sockets with BPF socket lookup hook Jakub Sitnicki, Cloudflare @jkbs0 @cloudflare October 28-29, 2020 Who am I? ● Software Engineer at Cloudflare Spectrum TCP/UDP reverse proxy, Linux kernel, ... bpftool version bpftool v5.9.1 Code and instructions at https://github.com/jsitnicki/ebpf-summit-2020 We will need… a TCP echo server $ sudo dnf install nmap-ncat $ nc -4kle /bin/cat 127.0.0.1 7777 /sys/fs/bpf/echo_dispatch_prog 75: sk_lookup name echo_dispatch tag 77fd96f660a5d2ab gpl loaded_at 2020-10-23T09:36:45+0000 uid 0 xlated 304B jited 197B memlock 4096B map_ids 28,29

deathstar access to empire ships only Kind: CiliumNetworkPolicy Metadata: Creation Timestamp: 2020-06-15T14:06:48Z Generation: 1 Managed Fields: API Version: cilium.io/v2 Fields Type: f:org: f:ingress: Manager: kubectl Operation: Update Time: 2020-06-15T14:06:48Z Resource Version: 2914 Self Link: /apis/cilium.io/v2/namespaces/defa restrict access to specific HTTP call Kind: CiliumNetworkPolicy Metadata: Creation Timestamp: 2020-06-15T14:06:48Z Generation: 2 Managed Fields: API Version: cilium.io/v2 Fields Type:

deathstar access to empire ships only Kind: CiliumNetworkPolicy Metadata: Creation Timestamp: 2020-06-15T14:06:48Z Generation: 1 Managed Fields: API Version: cilium.io/v2 Fields Type: f:org: f:ingress: Manager: kubectl Operation: Update Time: 2020-06-15T14:06:48Z Resource Version: 2914 Self Link: /apis/cilium.io/v2/namespaces/defa restrict access to specific HTTP call Kind: CiliumNetworkPolicy Metadata: Creation Timestamp: 2020-06-15T14:06:48Z Generation: 2 Managed Fields: API Version: cilium.io/v2 Fields Type:

deathstar access to empire ships only Kind: CiliumNetworkPolicy Metadata: Creation Timestamp: 2020-06-15T14:06:48Z Generation: 1 Managed Fields: API Version: cilium.io/v2 Fields Type: f:org: f:ingress: Manager: kubectl Operation: Update Time: 2020-06-15T14:06:48Z Resource Version: 2914 Self Link: /apis/cilium.io/v2/namespaces/defa restrict access to specific HTTP call Kind: CiliumNetworkPolicy Metadata: Creation Timestamp: 2020-06-15T14:06:48Z Generation: 2 Managed Fields: API Version: cilium.io/v2 Fields Type:

deathstar access to empire ships only Kind: CiliumNetworkPolicy Metadata: Creation Timestamp: 2020-06-15T14:06:48Z Generation: 1 Managed Fields: API Version: cilium.io/v2 Fields Type: f:org: f:ingress: Manager: kubectl Operation: Update Time: 2020-06-15T14:06:48Z Resource Version: 2914 Self Link: /apis/cilium.io/v2/namespaces/defa restrict access to specific HTTP call Kind: CiliumNetworkPolicy Metadata: Creation Timestamp: 2020-06-15T14:06:48Z Generation: 2 Managed Fields: API Version: cilium.io/v2 Fields Type:

Enabling eBPF Super Powers on ARM64 with Cilium Jianlin Lv Trevor Tao October 28, 2020 Preface Arm ecosystem of CNI Support Arm64 • Cilium enable on aarch64 • https://github.com/cilium/cilium/issues/9898 Cilium Channel for Arm64 • https://cilium.slack.com/archives/C0125S9TQD8 Confidential Restricted © 2020 Arm Limited Thank You Danke Merci 谢谢 ありがとう Gracias Kiitos 감사합니다 धन्यवाद اًركش ধন্যবাদ הדות

How Okteto uses Falco to keep users happy and our platform healthy Ramiro Berrelleza October 28, 2020 ● Co-founder of Okteto ● Former architect @ Atlassian, Software Engineer @ Azure ● @rberrelleza intervention Future Ideas The Tale of Smokey and the Crypto Bandits Ramiro Berrelleza October 28, 2020

Threat Detection and Network Monitoring by using eBPF Natalia Reka Ivanko, Isovalent October 28, 2020 ● ● ○ ● ○ ○ ○ ○ ● ● ● ● ● ● ● ● ○ ● ○ ○ ○ ● ● ● ○ ● ○ ○ ● ● ○ ○ ● ○ ○

How to ship BPF with your Go project Lorenz Bauer October 28, 2020 Goal ● Count the number of packets on lo ● Print the count to the console ● From a single Go binary Use the source, Luke github