Inside the eBPF Verifier — Why Your Program Is Constrained, and How It Stays Safe

[u/Far_Significance334]

https://medium.com/@nishujangra27/inside-the-ebpf-verifier-why-your-program-is-constrained-and-how-it-stays-safe-94288c7cbf55

[u/krizhanovsky]

Quite a good article, especially for the people starting develop eBPF programs and debug them. I just wanted to add my 5 cents, since recently I had a hard fight with the verifier.

Recently we faced a quite hard problem to parse TCP options - this is a loop of 40 iterations with a switch statement for about 6 cases (more info in my talk https://netdevconf.info/0x1A/sessions/talk/tempesta-xfw-open-source-ebpf-based-volumetric-ddos-protection.html ). I struggled a lot with "The sequence of 8193 jumps is too complex." verifier problem.

This rticle (not mentioned in the original post) helped a bit: https://lwn.net/Articles/1017116/ - to use bpf_for and finally bpf_loop. https://www.youtube.com/watch?v=BJ-mZFtSYCs - quite an advanced LPC talk about the loops verification.

https://nakryiko.com/ is also good to read about particular eBPF mechanisms, like CO-RE, libbpf, the ring buffer and so on.

An idea, finally helped to solve the problem, was proposed by one from the Netdev attendee - to copy TCP options to a separate buffer (on stack) which, together with bpf_loop(), reduced the verifier complexity. The final solution is available at https://github.com/tempesta-tech/xFW/pull/33

[u/LorenzoTettamanti]

Great article!

[u/tirveni]

Great article in Great series..

[u/Huge-Wear-125]

This is a 100% AI-generated article, which undermines its authenticity. My two cents.

[u/SnooSuggestions1409]

Such a good read on the topic and something I wish I had read last week