eBPF CNF Scaffold Skill

This skill scaffolds complete eBPF-based CNF projects following the established patterns in this repository.

What This Skill Does

Creates a new eBPF CNF project with:

1. Proper directory structure (

   examples/{name}/

   )
2. eBPF kernel program in Restricted C (

   bytecode/{name}.c

   )
3. Go userspace application (

   main.go

   )
4. bpf2go code generation setup (

   bytecode/gen.go

   )
5. Go module initialization
6. README with build/run instructions
7. Optional Dockerfile for containerization

When to Use

• Creating a new CNF from scratch
• Adding a new example to the examples/ directory
• Starting a new eBPF networking project
• Need a working template that follows repository conventions

Project Structure Created

Basic Structure

examples/{name}/
├── main.go                 # Go userspace application
├── bytecode/
│   ├── gen.go             # bpf2go generation directive
│   ├── {name}.c           # eBPF kernel program (Restricted C)
│   ├── {name}_bpfel.go    # Generated (after go generate)
│   └── {name}_bpfeb.go    # Generated (after go generate)
├── go.mod                 # Go module file
├── README.md              # Build and run instructions
└── Dockerfile             # Optional containerization

With Internal Packages

For complex CNFs, use subpackages to organize code:

examples/{name}/
├── main.go                 # Entry point, CLI, event loop
├── main_test.go           # Integration tests
├── bytecode/
│   ├── gen.go             # bpf2go generation
│   ├── vmlinux.h          # Kernel types for CO-RE
│   ├── {name}.c           # eBPF program
│   ├── {name}_bpfel.go    # Generated
│   └── {name}_bpfeb.go    # Generated
├── {subpkg}/              # Internal package
│   ├── {subpkg}.go        # Core functionality
│   ├── {subpkg}_test.go   # Unit tests
│   └── options.go         # Functional options
├── go.mod
└── README.md

Example from

netkit-ipv6

:

examples/netkit-ipv6/
├── main.go
├── main_test.go
├── bytecode/
│   ├── gen.go
│   ├── vmlinux.h
│   └── netkit_ipv6.c
├── netkit/                 # Subpackage for device management
│   ├── netkit.go          # CreatePair, Delete
│   ├── netkit_test.go
│   ├── options.go         # WithL2Mode, WithL3Mode
│   └── ipv6.go            # ConfigureIPv6LinkLocal
└── go.mod

Benefits of subpackages:

• Separation of concerns (bytecode generation vs device management)
• Reusable components
• Independent unit testing
• Clearer imports in main.go

Information to Gather

Before scaffolding, ask the user:

1. CNF Name: What to name the CNF (lowercase, hyphens only)
2. Hook Type: Which eBPF hook to use (XDP, TC/tcx, netkit, kprobe, tracepoint)
3. Functionality: Brief description of what the CNF should do
4. Maps Needed: Does it need eBPF maps? (hash, array, ringbuf, etc.)
5. Dockerfile: Should a Dockerfile be included?

Boilerplate Components

1. eBPF Program Template (bytecode/{name}.c)

//go:build ignore

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

// Add appropriate headers based on hook type
// XDP: <linux/if_ether.h>, <linux/ip.h>
// TC/tcx: <linux/pkt_cls.h>
// netkit: <linux/if_link.h>

char _license[] SEC("license") = "GPL";

SEC("{hook_section}")
int {function_name}(struct {ctx_type} *ctx) {
    // TODO: Implement CNF logic
    return {return_value};
}

2. Go Generation File (bytecode/gen.go)

package bytecode

//go:generate go tool bpf2go -type {types} {CapitalizedName} {name}.c -- -O2 -Wall -Werror

3. Go Userspace Application (main.go)

package main

import (
    "log"
    "os"
    "os/signal"
    "syscall"

    "{module}/bytecode"
    "github.com/cilium/ebpf"
    "github.com/cilium/ebpf/link"
)

func main() {
    // Load eBPF objects
    spec, err := bytecode.Load{Name}()
    if err != nil {
        log.Fatalf("loading eBPF spec: %v", err)
    }

    objs := &bytecode.{Name}Objects{}
    if err := spec.LoadAndAssign(objs, nil); err != nil {
        log.Fatalf("loading eBPF objects: %v", err)
    }
    defer objs.Close()

    // TODO: Attach program to hook
    // TODO: Read from maps/ringbufs if needed

    log.Println("{Name} CNF is running...")

