eBPF Program for Handling IPv4 TCP Connections with Proxy Redirection

#include <stddef.h> #include "bpf.h" #include <linux/netfilter_ipv4.h> #include <linux/in.h>

#include "bpf-builtin.h" #include "bpf-utils.h"

#define MAX_CONNECTIONS 20000

struct Config { __u16 proxy_port; __u64 pipy_pid; };

struct Socket { __u32 src_addr; __u16 src_port; __u32 dst_addr; __u16 dst_port; };

struct { int (*type)[BPF_MAP_TYPE_HASH]; int (*max_entries)[1]; __u32 *key; struct Config *value; } map_config SEC(".maps");

struct { int (*type)[BPF_MAP_TYPE_HASH]; int (*max_entries)[MAX_CONNECTIONS]; __u64 *key; struct Socket *value; } map_socks SEC(".maps");

struct { int (*type)[BPF_MAP_TYPE_HASH]; int (*max_entries)[MAX_CONNECTIONS]; __u16 *key; __u64 *value; } map_ports SEC(".maps");

int cg_connect4(struct bpf_sock_addr *ctx) { if (ctx->user_family != 2) return 1; if (ctx->protocol != IPPROTO_TCP) return 1;

__u32 i = 0; struct Config *conf = bpf_map_lookup_elem(&map_config, &i); if (!conf) return 1; if ((bpf_get_current_pi

It looks like your code snippet was cut off. However, I can provide some insights and suggestions based on the provided code.

The code appears to be an eBPF program designed to handle network connections, specifically for TCP connections in an IPv4 context. The program uses several eBPF maps to store configuration, socket information, and port mappings. Here's a breakdown of the key components and some suggestions for completing the function cg_connect4:

Key Components

1. Configuration Map (map_config):

   • Stores a single configuration entry that includes a proxy port and a process ID (pipy_pid).

2. Socket Map (map_socks):

   • Stores information about active connections, keyed by a unique identifier (likely a combination of source and destination addresses and ports).

3. Port Map (map_ports):

   • Maps port numbers to unique identifiers, possibly to track which connections are associated with which ports.

cg_connect4 Function

This function is a BPF program that is triggered on a connect syscall for IPv4 TCP connections. The function performs the following steps:

1. Check the Address Family and Protocol:

   • Ensures the connection is for IPv4 (user_family == 2) and TCP (protocol == IPPROTO_TCP).

2. Lookup Configuration:

   • Retrieves the configuration from map_config.

3. Check Process ID:

   • Compares the current process ID with the one stored in the configuration to determine if the connection should be handled.

Completing the Function

To complete the cg_connect4 function, you need to handle the connection logic based on the configuration and possibly update the socket and port maps. Here is a possible continuation and completion of the function:

int cg_connect4(struct bpf_sock_addr *ctx) {
  if (ctx->user_family != AF_INET) return 1;
  if (ctx->protocol != IPPROTO_TCP) return 1;

  __u32 i = 0;
  struct Config *conf = bpf_map_lookup_elem(&map_config, &i);
  if (!conf) return 1;

  // Check if the current process ID matches the configured pipy_pid
  if (bpf_get_current_pid_tgid() >> 32 != conf->pipy_pid) return 1;

  // Create a unique key for the connection
  __u64 key = ((__u64)ctx->user_ip4 << 32) | ctx->user_port;

  // Lookup the socket information in the map_socks
  struct Socket sock = {
    .src_addr = ctx->user_ip4,
    .src_port = ctx->user_port,
    .dst_addr = ctx->msg_src_ip4,
    .dst_port = ctx->msg_src_port
  };

  // Update the socket map with the new connection
  bpf_map_update_elem(&map_socks, &key, &sock, BPF_ANY);

  // Update the port map with the new connection
  bpf_map_update_elem(&map_ports, &ctx->user_port, &key, BPF_ANY);

  // Redirect the connection to the proxy port if necessary
  if (ctx->user_port == conf->proxy_port) {
    ctx->user_ip4 = bpf_htonl(INADDR_LOOPBACK);
    ctx->user_port = bpf_htons(conf->proxy_port);
  }

  return 0;
}

Explanation

1. Check Process ID:

   • The function checks if the current process ID matches the configured pipy_pid. If not, it returns 1 to allow the connection to proceed normally.

2. Create a Unique Key:

   • A unique key is created for the connection using the source IP and port.

3. Update Socket Map:

   • The socket information is stored in the map_socks map using the unique key.

4. Update Port Map:

   • The port map is updated to associate the port with the unique key.

5. Redirect Connection:

   • If the connection is to the proxy port, it redirects the connection to the loopback address and the proxy port.

This is a basic implementation and may need adjustments based on your specific requirements and environment. Make sure to test thoroughly in a