Deep Dive: eBPF Kernel Socket Filters (8418)

Technical Overview

Engineering breakdown of Deep Dive: eBPF Kernel Socket Filters (8418). Bare-metal hardware performance requires isolated kernel parameters, zero-copy packet processing, and deterministic latency profiles. This commit introduces a refined socket filter subsystem leveraging eBPF's JIT-compiled bytecode to enforce policy at the earliest possible hook—sk_filter—bypassing traditional netfilter overhead.

Architecture & Data Path

The filter attaches to struct sock via SO_ATTACH_BPF, executing in the context of the receiving CPU. Each packet traverses:

1. __skb_run_filter – JIT-compiled eBPF program evaluates match criteria.
2. Verdict: SK_PASS, SK_DROP, or SK_REDIRECT (via bpf_redirect_map).
3. XDP integration for pre-stack drop/redirect, reducing per-packet cycles by ~40%.

Key Innovations in 8418

• Per-CPU LRU maps for connection tracking state, eliminating lock contention.
• Bounded tail calls enabling modular policy chains (max 32 segments).
• Verifier enhancements allowing bounded loops for complex header parsing (TCP options, QUIC frames).
• Socket cookie correlation for userspace telemetry without perf_event overhead.

Production Hardening Checklist

# Kernel config
CONFIG_BPF_JIT_ALWAYS_ON=y
CONFIG_BPF_STREAM_PARSER=y
CONFIG_NET_CLS_BPF=y
# Runtime limits
sysctl -w net.core.bpf_jit_limit=256M
sysctl -w net.core.bpf_jit_harden=2
# Verifier log for CI
echo 1 > /sys/kernel/debug/bpf/verifier_log_level