XDP & tc-bpf

Programmable packet processing at line rate

XDP (eXpress Data Path)

XDP is the earliest programmable hook point in the Linux networking stack. It processes packets at the NIC driver level, before the kernel allocates an sk_buff structure. This makes XDP extraordinarily fast — packets that are dropped or redirected by XDP never touch the normal network stack at all.

Packet Processing: XDP vs. iptables Path

XDP Actions (Return Codes)

Every XDP program must return one of these action codes. The return value tells the NIC driver what to do with the packet.

XDP Attachment Modes

    $ # Attach XDP program in native mode
    $ ip link set dev eth0 xdpdrv obj xdp_prog.o sec xdp
    

    $ # Attach in generic (SKB) mode — fallback
    $ ip link set dev eth0 xdpgeneric obj xdp_prog.o sec xdp
    

    $ # Verify attachment
    $ ip link show eth0
    2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 xdp qdisc mq state UP
        prog/xdp id 42 tag a1b2c3d4
    

    $ # Detach XDP program
    $ ip link set dev eth0 xdp off
  

XDP in Production

XDP Program Structure (C Pseudocode)

An XDP program receives an xdp_md context with pointers to the raw packet data. Here is a simplified firewall that drops packets from a blocked IP list.

// SPDX-License-Identifier: GPL-2.0
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <bpf/bpf_helpers.h>

// Map: blocked source IPs (key = __be32 IP, value = drop counter)
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 10000);
    __type(key, __be32);           // source IP
    __type(value, __u64);          // packet counter
} blocked_ips SEC(".maps");

SEC("xdp")
int xdp_firewall(struct xdp_md *ctx) {
    // Packet data boundaries
    void *data     = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;

    // Parse Ethernet header — MUST bounds-check for verifier
    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end)
        return XDP_PASS;

    // Only process IPv4
    if (eth->h_proto != __constant_htons(ETH_P_IP))
        return XDP_PASS;

    // Parse IP header — MUST bounds-check again
    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end)
        return XDP_PASS;

    // Lookup source IP in blocked list
    __u64 *counter = bpf_map_lookup_elem(&blocked_ips, &ip->saddr);
    if (counter) {
        // IP is in blocklist — increment counter and DROP
        __sync_fetch_and_add(counter, 1);
        return XDP_DROP;
    }

    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

tc-bpf (Traffic Control eBPF)

tc-bpf hooks into the Linux traffic control layer, processing packets after XDP but before netfilter/iptables. Unlike XDP, tc-bpf works with the full sk_buff structure, giving access to richer metadata — at the cost of being slightly slower.

tc-bpf Actions

Where tc-bpf Fits in the Stack

1. NIC

   Packet arrives

2. XDP

   Pre-sk_buff hook

3. sk_buff created

   Kernel allocates socket buffer

4. tc ingress (eBPF)

   Classify, mangle, redirect

5. Netfilter / iptables

   PREROUTING, INPUT...

6. Application

   Socket recv()

1. Application

   Socket send()

2. Routing

   Output route lookup

3. Netfilter OUTPUT

   POSTROUTING

4. tc egress (eBPF)

   Shape, police, redirect

5. NIC

   Packet transmitted

    $ # Attach tc-bpf to ingress
    $ tc qdisc add dev eth0 clsact
    $ tc filter add dev eth0 ingress bpf da obj tc_prog.o sec tc
    

    $ # Attach tc-bpf to egress
    $ tc filter add dev eth0 egress bpf da obj tc_prog.o sec tc_egress
    

    $ # List attached tc programs
    $ tc filter show dev eth0 ingress
    filter protocol all pref 49152 bpf chain 0
      handle 0x1 tc_prog.o:[tc] direct-action id 15 tag d4e5f6a7 jited
  

eBPF/XDP vs. iptables: The Comparison

Performance Numbers

Decision Guide: XDP vs. tc-bpf vs. iptables

Bonus: AF_XDP (Kernel Bypass to Userspace)