Nova ruleset evaluation in bpf probes by haesbaert · Pull Request #309 · elastic/quark

haesbaert · 2026-04-16T13:30:28Z

This implements the basic rule matching for nova probes, this diff does
basically two things:

o - Actually load QQ_NOVA probes
o - Installs the quark_ruleset into the BPF probes so we can evaluate rules in
kernel land. Path matching is still missing but this is a good start.

We support 1024 rules, and for the first version we will require 5.17 so we have
bpf_loop(). We do some slightly smart things like diminishing the amount of
branches the verifier has to calculate by doing branchless comparisons in the
evaluation loop, this is likely not necessary for 5.17 as bpf_loop() saves a lot
of budget.

Next step is implementing path matching via bpf_strncmp() or manually, since we
likely don't need TRIE for this.

haesbaert · 2026-04-16T16:34:42Z

so canonical is robbing us of our productivity, there's something going on with the apt repositories, that's why CI is failing

This implements the basic rule matching for nova probes, this diff does basically two things: o - Actually load QQ_NOVA probes o - Installs the quark_ruleset into the BPF probes so we can evaluate rules in kernel land. Path matching is still missing but this is a good start. We support 1024 rules, and for the first version we will require 5.17 so we have bpf_loop(). We do some slightly smart things like diminishing the amount of branches the verifier has to calculate by doing branchless comparisons in the evaluation loop, this is likely not necessary for 5.17 as bpf_loop() saves a lot of budget. Next step is implementing path matching via bpf_strncmp() or manually, since we likely don't need TRIE for this.

haesbaert requested a review from a team as a code owner April 16, 2026 13:30