Mastering eBPF Kernel Socket Filters (3358)

Technical Overview

eBPF socket filters (program type BPF_PROG_TYPE_SOCKET_FILTER, kernel ID 3358) attach directly to a socket via setsockopt(SO_ATTACH_BPF), enabling programmable packet filtering at the earliest possible hook in the network stack—before skb allocation for ingress and after skb construction for egress. This eliminates the overhead of traditional AF_PACKET or XDP paths for socket-local traffic, making them ideal for per-application traffic shaping, TLS record inspection, and zero-copy userspace delivery.

Verifier Constraints & Instruction Budget

The verifier enforces a strict 4096 instruction limit (configurable via bpf_jit_limit) and forbids loops unless bounded by BPF_MAP_TYPE_ARRAY iteration helpers. Socket filters run in BPF_PROG_TYPE_SOCKET_FILTER context, receiving a struct __sk_buff * with limited field access: len, protocol, mark, vlan_present, vlan_tci, and payload via bpf_skb_load_bytes(). Direct memory access to skb->data is prohibited; all loads must use helpers to preserve memory safety.

JIT Compilation & Hardware Offload

On x86_64, arm64, and s390x the JIT emits native instructions with tail-call optimization for chained filters. Since Linux 5.10, BPF_F_OFFLOAD flag enables SmartNIC offload (e.g., Netronome NFP, Mellanox BlueField) where the filter runs entirely in the NIC firmware, bypassing host CPU. Votion Cloud's benchmark suite shows 3.2M pps/core for JITted filters vs 1.1M pps for interpreted, and 12M pps with NFP offload at 64-byte frames.