lb.programs.xdp-ingress — org.clojars.pgdad/clj-ebpf-lb 0.2.0

XDP ingress program for the load balancer. Handles incoming packets: parses headers, looks up routing, performs DNAT.

attach-to-interface clj

(attach-to-interface prog iface & {:keys [mode] :or {mode :skb}})

Attach XDP program to a network interface.

prog: BpfProgram record or program FD iface: Interface name (e.g., "eth0") mode: :skb (generic), :drv (native), or :hw (hardware)

attach-to-interfaces clj

(attach-to-interfaces prog interfaces & opts)

Attach XDP program to multiple interfaces.

BPF-FUNC-csum-diff clj

BPF-FUNC-ktime-get-ns clj

build-ipv4-filter-program clj

(build-ipv4-filter-program)

Build XDP program that passes IPv4 packets and drops others. Uses clj-ebpf.net primitives for packet parsing.

build-xdp-dnat-program clj

(build-xdp-dnat-program listen-map-fd config-map-fd sni-map-fd conntrack-map-fd)

Build XDP ingress program that performs DNAT on incoming packets.

This program:

1. Parses IPv4/TCP or IPv4/UDP packets
2. For TCP port 443, attempts SNI-based routing (TLS ClientHello parsing)
3. Falls back to listen map lookup by (ifindex, dst_port)
4. Falls back to config map LPM lookup by source IP
5. If match found, performs DNAT (rewrites dst IP and port)
6. Updates IP and L4 checksums
7. Creates conntrack entry for TC SNAT to use on reply path
8. Returns XDP_PASS to let kernel routing deliver packet

Routing priority:

1. Source IP exact/CIDR match (config map)
2. SNI hostname match (sni map, for TLS traffic)
3. Default target (listen map)

Register allocation: r6 = saved XDP context (callee-saved) r7 = data pointer (callee-saved) r8 = data_end pointer (callee-saved) r9 = IP header pointer / map value ptr (callee-saved) r0-r5 = scratch, clobbered by helpers

Uses clj-ebpf.asm label-based assembly for automatic jump offset resolution.

build-xdp-ingress-program clj

(build-xdp-ingress-program map-fds)

Build the XDP ingress program.

Performs DNAT on incoming packets:

1. For TCP port 443, attempts SNI-based routing (TLS ClientHello parsing)
2. Falls back to listen map lookup by (ifindex, dst_port)
3. Falls back to config map LPM lookup by source IP
4. If match found, rewrites destination IP/port
5. Updates IP and L4 checksums
6. Creates conntrack entry for TC SNAT
7. Returns XDP_PASS to let kernel routing deliver packet

map-fds: Map containing :listen-map, optionally :config-map, :sni-map and :conntrack-map

build-xdp-pass-program clj

(build-xdp-pass-program)

Build a simple XDP program that passes all packets. This is useful for initial testing of program loading/attachment.

detach-from-interface clj

(detach-from-interface iface & {:keys [mode] :or {mode :skb}})

Detach XDP program from an interface.

detach-from-interfaces clj

(detach-from-interfaces interfaces & opts)

Detach XDP program from multiple interfaces.

dump-program-bytecode clj

(dump-program-bytecode maps)

Dump program bytecode for debugging.

load-program clj

(load-program maps)

Load the XDP ingress program. Returns a BpfProgram record.

verify-program clj

(verify-program maps)

Verify the XDP program can be loaded (dry run). Returns {:valid true} or {:valid false :error <message>}

xdp-apply-csum-diff clj

(xdp-apply-csum-diff old-csum-reg diff-reg scratch-reg)

Apply a checksum difference to an existing checksum. old-csum-reg: Register containing old checksum (16-bit, will be modified) diff-reg: Register containing the difference from csum_diff scratch-reg: Scratch register

Result: old-csum-reg contains new 16-bit checksum

xdp-fold-csum clj

(xdp-fold-csum csum-reg scratch-reg)

Fold a 32-bit checksum to 16 bits in XDP. csum-reg will contain the folded result. scratch-reg is clobbered.

xdp-load-data-ptrs-32 clj

(xdp-load-data-ptrs-32 data-reg data-end-reg ctx-reg)

Load data and data_end pointers from XDP context using 32-bit loads. The kernel requires 32-bit access to xdp_md fields.

data-reg: Register to store data pointer data-end-reg: Register to store data_end pointer ctx-reg: XDP context register (typically :r1)

xdp-update-csum-for-port-change clj

(xdp-update-csum-for-port-change csum-reg old-port-reg new-port-reg scratch-reg)

Update checksum for a 2-byte port change. csum-reg: Register containing current checksum (will be modified) old-port-reg: Register containing old port value new-port-reg: Register containing new port value scratch-reg: Scratch register

Uses incremental checksum: new_csum = ~(~old_csum + ~old_val + new_val)