Introduction to eBPF
- 1. Introduction to eBPF Network Applications Roger Coll - 3/12/2020 Universitat Politècnica de Catalunya
- 2. Linux Kernel ◉ Free and open-source ◉ Modular ◉ Multitasking ◉ Monolithic ◉ Written in C About 33% of web servers use Linux as OS !
- 3. Monolithic Kernel - The entire OS is working in the Kernel space - All OS code runs in privileged mode - High performance, but higher risk for system crash
- 5. What is BPF? Berkeley Packet Filter is a small virtual machine that can run programs injected from the user space in the kernel space without changing/recompiling the kernel code. - First implementation (BPF) => Linux Kernel 3.15 (1992) - Better known as the packet filter language for tcpdump
- 7. Any benefit? - Avoids copying unwanted packets from the OS to the process/user space. Huge impact on performance
- 8. So… what is eBPF? - Extended Berkeley Packet Filter - Fast and safe, in-kernel, register based, bytecode VM - Linux Kernel 3.18 (2014) Run code in the kernel without having to write a kernel module.
- 9. BPF eBPF - 32-bit - Fixed length instructions - One accumulator - One index register Arithmetic operations on the packets data, compare and decide (accept/reject) - 64-bit - 512 byte stack - Maps (key/value) Wide range of applications
- 10. eBPF features - Much more than just filtering packets - bpf() syscall => run program developed in user space in the kernel C (limited) eBPF (Bytecode) Machine code Kernel JIT compiler
- 12. Hello World + Kprobes example
- 13. Time to rethink the Kernel
- 14. From monolithic to microkernel or kernel with microservices
- 16. Network use cases - SDN configuration - DDos mitigation (cloudflare) - Intrusion detection - Network security at application layer => Cilium k8s - Load balancing (facebook data centers) - Servers performance
- 17. Iptables has not been designed for micro services