eBPF Learning with C

This repository contains eBPF learning exercises and projects written in C, with a focus on packet filtering.

📚 About eBPF

eBPF (extended Berkeley Packet Filter) is a powerful technology in the Linux kernel that allows running sandboxed programs in kernel space without changing kernel code or loading kernel modules.

🔧 Installing Dependencies

Ubuntu/Debian

sudo apt update
sudo apt install -y \
    clang \
    llvm \
    libelf-dev \
    libbpf-dev \
    linux-headers-$(uname -r) \
    build-essential \
    gcc-multilib

Fedora/RHEL/CentOS

sudo dnf install -y \
    clang \
    llvm \
    elfutils-libelf-devel \
    libbpf-devel \
    kernel-devel \
    make \
    gcc

Arch Linux

sudo pacman -S \
    clang \
    llvm \
    libelf \
    libbpf \
    linux-headers \
    base-devel

Verify Installation

To ensure the tools are correctly installed:

clang --version
llc --version

🚀 Running the Programs

Each project has its own Makefile. To run any program:

1. Compile

cd <directory-name>
make

This command compiles both the eBPF and user-space files.

2. Run the Program

sudo ./program-name

Note: Running eBPF programs requires root access.

3. Clean Build Files

make clean

📁 Project Structure

.
├── example1/
│   ├── Makefile
│   ├── program.c          # User-space code
│   └── program_kern.c     # eBPF kernel code
├── example2/
│   ├── Makefile
│   ├── ...
└── README.md

🔍 Available Examples

Packet Filtering

These projects demonstrate how to filter network packets:

• Basic Packet Filter: Simple filtering based on protocol
• IP Filter: Filtering based on IP address
• Port Filter: Filtering based on port numbers

🛠️ Important Notes

Required Permissions

• Programs must be run with sudo
• Linux kernel must support eBPF (version 4.4 or higher)

Debugging

To view eBPF logs:

sudo cat /sys/kernel/debug/tracing/trace_pipe

View Loaded Programs

sudo bpftool prog list
sudo bpftool map list

📖 Learning Resources

• eBPF Official Documentation
• BPF and XDP Reference Guide
• Linux Kernel BPF Documentation

🤝 Contributing

This is a personal learning project, but suggestions and improvements are welcome!

⚠️ Warning

These programs are for educational purposes only. Make sure to run thorough tests before using in production environments.

📝 License

This project is released under the MIT License.

---

Note: If you encounter any issues with installation or execution, make sure your kernel supports eBPF:

uname -r  # Should be 4.4 or higher