bpf: split eBPF out of NET