eBPF
251 items from zoidbergwill/awesome-ebpf ★5,181
-
Falco falco.org
A cloud-native runtime security project used as a Kubernetes threat detection engine.
-
Cilium cilium.io
project (GitHub repository) is a technology relying on eBPF and XDP to provide "fast in-kernel networking and security policy enforcement for containers based on eBPF programs generated on the fly". Many presentations available (with overlap):
-
LLVM llvm.org
Contains several tools used in eBPF workflows. Snapshots of the latest versions for Ubuntu/Debian can be retrieved from here.
-
-
-
bpfilter: Linux firewall with eBPF sauce qmo.fr
Slides from a talk by Quentin Monnet with a background on eBPF and comparing bpfilter to iptables.
-
Why is the kernel community replacing iptables with BPF? cilium.io
A blog post by Cilium on the motivations behind eBPF and bpfilter, with a couple examples and links to other projects using eBPF and bpfilter.
-
Cilium's BPF and XDP Reference Guide docs.cilium.io
In-depth documentation about most features and aspects of eBPF.
-
Dive into BPF: A List of Reading Material qmonnet.github.io
-
IO Visor's bcc documentation github.com
-
The netdev mailing list lists.openwall.net
Mailing list for Linux kernel networking stack development. All patches are sent there for review and inclusion.
-
-
The bpf-next tree git.kernel.org
BPF patches land in this tree. It is regularly merged into net-next, which is itself merged for each release to Linus' tree.
-
linux/net/core/dev.c git.kernel.org
contains the function dev_change_xdp_fd() that is called through a Netlink command to hook a XDP program to a device, after is has been loaded into the kernel from user space. This function in turns uses a callback from the relevant driver.
-
linux/kernel/seccomp.c git.kernel.org
-
linux/net/sched/ git.kernel.org
and in particular in files act_bpf.c (action) and cls_bpf.c (filter): code related to BPF actions and filters with TC.
-
linux/arch/x86/net/bpf_jit_comp.c git.kernel.org
for x86. Exception is made for JIT compilers used for hardware offload, sitting in their drivers, such as linux/drivers/net/ethernet/netronome/nfp/bpf/jit.c for Netronome NFP.
-
linux/kernel/trace/bpf_trace.c git.kernel.org
Functions and eBPF helpers related to tracing and monitoring (kprobes, tracepoints, etc.).
-
linux/net/core/filter.c git.kernel.org
Functions and eBPF helpers related to networking (TC, XDP etc.); also contains the code to migrate cBPF bytecode to eBPF (all cBPF programs are translated to eBPF in recent kernels).
-
-
-
syscall.c git.kernel.org
Different operations permitted by the system call, such as program loading or map management.
-
linux/kernel/bpf/ git.kernel.org
This directory contains most of BPF-related code. In particular, those files are worth of interest:
-
linux/include/linux/filter.h git.kernel.org
with linux/include/uapi/filter.h: information used to run the BPF programs themselves.
-
linux/include/linux/bpf.h git.kernel.org
with linux/include/uapi/bpf.h: definitions related to eBPF, to be used respectively in the kernel and to interface with userspace programs.
-
Blackhat 2021: With Friends Like eBPF, Who Needs Enemies? blackhat.com
Talk about an eBPF rootkit and how the capabilities of eBPF could be abused. The rootkit was also the object of a talk at Defcon, eBPF, I thought we were friends !.
-
eBPF: Block Linux Fileless Payload "Malware" Execution with BPF LSM djalal.opendz.org
Blog post about how BPF can help detection and blocking fileless malware.
-
Embrace The Red: Offensive BPF! embracethered.com
A series of posts around the introduction into BPF with a focus to an offensive setting, and also how its misuse can be detected. Posts include discussions on the rootkit capabilities of eBPF, or on which tracing type is needed for different use cases.
-
-
inspektor-gadget inspektor-gadget.io
A collection tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF.
- next page of items loading…
