Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An eBPF loophole: Using XDP for egress traffic

loopholelabs.io

Post reply on HN
Print view View original

51–60 of 81 posts

Re: An eBPF loophole: Using XDP for egress traffic

#51

Post by tptacek »

shivanshvij wrote: post #42
cptnntsoobv wrote: post #39

XDP, and the eBPF ecosystem in general, is quite neat. However, a word of caution: * The BPF verifier's DX is not great yet. If it finds problems with your BPF code it will spit our a rather inscrutable set of error messages that often requires a good understanding of the verifier internals (e.g the register nomenclature) to debug * For the same source code, the code generated by the verifier can change across compil…

We absolutely ran into these issues. A couple notes that help quite a bit: 1. Always build the eBPF programs in a container - this is great for reproducibility of course, but also makes DevX on MacOS better for those who prefer to use that. 2. You actually can do a full checksum! You need to limit the MTU but you can: static __always_inline void tcp_checksum(const struct iphdr *ip_header, struct tcphdr *tcp_header, c…

Different kernels will be different levels of fussy about the bounded loop you're using there. Bounded loops are themselves a relatively recent feature.

Of course, checksum fixups in eBPF are idiomatically incremental.

Re: An eBPF loophole: Using XDP for egress traffic

#53

Post by [deleted] »

cortesoft wrote: post #36
tptacek wrote: post #5

From 2022: https://www.samd.is/2022/06/13/egress-XDP.html You can also use XDP for outgoing packets for tap interfaces.

This is why I am always skeptical when anyone writes that they are the first to do something… the added caveat is always, “that we know of”

[deleted]

Re: An eBPF loophole: Using XDP for egress traffic

#54

Post by HeWhoLurksLate »

cortesoft wrote: post #36
tptacek wrote: post #5

From 2022: https://www.samd.is/2022/06/13/egress-XDP.html You can also use XDP for outgoing packets for tap interfaces.

This is why I am always skeptical when anyone writes that they are the first to do something… the added caveat is always, “that we know of”

in engineering there's also the "first unclassified attempt" stuff too

Re: An eBPF loophole: Using XDP for egress traffic

#56

Post by andrepd »

cptnntsoobv wrote: post #39

XDP, and the eBPF ecosystem in general, is quite neat. However, a word of caution: * The BPF verifier's DX is not great yet. If it finds problems with your BPF code it will spit our a rather inscrutable set of error messages that often requires a good understanding of the verifier internals (e.g the register nomenclature) to debug * For the same source code, the code generated by the verifier can change across compil…

openonload is faster than the kernel even with the most basic configuration, which is pretty much drop-in and requires zero changes on your application.

Re: An eBPF loophole: Using XDP for egress traffic

#57

Post by joshstrange »

cachius wrote: post #50
joshstrange wrote: post #46

For some reason at above 1600px wide the content starts to shrink and become unreadable. Video: https://cs.joshstrange.com/Zhxk4kRp

Awesome that you have a set up that allows you to record and share and then also do it!

CleanShotX [0] is what I used. Honestly the cloud hosting aspect is overpriced but it does make sharing a picture/video super easy for cases like this. I know macOS has annotation tools built-in for screenshots but CleanShotX's tools are about 1 billion times faster/easier to use. I use this tool all the time just to take a quick screenshot, add some arrows/circles/text/numbers and send it off.

Not affiliated in any way, just a big fan of any tool that lets me quickly explain or document something. I'd say about 99% of bug tickets I enter into our ticketing tool have a CleanShotX screenshot attached (or video).

Here is an example of a handful of the tools (numbers, text, boxes, arrows, highlight area, and redact): https://cs.joshstrange.com/kSpsv7DG

[0] https://cleanshot.com/

Re: An eBPF loophole: Using XDP for egress traffic

#58

Post by joshstrange »

shivanshvij wrote: post #55
joshstrange wrote: post #46

For some reason at above 1600px wide the content starts to shrink and become unreadable. Video: https://cs.joshstrange.com/Zhxk4kRp

Wow thank for the recording! We were able to push out a fix, should be workin g now!

No problem, happy to help and thank you for fixing it! It works perfectly now.

Re: An eBPF loophole: Using XDP for egress traffic

#59

Post by tptacek »

joshstrange wrote: post #57
cachius wrote: post #50

Earlier quoted context omitted.

Awesome that you have a set up that allows you to record and share and then also do it!

CleanShotX [0] is what I used. Honestly the cloud hosting aspect is overpriced but it does make sharing a picture/video super easy for cases like this. I know macOS has annotation tools built-in for screenshots but CleanShotX's tools are about 1 billion times faster/easier to use. I use this tool all the time just to take a quick screenshot, add some arrows/circles/text/numbers and send it off. Not affiliated in any…

CleanShot X is extremely good, in case anyone is looking for more endorsements.

Re: An eBPF loophole: Using XDP for egress traffic

#60

Post by tptacek »

cortesoft wrote: post #36
tptacek wrote: post #5

From 2022: https://www.samd.is/2022/06/13/egress-XDP.html You can also use XDP for outgoing packets for tap interfaces.

This is why I am always skeptical when anyone writes that they are the first to do something… the added caveat is always, “that we know of”

"Who did it first" is not interesting to me, but what they're doing isn't a "loophole"; that's all I'm concerned with.
Post reply on HN