How eBPF interacts with Windows VFP

[song-jiang]

Hype-V virtual vSwitch is at the centre of Windows container networking. HNS utilizes the Virtual Filtering Platform (VFP) for policy creation which includes load balancing, ACLs, and encapsulation.

This thread discusses how eBPF interacts with VFP and what is the impact eBPF could make in terms of functionality, performance and observability.

Some initial questions on this topic:
Functionality:

1. Is it possible to attach XDP program on a vNIC or a vmNIC?

Performance

1. Can packets bypass all VFP layers or (just one of the layers) and reach a network endpoint?

Observability

1. Can we get stats from the flow table or an endpoint? Like what vfpctl.exe can do now.
2. Can we get what rule/policy applied on a packet when it traverse each layer?

[song-jiang]

@poornagmsft Thanks for your input during last meeting.

For observability, I can think of two possible use cases.

1. Get info about VFP flow table entries.
   Similar to linux conntrack table, we should be able to get 5 tuples (original) and Destination IP/Port after DNAT for each connection. Currently there is no public API available.

2. Get info about ACL rules which allow/deny the traffic.
   We can get ETW trace but I feel utilise ETW trace for observability is quite heavy-weight. It would be nice if eBPF can make things simpler.