = bpf_map_lookup_elem(&vip_map, &vkey);
20
    if (!vmeta)
21
        return XDP_PASS;
22

23
    // Select real server
24
    __u32 hash = get_packet_hash(&pctx);
25
    __u32 real_idx = hash % vmeta->num_reals;
26

27
    // Encapsulate and forward
28
    return encap_and_forward(ctx, real_idx);
29
}

1
# TracingPolicy example
2
apiVersion: cilium.io/v1alpha1
3
kind: TracingPolicy
4
metadata:
5
  name: file-monitoring
6
spec:
7
  kprobes:
8
    - call: "security_file_open"
9
      syscall: false
10
      args:
11
        - index: 0
12
          type: "file"
13
      selectors:
14
        - matchArgs:
15
            - index: 0
16
              operator: "Equal"
17
              values:
18
                - "/etc/passwd"
19
                - "/etc/shadow"
20
          matchActions:
21
            - action: Sigkill

1
//go:generate go run github.com/cilium/ebpf/cmd/bpf2go counter counter.c
2

3
package main
4

5
import (
6
    "log"
7
    "github.com/cilium/ebpf/link"
8
    "github.com/cilium/ebpf/rlimit"
9
)
10

11
func main() {
12
    // Remove memory limit
13
    if err := rlimit.RemoveMemlock(); err != nil {
14
        log.Fatal(err)
15
    }
16

17
    // Load pre-compiled programs
18
    spec, err := loadCounter()
19
    if err != nil {
20
        log.Fatal(err)
21
    }
22

23
    coll, err := ebpf.NewCollection(spec)
24
    if err != nil {
25
        log.Fatal(err)
26
    }
27
    defer coll.Close()
28

29
    // Attach to tracepoint
30
    tp, err := link.Tracepoint("syscalls", "sys_enter_open",
31
                                coll.Programs["count_open"])
32
    if err != nil {
33
        log.Fatal(err)
34
    }
35
    defer tp.Close()
36
}

1
#![no_std]
2
#![no_main]
3

4
use aya_bpf::{
5
    macros::{kprobe, map},
6
    maps::HashMap,
7
    programs::ProbeContext,
8
};
9

10
#[map]
11
static mut COUNTS: HashMap<u32, u64> = HashMap::with_max_entries(1024, 0);
12

13
#[kprobe(name="count_opens")]
14
pub fn count_opens(ctx: ProbeContext) -> u32 {
15
    match try_count_opens(ctx) {
16
        Ok(ret) => ret,
17
        Err(ret) => ret,
18
    }
19
}
20

21
fn try_count_opens(ctx: ProbeContext) -> Result<u32, u32> {
22
    let pid = ctx.pid();
23

24
    unsafe {
25
        let count = COUNTS.get(&pid).unwrap_or(&0);
26
        COUNTS.insert(&pid, &(count + 1), 0)?;
27
    }
28

29
    Ok(0)
30
}

1
graph TD
2
    A[What do you need?] --> B{Type}
3
    B --> C[Debugging/Analysis]
4
    B --> D[Production System]
5
    B --> E[Security]
6

7
    C --> F{Complexity}
8
    F --> G[Simple] --> H[bpftrace]
9
    F --> I[Complex] --> J[BCC]
10

11
    D --> K{Domain}
12
    K --> L[Networking] --> M[Cilium/Calico]
13
    K --> N[Observability] --> O[Pixie/Parca]
14
    K --> P[Custom] --> Q[libbpf]
15

16
    E --> R{Focus}
17
    R --> S[Detection] --> T[Falco]
18
    R --> U[Enforcement] --> V[Tetragon]