Documentation
¶
Overview ¶
Package ebpf provides an eBPF-based IPv4 IPID tagger for Linux.
The eBPF program (tagger.c) is compiled at build time into a Go byte-slice via bpf2go and loaded at runtime via cilium/ebpf. It attaches to the TC egress hook on a named network interface.
Key architecture:
- The Go-side KeyManager periodically updates a BPF hash map with the current per-measurement authentication key (ak).
- The eBPF program reads ak from the map, runs SipHash-2-4 over the packet, and writes the 16-bit result into the IPv4 IPID field.
- The Linux kernel's BPF_F_RECOMPUTE_CSUM flag causes the checksum to be updated in-place, so no userspace checksum fix is needed.
Performance comparison ¶
Use the benchmark in bpf_linux_test.go to compare eBPF vs the pure-Go tagger at different packet rates.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CleanupError ¶
CleanupError projects constructor rollback failures without treating the initialization error itself as a cleanup failure. It is available on every platform so the parent constructor can retain the same ownership contract.
Types ¶
type BPFTagger ¶
type BPFTagger struct {
// Attachment names how the program is attached: "tcx", or "tc" for the
// legacy clsact filter used where the kernel has no TCX.
Attachment string
// contains filtered or unexported fields
}
BPFTagger loads, attaches, and manages the eBPF packet tagger. It implements tagger.TaggerInterface (eBPF side) and exposes a KeyManager for periodic key updates.
func NewBPFTagger ¶
func NewBPFTagger(logger *zap.Logger, iface *net.Interface, schedule *tesla.KeySchedule, measurementID []byte) (*BPFTagger, error)
NewBPFTagger loads the compiled eBPF object, attaches the TC egress program to iface, and starts the key-update goroutine.
The caller must call Close() when done to detach the program and release BPF resources.
func (*BPFTagger) Schedule ¶
func (bt *BPFTagger) Schedule() *tesla.KeySchedule
Source Files