Kunai: Toward a Verifier-Safe Layered DSL for Nested Encapsulation Packet Filtering on eBPF

Abstract

Packet capture and network debugging require selecting the packets of interest early, inside the Linux kernel. However, pcap-filter, tcpdump's filter language, has no syntax for nested encapsulation, repeated occurrences of the same protocol, or the variable-length lists and options whose field offsets change from packet to packet. Running such an expressive filter in the kernel also requires bytecode that the Linux eBPF verifier accepts, and the verifier rejects a naive lowering. We present Kunai, a packet-filter DSL together with a compiler that lowers its expressions to eBPF bytecode. A Kunai expression describes a packet's layer structure and field conditions together, and resolves each field's offset and type from protocol definitions written in a subset of P4. The compiler records every header's start offset at run time, bounds each variable-length scan by a compile-time constant, and places a verifier-compliant bounds check before every packet read. We evaluated Kunai on filters spanning GTP-U, SRv6, Geneve, and TCP options. The generated bytecode was accepted by the verifier across six kernels (Linux 6.1-7.0) on both the XDP and tc attach points, matched and rejected the intended packets, and, where pcap-filter can express the filter, ran within a few percent of pcap-filter in per-packet processing cost.