times to repeat – Control input data and/or context. Examine output data/context. – Use cases: – Unit testing – Debugging bpftool prog run Program Type Input Data Input Context Output Data Output

size? eBPF filter-reduce 14 Filter Reduce input Result https://github.com/giuliafrascaria/ebpf-data-filter eBPF filter-reduce 15 If x > 5 max() input Result https://github.com/giuliafrascaria/ebpf-data-filter bpf-data-filter eBPF filter-reduce 16 If x == 5 count() input Result https://github.com/giuliafrascaria/ebpf-data-filter Promising, but not ready yet ● Ideally, same powers as networking stack ●

accessed am address!\\n"); return 0; } """ b = BPF(text=bpf_text) symbol_addr = input() pid = input() bp_type = input() b.attach_breakpoint(symbol_addr, pid, "func", bp_type) 03 breakpoint.py Output

Endpoint to Endpoint Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Egress Policy CILIUM_POST_* Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Ingress Policy bpf_netdev Cluster/World Overlay Mode (VXLAN, Geneve configured for intra-cluster traffic) Userspace Proxy INPUT PREROUTING OUTPUT POSTROUTING L7 Policy Key Direction of traffic CILIUM_FORWARD bpf_netdev TC @ cilium_host Userspace Proxy bpf_lxc TC @ Endpoint PREROUTING INPUT OUTPUT POSTROUTING CILIUM_POST_* L7 Policy bpf_netdev TC@cilium_host Key

Endpoint to Endpoint Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Egress Policy CILIUM_POST_* Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Ingress Policy bpf_netdev PREROUTING FORWARD CILIUM_FORWARD bpf_netdev TC @ cilium_host Userspace Proxy bpf_lxc PREROUTING INPUT L7 Policy Key Direction of traffic Optional feature KUBE-SEP-1 -s 10.233.67.32/32 -j KUBE-MARK-MASQ -p tcp -m tcp -j DNAT --to-destination 10.233.67.32:53 INPUT KUBE-SERVICES KUBE-FIREWALL FORWARD (filter) KUBE-FORWARD CILIUM_FORWARD KUBE-FIREWALL -m mark

147 direct1 Direct --- down 10:53:40.147 Channel ipv4 State: DOWN Input filter: ACCEPT Output filter: REJECT ... Basic configuration It’s hard to discuss bird configurations Endpoint to Endpoint Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Egress Policy CILIUM_POST_* Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Ingress Policy bpf_netdev PREROUTING FORWARD CILIUM_FORWARD bpf_netdev TC @ cilium_host Userspace Proxy bpf_lxc PREROUTING INPUT L7 Policy Key Direction of traffic Optional feature

147 direct1 Direct --- down 10:53:40.147 Channel ipv4 State: DOWN Input filter: ACCEPT Output filter: REJECT ... Basic configuration It’s hard to discuss bird configurations KUBE-SEP-1 -s 10.233.67.32/32 -j KUBE-MARK-MASQ -p tcp -m tcp -j DNAT --to-destination 10.233.67.32:53 INPUT KUBE-SERVICES KUBE-FIREWALL FORWARD (filter) KUBE-FORWARD CILIUM_FORWARD KUBE-FIREWALL -m mark Endpoint to Endpoint Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Egress Policy CILIUM_POST_* Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Ingress Policy bpf_host TC

147 direct1 Direct --- down 10:53:40.147 Channel ipv4 State: DOWN Input filter: ACCEPT Output filter: REJECT ... Basic configuration It’s hard to discuss bird configurations Endpoint to Endpoint Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Egress Policy CILIUM_POST_* Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Ingress Policy bpf_host TC PREROUTING FORWARD CILIUM_FORWARD bpf_host TC @ cilium_host Userspace Proxy bpf_lxc PREROUTING INPUT L7 Policy Key Direction of traffic Optional feature

147 direct1 Direct --- down 10:53:40.147 Channel ipv4 State: DOWN Input filter: ACCEPT Output filter: REJECT ... Basic configuration It’s hard to discuss bird configurations Endpoint to Endpoint Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Egress Policy CILIUM_POST_* Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Ingress Policy bpf_host TC PREROUTING FORWARD CILIUM_FORWARD bpf_host TC @ cilium_host Userspace Proxy bpf_lxc PREROUTING INPUT L7 Policy Key Direction of traffic Optional feature

147 direct1 Direct --- down 10:53:40.147 Channel ipv4 State: DOWN Input filter: ACCEPT Output filter: REJECT ... Basic configuration It’s hard to discuss bird configurations Endpoint to Endpoint Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Egress Policy CILIUM_POST_* Userspace Proxy PREROUTING INPUT OUTPUT POSTROUTING L7 Ingress Policy bpf_host TC PREROUTING FORWARD CILIUM_FORWARD bpf_host TC @ cilium_host Userspace Proxy bpf_lxc PREROUTING INPUT L7 Policy Key Direction of traffic Optional feature