How do I attach XDP to a network interface?

[lmb]

Mathias Kolehmainen writes on Slack:

I’m working with the golang ebpf library and am stuck on how to attach my XDP program to a network interface. None of the link package functions seems quite right. So I’m trying link.RawAttachProgram but have so far not been successful setting the arguments correctly. It looks straightforward in libbpf C, but I don’t see an implementation in the go lib. Any pointers would be appreciated!

[lmb]

The library doesn't have a way to attach XDP programs out of the box, for now, since that requires interacting with netlink. You can use a third party netlink library to achieve what you want:

• https://pkg.go.dev/github.com/vishvananda/netlink#LinkSetXdpFdWithFlags

[mehrdadrad]

Now you can attach XDP programs to network interfaces with Cilium eBPF library. This feature has added to the library since version 0.8.0 and it requires at least Linux 5.9. (It uses bpf_link to attach, not netlink)
Sample code:

package main

import (
	"log"
	"net"
	"os"
	"os/signal"
	"syscall"

	"github.com/cilium/ebpf"
	"github.com/cilium/ebpf/link"
)

func main() {
	sig := make(chan os.Signal, 1)
	signal.Notify(sig, os.Interrupt, syscall.SIGTERM)

	coll, err := ebpf.LoadCollection("xdp.o")
	if err != nil {
		log.Fatal(err)
	}

	ifce, err := net.InterfaceByName("eth0")
	if err != nil {
		log.Fatal(err)
	}

	l, err := link.AttachXDP(link.XDPOptions{
		Program:   coll.Programs["xdp_prog"],
		Interface: ifce.Index,
	})
	if err != nil {
		log.Fatal(err)
	}
	defer l.Close()

	<-sig
}

[diegobes]

5.9 or 5.7 ?

ebpf/link/syscalls.go

Line 89 in bf256fd

var haveBPFLink = internal.FeatureTest("bpf_link", "5.7", func() error {

[dreamerlzl]

Is there a place to look up the history of bpf syscall/version required for each bpf subcommand?
I could attach my XDP program to eno1 this way on a machine with kernel 4.18.0-372.9.1.el8.x86_64

[ti-mo]

There's https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md, but not necessarily up-to-date. BPF_LINK_CREATE for XDP was merged in 5.9: torvalds/linux@aa8d3a716b59.

Found using grep BPF_LINK_CREATE on the Linux tree, navigating kernel/bpf/syscall.c, and git blameing the part in link_create() where the case was added for BPF_PROG_TYPE_XDP.

[alttagil]

Are there any methods to remove XDP programs from a certain network interface using only Cilium eBPF library?

[ti-mo]

@alttagil That depends. ebpf-go supports removing/closing bpf_link-based XDP attachments, but arguably a simple rm could accomplish the same for a link pinned to a well-known path on bpffs. Once a bpf_link is established, no more interactions are needed that involve the ifindex, you just close/remove the link and move on.

For removing XDP links attached using netlink, you'll have to use vishvananda/netlink or jsimonetti/rtnetlink.