Introduction: The Power of eBPF on Android

The Android ecosystem, while robust, often presents challenges for low-level system customization, especially concerning network traffic manipulation and analysis. Traditional methods involving kernel modules or proxy applications have drawbacks in terms of performance, security, and integration. This is where eBPF (extended Berkeley Packet Filter) emerges as a game-changer. eBPF allows developers to run sandboxed programs within the operating system kernel, granting powerful capabilities for networking, security, and observability without modifying kernel source code or loading kernel modules. On Android, eBPF is increasingly integrated, powering features like network accounting and some firewall functionalities.

This article provides an expert-level, step-by-step guide on how to compile custom eBPF network programs and deploy them on a rooted Android device. We will cover the entire lifecycle, from writing the eBPF C code to using the Android NDK’s Clang toolchain, and finally loading and attaching the compiled bytecode to a network interface on the device.

Prerequisites: Setting Up Your Development Environment

Before diving into eBPF development for Android, ensure your development environment is properly configured. You’ll need the following:

• Android NDK (Native Development Kit): Essential for accessing the Clang/LLVM toolchain capable of targeting the BPF backend. Download the latest stable version.
• AOSP (Android Open Source Project) Source Tree (Optional but Recommended): Access to Android’s kernel headers is crucial for eBPF programs. While you can often use standalone kernel headers, building from AOSP ensures compatibility with your target device’s kernel version.
• Rooted Android Device: Loading and attaching eBPF programs typically requires root privileges on the target device.
• ADB (Android Debug Bridge): For interacting with your Android device (pushing files, running commands, viewing logs).
• bpftool (Cross-compiled for Android): A powerful utility for interacting with eBPF programs and maps. You’ll likely need to compile this from source for your Android target architecture.

Understanding eBPF’s Place in Android’s Ecosystem

Android’s BPFLoader and Security Model

Android utilizes a component called BpfLoader (part of init) and various eBPF programs for system-level functions like network accounting (TrafficController), battery monitoring, and some security features. While Android leverages eBPF internally, directly loading arbitrary eBPF programs by unprivileged apps is restricted due to security implications. For our purposes, we will bypass these restrictions by operating with root privileges, directly interacting with the kernel’s BPF syscall interface.

Kernel Configuration Requirements

For eBPF programs to function correctly, the Android device’s kernel must be configured with appropriate eBPF support. Key kernel configuration options typically include:

• CONFIG_BPF=y
• CONFIG_BPF_SYSCALL=y
• CONFIG_NET_BPF=y (for network-related eBPF features like XDP/TC)
• CONFIG_BPF_JIT=y (for performance, though not strictly required for functionality)
• CONFIG_BPF_EVENTS=y (for tracing/observability)

You can verify these by checking your device’s /proc/config.gz or by examining the kernel source for your device.

Crafting Your First eBPF Network Program

Let’s write a simple eBPF program that demonstrates network filtering. This program will attach to the XDP (eXpress Data Path) hook and drop incoming TCP packets destined for a specific port (e.g., 8080), logging the action using bpf_printk.

#include <linux/bpf.h>             // Core BPF definitions, e.g., XDP_PASS, XDP_DROP. Requires kernel headers. 
#include <linux/if_ether.h>        // Ethernet header definitions 
#include <linux/ip.h>              // IP header definitions 
#include <linux/tcp.h>             // TCP header definitions 
#include <bpf/bpf_helpers.h>       // BPF helper functions, e.g., bpf_printk 
#include <bpf/bpf_endian.h>        // Byte order conversion helpers 
 
char _license[] SEC("license") = "GPL"; // Required for many BPF helpers 
 
// Define a map for statistics if needed, not used in this simple example. 
// struct bpf_map_def SEC("maps") my_map = { 
//     .type        = BPF_MAP_TYPE_ARRAY, 
//     .key_size    = sizeof(u32), 
//     .value_size  = sizeof(u64), 
//     .max_entries = 1, 
// }; 
 
SEC("xdp") // This macro places the function in the "xdp" section for the BPF loader 
int xdp_drop_port(struct xdp_md *ctx) { 
    void *data_end = (void *)(long)ctx->data_end; 
    void *data = (void *)(long)ctx->data; 
    struct ethhdr *eth = data; 
    struct iphdr *ip; 
    struct tcphdr *tcp; 
 
    // Ensure we can access the Ethernet header 
    if (data + sizeof(*eth) > data_end) 
        return XDP_PASS; // Packet too short, pass it 
 
    // Check if it's an IP packet 
    if (bpf_ntohs(eth->h_proto) != ETH_P_IP) 
        return XDP_PASS; // Not an IP packet, pass 
 
    // Access IP header 
    ip = data + sizeof(*eth); 
    if (data + sizeof(*eth) + sizeof(*ip) > data_end) 
        return XDP_PASS; // IP header too short 
 
    // Check if it's a TCP packet 
    if (ip->protocol != IPPROTO_TCP) 
        return XDP_PASS; // Not a TCP packet, pass 
 
    // Access TCP header 
    tcp = (struct tcphdr *)(ip + 1); // TCP header immediately follows IP header 
    if ((void *)tcp + sizeof(*tcp) > data_end) 
        return XDP_PASS; // TCP header too short 
 
    // Drop packets destined for TCP port 8080 (example) 
    if (bpf_ntohs(tcp->dest) == 8080) { 
        bpf_printk("XDP: Dropping TCP packet to port %d!n", bpf_ntohs(tcp->dest)); 
        return XDP_DROP; // Drop the packet 
    } 
 
    return XDP_PASS; // Allow other packets to pass 
} 

Save this code as xdp_drop_port.c. The SEC(