    // Wait for signal
    sig := make(chan os.Signal, 1)
    signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM)
    <-sig

    log.Println("Shutting down...")
}

4. README Template

# {Name} CNF

{Description}

## Build

Compile the eBPF program:
```shell
go generate ./bytecode
```

Build the userspace application:
```shell
go build -o {name}
```

## Run

```shell
sudo ./{name}
```

## Test

```shell
sudo -E go test .
```

Hook-Specific Configuration

XDP

• Section:

  SEC("xdp")

• Context:

  struct xdp_md *ctx

• Return values:

  XDP_PASS

  ,

  XDP_DROP

  ,

  XDP_TX

  ,

  XDP_REDIRECT

  ,

  XDP_ABORTED

• Attach:

  link.AttachXDP()

TC/tcx (Kernel 6.6+)

• Section:

  SEC("tc")

  or

  SEC("tcx/ingress")

  /

  SEC("tcx/egress")

• Context:

  struct __sk_buff *skb

• Return values:

  TC_ACT_OK

  ,

  TC_ACT_SHOT

  ,

  TC_ACT_REDIRECT

  ,

  TC_ACT_PIPE

• Attach:

  link.AttachTCX()

  for tcx,

  link.AttachTC()

  for legacy

netkit (BPF-programmable network device)

• Section:

  SEC("netkit/primary")

  and

  SEC("netkit/peer")

• Context:

  struct __sk_buff *skb

• Return values:

  NETKIT_PASS

  ,

  NETKIT_DROP

  ,

  NETKIT_REDIRECT

• Attach:

  link.AttachNetkit()

  with

  ebpf.AttachNetkitPrimary

  or

  ebpf.AttachNetkitPeer

• Note: Requires two programs (primary and peer) for bidirectional processing

kprobe/kretprobe

• Section:

  SEC("kprobe/function_name")

  or

  SEC("kretprobe/function_name")

• Context:

  struct pt_regs *ctx

• Return value:

  0

• Attach:

  link.Kprobe()

  or

  link.Kretprobe()

tracepoint

• Section:

  SEC("tracepoint/category/name")

• Context: Custom struct based on tracepoint
• Return value:

  0

• Attach:

  link.Tracepoint()

Go Module Initialization

After creating the structure, initialize the Go module:

cd examples/{name}
go mod init github.com/{username}/xcnf/examples/{name}
go get -tool github.com/cilium/ebpf/cmd/bpf2go
go mod tidy

Post-Scaffold Instructions

After scaffolding, remind the user to:

1. Enter the Linux VM (if using OrbStack):

   orb
   

2. Generate vmlinux.h (for CO-RE programs):

   cd examples/{name}/bytecode
   bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h
   

3. Generate eBPF bytecode:

   cd examples/{name}
   go generate ./bytecode
   

4. Implement the CNF logic in:

   • bytecode/{name}.c

     - kernel-space processing

   • main.go

     - userspace control and data handling

5. Build and test:

   go build -o {name}
   sudo ./{name}
   

Best Practices

• Use meaningful variable names that describe the CNF's purpose
• Add TODO comments for areas that need implementation
• Include bounds checking for all packet data access
• Use appropriate helper functions (

  bpf_printk

  for debugging)
• Follow the existing patterns in the repository
• Add proper error handling in Go code
• Use

  defer

  for cleanup (Close(), link cleanup)

Example Usage

User: "Create a new CNF called 'rate-limiter' that uses XDP to rate limit incoming packets"