In this lesson, you will learn how to attach BPF programs to the Linux Traffic Control (TC) subsystem to perform advanced packet inspection and manipulation at the network interface.
Beyond XDP: Why Use TC?
While you have already explored XDP (eXpress Data Path) for ultra-fast packet processing, TC offers a distinct advantage: it operates after the packet has been processed by the kernel's network stack. When a packet is at the TC hook point, it is associated with a sk_buff (socket buffer) structure. This means the kernel has already parsed headers, handled segments, and identified the destination. By attaching BPF programs to TC ingress or egress points, you can make informed decisions based on metadata that XDP cannot see, such as routing information or socket associations.
Attaching via tc
To attach a BPF program, you typically use the tc command-line utility. The process involves creating a "classifier" (or filter) that points to your BPF object file.
For example, to attach a program to the ingress hook of the eth0 interface, you would use:
# Add a clsact qdisc to the interface to enable TC BPF hooks
tc qdisc add dev eth0 clsact
# Attach a BPF program to the ingress path
tc filter add dev eth0 ingress bpf da obj my_program.o sec ingress_filter
The da flag stands for "direct action." This is crucial because it tells the kernel that the BPF program itself will return the decision (e.g., TC_ACT_OK to let the packet pass or TC_ACT_SHOT to drop it), rather than relying on an external TC action object.
The Power of skb Access
Because your program receives the sk_buff context, you can read complex fields like the packet's priority, the network namespace, or even mark the packet for later processing by other kernel subsystems. While XDP is your go-to for dropping malicious traffic at wire speed, TC BPF is the correct tool for granular traffic shaping, header modification, and advanced steering that requires full kernel visibility.
Key Takeaway: TC BPF programs provide deep visibility into the kernel's packet processing path by allowing you to inspect and modify sk_buff metadata at the ingress and egress points.