BPF, XDP, Packet Filters and UDP
So... this post casually outlines how one could go about build a Global Network Load Balancer at Google-scale. Amazing!A few naïve questions:> You can make any protocol work with a custom proxy. Take DNS: your edge servers listen for UDP packets, slap PROXY headers on them, relay the packets to worker servers, unwrap them, and deliver them to containers.Curious: Wouldn't SOCKS5 here be a like-for-like replacement for PROXY? Why would one choose one over the other?> WireGuard doesn't have link-layer headers, and XDP wants it toIs the gist here that WireGuard doesn't because it is Layer 3? And that XDP sits one layer below it?> Jason Donenfeld even wrote a patch, but the XDP developers were not enthused, just about the concept of XDP running on WireGuard at allCould someone please explain this? Is it that XDP here didn't want to add a support to delegate routing onto WireGuard?> It's a little hard to articulate how weird it is writing eBPF code. You're in a little wrestling match with the verifierWould NetMap or Intel's dpdk instead make for an non-enterprising choice here? Don't they have a similar profile in terms of throughput? I guess, one has to use a userspace TCP/IP stack like gVisor's NetStack or LwIP to go with NetMap/dpdk?> Those configurations are fed into distributed service discovery; our servers listen on changes and, when they occur, they update a routing mapHow is this system implemented? Curious because uptime, availability, durability, and latency must be of prime importance for such a service. Is there a blog about this detailing the challenges inherent here? Or, does it use consul/etcd or some such out-of-the-box solution?> a simple map of addresses to actions and next-hops; the Linux bpf(2) system call lets you update these maps on the fly.Clarification: does this mean the maps are already in a format the bpf/2 command understands, or is something else going on here?Thanks.