Implement simple local DNS server with BPF
summary
Claims a working BPF-based local DNS responder that parses UDP DNS queries and rewrites packets in-place, implemented as XDP and TC BPF programs. It swaps MAC/IP/UDP fields, appends answer RR(s) from a BPF map, recalculates checksums and returns the packet as a response without userland. Demo uses a five-host list (Facebook/Google/etc.), returns multiple A/AAAA records (Facebook returned two IPs) and shows lower latency across regions. Limitations: no TCP or DoT, simple stateless records only; useful for hosts replacement and DDoS mitigation.
AI-written summary · about
chapters (13)
- 0:00Introduction to DNS with BPF
- 1:11BPF use cases at Meta
- 2:16DNS packet structure basics
- 5:51BPF programs for DNS interception
- 7:23Packet modifications for DNS replies
- 10:37Storing DNS records in BPF
- 11:24Use cases for DNS-BPF
- 12:31XDP vs TC for DNS resolution
- 15:48Live demo setup
- 16:26Running TC program demo
- 18:22Local DNS resolution results
- 19:48XDP program demo
- 20:58Q&A session
related talks
29mCan We Really Parse DNS in eBPF? Improving Cilium ToFQDN With In-kernel Policy Upda...
20mToying with DNS
19mGet start with XDP: write a network filter in 10m
32mDemystifying eBPF - eBPF Firewall from scratch
34mUsing DNS as a layer of defense
32meBPF: BPF kernel infrastructure
26mMisuse of DNS, the Second Most Used Protocol
41mA BPF map for online packet classification