Can We Really Parse DNS in eBPF? Improving Cilium ToFQDN With In-kernel Policy Upda...
summary
Claims DNS can be fully parsed in-kernel to make Cilium ToFQDN policy proxyless: implementation uses eBPF SKSKB-based sock ops to capture TCP sockets, a stream parser to read the two‑byte TCP length, and a stream verdict program with bounded BPF loops to parse multiple answers and handle compression heuristically. Identities are preallocated into a BPF map, the parser updates the node IP cache directly, and DNS over TCP truncation is handled without a userspace proxy.
AI-written summary · about
chapters (26)
- 0:00eBPF DNS parsing in Cilium
- 1:04FQDN policy limits in Cilium
- 2:52How Cilium intercepts DNS
- 4:17DNS proxy architecture issues
- 4:58DNS proxy high availability
- 6:25Why parse DNS in eBPF
- 8:13DNS wire protocol basics
- 10:19Parsing domain names in DNS
- 11:23DNS label compression impact
- 12:50DNS header RFC 9619
- 13:53DNS parsing assumptions
- 14:36BPF loop evolution
- 15:20BPF loop helper for DNS
- 16:01TCP DNS truncation handling
- 16:42SKSKB BPF for TCP DNS
- 17:25Socket tracking with sock ops
- 18:09Stream parser BPF program
- 18:51Stream verdict BPF program
- 19:34Updating IP cache with DNS
- 20:37Live demo eBPF DNS parsing
- 23:56Tracing DNS parsing with BPF
- 24:39Policy enforcement testing
- 25:00Next steps and improvements
- 26:26Q&A: Metrics and hijacking
- 27:33Q&A: Visibility and security
- 28:15Q&A: IP cache and BPF maps
related talks
23mImplement simple local DNS server with BPF
38mUnderstanding and Troubleshooting the eBPF Datapath in Cilium
28mLessons from Building Scalable Network Policy Enforcement with eBPF
44mCilium - Container Security and Networking Using BPF and XDP
26mIt Is Always DNS… Even at the Edge: Taming Proxy-Only Lookups With Cilium and eBPF
21mCilium Beyond Linux: Extending eBPF to Windows...
32meBPF: BPF kernel infrastructure
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel