Can We Really Parse DNS in eBPF? Improving Cilium ToFQDN With In-kernel Policy Updates

Explore advanced eBPF programming techniques for parsing DNS responses directly in the kernel to improve Cilium's toFQDN policy implementation. Learn how to handle complex DNS parsing challenges including DNS compression, pointer following, multiple answer parsing, and DNS over TCP scenarios where responses may be split across multiple packets requiring TCP stream parsing in eBPF. Discover the current limitations of Cilium's toFQDN policies that rely on userspace DNS proxies to intercept responses and populate endpoint policy maps, and understand the complexity issues with userspace high availability modes that create dependencies and coordination challenges between agents and out-of-process proxies. Examine how modern eBPF capabilities can now handle sophisticated logic that was previously considered too complex for kernel-space implementation. Gain insights into designing and integrating a native eBPF-based DNS parsing system into Cilium's toFQDN policy subsystem to eliminate userspace dependencies and reduce architectural complexity while maintaining robust DNS policy enforcement capabilities.