microsoft / microsoft/ebpf-for-windows

Implement connect redirect and bind redirect.

Open
#848 1 comment 0 reactions 0 assignees View on GitHub
enhancement help wanted triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

(This issue is created from some of the tasks in #786 that was incorrectly associated with the wrong program type)

### Describe the feature you'd like supported

An eBPF program of type BPF_PROG_TYPE_SOCK_ADDR program type attached to `BPF_CGROUP_INETx_CONNECT` can be used to redirect or rebind a connection at connect time.

Example: https://github.com/torvalds/linux/blob/fc02cb2b37fe2cbf1d3334b9f0f0eab9431766c4/tools/testing/selftests/bpf/progs/connect_force_port4.c

```
SEC("cgroup/connect4")
int connect4(struct bpf_sock_addr *ctx)
{
struct sockaddr_in sa = {};
struct svc_addr *orig;

/* Force local address to 127.0.0.1:22222. */
sa.sin_family = AF_INET;
sa.sin_port = bpf_htons(22222);
sa.sin_addr.s_addr = bpf_htonl(0x7f000001);

if (bpf_bind(ctx, (struct sockaddr *)&sa, sizeof(sa)) != 0)
return 0;

/* Rewire service 1.2.3.4:60000 to backend 127.0.0.1:60123. */
if (ctx->user_port == bpf_htons(60000)) {
orig = bpf_sk_storage_get(&service_mapping, ctx->sk, 0,
BPF_SK_STORAGE_GET_F_CREATE);
if (!orig)
return 0;

orig->addr = ctx->user_ip4;
orig->port = ctx->user_port;

ctx->user_ip4 = bpf_htonl(0x7f000001);
ctx->user_port = bpf_htons(60123);
}
return 1;
}

```

Relevant Helper function:
- [ ] bpf_bind

### Proposed solution

Enhance the netebpfext to implement callouts at ALE connect/bind redirect layers.

Calling bpf_bind() may not be possible from INETx_CONNECT attach type. For that, INETx_BIND attach time may be needed.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the referenced Linux selftest connect_force_port4.c and the proposed netebpfext ALE connect/bind redirect layers. Determine how BPF_PROG_TYPE_SOCK_ADDR programs attach to BPF_CGROUP_INETx_CONNECT and INETx_BIND, including the bpf_bind helper. Done means connect and bind redirect or rebind behavior is implemented and covered by tests for the relevant IPv4 and IPv6 paths.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.