lb.programs.common — org.clojars.pgdad/clj-ebpf-lb 0.10.0

Common eBPF program fragments and DSL utilities shared between XDP and TC programs.

add-imm clj

(add-imm dst imm)

Add immediate to register.

add-reg clj

(add-reg dst src)

Add register to register.

assemble-program clj

(assemble-program & fragments)

Assemble a program from instruction fragments. Returns BPF bytecode ready for loading.

BPF-F-PSEUDO-HDR clj

BPF-F-RECOMPUTE-CSUM clj

BPF-FUNC-csum-diff clj

BPF-FUNC-get-prandom-u32 clj

BPF-FUNC-ktime-get-ns clj

BPF-FUNC-l3-csum-replace clj

BPF-FUNC-l4-csum-replace clj

BPF-FUNC-map-delete-elem clj

BPF-FUNC-map-lookup-elem clj

BPF-FUNC-map-update-elem clj

BPF-FUNC-redirect clj

BPF-FUNC-redirect-map clj

BPF-FUNC-ringbuf-discard clj

BPF-FUNC-ringbuf-reserve clj

BPF-FUNC-ringbuf-submit clj

BPF-FUNC-xdp-adjust-head clj

build-bounds-check clj

(build-bounds-check offset size fail-offset)

Generate instructions to check if accessing [data + offset, data + offset + size) is within packet bounds. Jumps forward by fail-offset if out of bounds.

Assumes: r6 = data start, r7 = data end Uses: r8 as scratch

build-get-prandom-u32 clj

(build-get-prandom-u32)

Get a pseudo-random 32-bit number. Result in r0.

build-ktime-get-ns clj

(build-ktime-get-ns)

Get current time in nanoseconds. Result in r0.

build-l3-csum-replace clj

(build-l3-csum-replace skb-reg csum-off old-reg new-reg)

Generate incremental IP checksum update.

skb-reg: Register containing skb/xdp_md pointer csum-off: Offset of checksum field in packet old-val: Old value (in register) new-val: New value (in register)

build-l4-csum-replace clj

(build-l4-csum-replace skb-reg csum-off old-reg new-reg flags)

Generate incremental L4 (TCP/UDP) checksum update.

skb-reg: Register containing skb/xdp_md pointer csum-off: Offset of checksum field in packet old-val: Old value (in register) new-val: New value (in register) flags: BPF_F flags (use BPF-F-PSEUDO-HDR for IP address changes)

build-map-lookup clj

(build-map-lookup map-fd key-stack-off)

Generate instructions for bpf_map_lookup_elem.

Args: map-fd: The map file descriptor (will be loaded as 64-bit immediate) key-stack-off: Stack offset where key is stored (negative)

Returns: instructions that leave result pointer in r0 (or NULL)

build-map-update clj

(build-map-update map-fd key-stack-off value-stack-off flags)

Generate instructions for bpf_map_update_elem.

Args: map-fd: The map file descriptor key-stack-off: Stack offset where key is stored value-stack-off: Stack offset where value is stored flags: Update flags (0 = any, 1 = noexist, 2 = exist)

build-parse-eth clj

(build-parse-eth pass-offset)

Parse Ethernet header and check for IPv4.

Assumes: r6 = data, r7 = data_end After: jumps forward by pass-offset if not IPv4 Uses: r8 as scratch

build-parse-ip clj

(build-parse-ip pass-offset)

Parse IPv4 header, extract protocol and addresses.

Assumes: r6 = data, r7 = data_end, Ethernet header already validated Stores on stack: stack[-4] = protocol (1 byte as word) stack[-8] = src IP stack[-12] = dst IP stack[-16] = IP header length (bytes) Uses: r8, r9 as scratch

build-parse-ipv6 clj

(build-parse-ipv6 pass-offset)

Parse IPv6 header, extract next header (protocol) and addresses.

IPv6 has a fixed 40-byte header (no options in base header).

Assumes: r6 = data, r7 = data_end, Ethernet header already validated Stores on stack (unified format with 16-byte addresses): stack[-4] = next header (protocol, 1 byte as word) stack[-20] = src IP (16 bytes, at stack[-20..-5]) stack[-36] = dst IP (16 bytes, at stack[-36..-21]) stack[-40] = header length (always 40 for base IPv6) Uses: r8, r9 as scratch

build-parse-l4 clj

(build-parse-l4 pass-offset)

Parse TCP/UDP header to extract ports.

Assumes: stack[-16] = IP header length, r6 = data, r7 = data_end Stores on stack: stack[-20] = src port stack[-24] = dst port Uses: r8, r9

build-parse-l4-ipv6 clj

(build-parse-l4-ipv6 pass-offset)

Parse TCP/UDP header to extract ports for IPv6.

IPv6 has fixed 40-byte header, so L4 is always at ETH_HLEN + 40.

Assumes: r6 = data, r7 = data_end, IPv6 header validated Stores on stack: stack[-44] = src port stack[-48] = dst port Uses: r8, r9

build-random-mod-100 clj

(build-random-mod-100)

Generate random number in range [0, 99]. Result in r0. Uses: r0, r1 as scratch

build-rate-limit-check clj

(build-rate-limit-check config-map-fd
                        config-index
                        bucket-map-fd
                        key-stack-off
                        scratch-stack-off
                        skip-label
                        drop-label)

Generate BPF instructions for token bucket rate limit check.

