ebpf

Is your feature request related to a problem? Please describe.

Useful for networking tracing to convert from network order to host order.

Describe the solution you'd like

int[8|16|32|64] bswap(int[8|16|32|64])

We can make bswap() infer the integer width and return the appropriate integer. Previous discussi

Originally posted by @mmat11 in cilium/ebpf#303 (comment)

Hi, I believe bpf_tracing.h needs additional env vars as written here.
The following works for me:

/t/tcpconnlat *master> BPF_CFLAGS='-D__TARGET_ARCH_x86' go generate ./...
Compiled /tmp/tcpconnlat/tcpconn

We use kind for integration tests against a kubernetes cluster. We now have a dirty hack to load the built images into the kind docker daemon since when we started using it kind was at a very early stage and didn't have the load command. Now the load command is available so we can just replace the hack with it!

Docs here
https://kind.sigs.k8s.io/docs/user/quick-start/#loading-an-image-into-y

We currently only check for CAP_SYS_ADMIN when running Tracee (https://github.com/aquasecurity/tracee/blob/main/tracee-ebpf/main.go#L885), which was correct for old kernels.
For newer kernels, CAP_SYS_ADMIN was split into combination of 3 other capabilities:
CAP_BPF, CAP_PERFMON and CAP_NET_ADMIN as described in https://lwn.net/Articles/820560/, and https://lwn.net/Articles/822362/
Update check

Since the kernel's libbpf seems to handle .text ELF sections gracefully, we should probably do that too.

Can we get some performance comparison between polycube and using standard linux facilities (NAT, iptables, etc.)?

CPU usage, PPS, latencies, etc.