Packet Parsing with eBPF

In this lesson, you will learn how to safely traverse packet data buffers in eBPF to extract specific protocol fields for real-time network monitoring.

The Challenge of Direct Access

When a packet reaches an eBPF hook (like XDP or TC), the kernel provides a data pointer to the raw packet buffer. However, you cannot simply cast this pointer to a C struct. The eBPF verifier enforces strict bounds checking to ensure you never access memory outside the current packet's scope. To extract fields like source IPs or TCP port numbers, you must manually perform "pointer arithmetic" while respecting the packet's data_end.

Safe Protocol Extraction

To read a field, you define the expected structure, check that the pointer is within the valid memory range, and then perform a safe load. If you try to access a field without checking the bounds, the verifier will reject your program.

Here is how you safely parse a standard IPv4 header:

struct iphdr *ip = data + sizeof(struct ethhdr);

// Verify that the IP header fits within the packet buffer
if ((void *)ip + sizeof(*ip) > data_end) {
    return XDP_PASS; // Packet is malformed or too short
}

// Now it is safe to extract fields
__u32 src_ip = ip->saddr;
bpf_trace_printk("Source IP: %x\n", src_ip);

Parsing Nested Protocols

Because network packets are encapsulated (Ethernet -> IP -> TCP/UDP), parsing often requires a recursive approach. You move your pointer forward by the size of the current header, check the data_end again, and then parse the next layer.

For instance, to get the destination port from a TCP packet:

1. Parse the Ethernet header.
2. Check if the EtherType is ETH_P_IP.
3. Move the pointer forward and parse the iphdr.
4. Check the ip->protocol field for IPPROTO_TCP.
5. Move the pointer forward again, check the data_end, and finally read the tcphdr->dest field.

By strictly following these bounds checks, you create stable monitoring tools that interact safely with the kernel’s networking stack without risking memory corruption or verifier errors.

Key Takeaway: Always validate that your pointer arithmetic stays within the data and data_end boundaries before accessing any protocol field to satisfy the eBPF verifier.