This implements a token bucket algorithm:

1. Load config from config-map at config-index
2. If rate == 0, skip (rate limiting disabled)
3. Load/create bucket from bucket-map using key at key-stack-off
4. Calculate elapsed time since last update
5. Add tokens: new_tokens = old_tokens + elapsed_ns * rate / 1e9
6. Cap at burst
7. If tokens >= 1 (1000 scaled), consume and continue
8. Else jump to drop-label

Stack usage (relative to current-stack-off): offset 0-15: rate limit config (rate, burst) offset 16-31: bucket state (tokens, last_update)

Parameters: config-map-fd: FD for rate_limit_config array map config-index: 0 for source, 1 for backend bucket-map-fd: FD for rate_limit_src or rate_limit_backend LRU map key-stack-off: Stack offset where lookup key is stored scratch-stack-off: Stack offset for scratch space (needs 32 bytes) skip-label: Label to jump to if rate limiting disabled/passed drop-label: Label to jump to if rate limited

build-ringbuf-discard clj

(build-ringbuf-discard ptr-reg)

Discard ring buffer reservation.

ptr-reg: Register containing pointer from reserve

build-ringbuf-reserve clj

(build-ringbuf-reserve ringbuf-fd size)

Reserve space in ring buffer.

ringbuf-fd: Ring buffer map FD size: Size to reserve

Returns ptr in r0 (or NULL on failure)

build-ringbuf-submit clj

(build-ringbuf-submit ptr-reg)

Submit ring buffer entry.

ptr-reg: Register containing pointer from reserve

ETH-HLEN clj

ETH-P-IP clj

ETH-P-IP-BE clj

ETH-P-IPV6 clj

ETH-P-IPV6-BE clj

flatten-instructions clj

(flatten-instructions & instruction-groups)

Flatten nested instruction vectors. Returns a flat vector of instructions.

FNV1A-64-OFFSET-BASIS-HI clj

FNV1A-64-OFFSET-BASIS-LO clj

FNV1A-64-PRIME-HI clj

FNV1A-64-PRIME-LO clj

HTTPS-PORT-BE clj

IP-HLEN-MIN clj

IPPROTO-ICMP clj

IPPROTO-ICMPV6 clj

IPPROTO-TCP clj

IPPROTO-UDP clj

IPV6-HLEN clj

IPV6-OFF-DST clj

IPV6-OFF-HOP-LIMIT clj

IPV6-OFF-NEXT-HEADER clj

IPV6-OFF-SRC clj

ldx-b clj

(ldx-b dst src off)

Load byte from memory.

ldx-dw clj

(ldx-dw dst src off)

Load double-word (8 bytes) from memory.

ldx-h clj

(ldx-h dst src off)

Load half-word (2 bytes) from memory.

ldx-w clj

(ldx-w dst src off)

Load word (4 bytes) from memory.

map-fd clj

(map-fd m)

Get the raw file descriptor for a map. This is needed when building eBPF programs that reference maps.

MAX-SNI-LENGTH clj

MAX-TLS-EXTENSIONS clj

mov-imm clj

(mov-imm dst imm)

Move immediate value to register.

mov-reg clj

(mov-reg dst src)

Move register to register.

RATE-LIMIT-CONFIG-BACKEND clj

RATE-LIMIT-CONFIG-SRC clj

stx-b clj

(stx-b dst src off)

Store byte to memory. Signature: *(dst + off) = src

stx-dw clj

(stx-dw dst src off)

Store double-word to memory. Signature: *(dst + off) = src

stx-h clj

(stx-h dst src off)

Store half-word to memory. Signature: *(dst + off) = src

stx-w clj

(stx-w dst src off)

Store word to memory. Signature: *(dst + off) = src

sub-imm clj

(sub-imm dst imm)

Subtract immediate from register.

sub-reg clj

(sub-reg dst src)

Subtract register from register.

TC-ACT-OK clj

TC-ACT-REDIRECT clj

TC-ACT-SHOT clj

tc-drop-all clj

(tc-drop-all)

Simple TC program that drops all packets.

tc-pass-all clj

(tc-pass-all)

Simple TC program that passes all packets.

TCP-HLEN-MIN clj

TLS-CONTENT-TYPE-HANDSHAKE clj

TLS-EXT-SNI clj

TLS-HANDSHAKE-CLIENT-HELLO clj

TLS-HANDSHAKE-HEADER-SIZE clj

TLS-HANDSHAKE-LENGTH-OFF clj

TLS-HANDSHAKE-TYPE-OFF clj

TLS-RECORD-CONTENT-TYPE-OFF clj

TLS-RECORD-HEADER-SIZE clj

TLS-RECORD-LENGTH-OFF clj

TLS-RECORD-VERSION-OFF clj

TLS-SNI-NAME-TYPE-HOSTNAME clj

TOKEN-SCALE clj

UDP-HLEN clj

XDP-ABORTED clj

XDP-DROP clj

xdp-drop-all clj

(xdp-drop-all)

Simple XDP program that drops all packets.

XDP-PASS clj

xdp-pass-all clj

(xdp-pass-all)

Simple XDP program that passes all packets. Useful for testing XDP attachment.

XDP-REDIRECT clj

XDP-TX clj