microsoft / microsoft/ebpf-for-windows
Implement connect redirect and bind redirect.
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
(This issue is created from some of the tasks in #786 that was incorrectly associated with the wrong program type)
### Describe the feature you'd like supported
An eBPF program of type BPF_PROG_TYPE_SOCK_ADDR program type attached to `BPF_CGROUP_INETx_CONNECT` can be used to redirect or rebind a connection at connect time.
Example: https://github.com/torvalds/linux/blob/fc02cb2b37fe2cbf1d3334b9f0f0eab9431766c4/tools/testing/selftests/bpf/progs/connect_force_port4.c
```
SEC("cgroup/connect4")
int connect4(struct bpf_sock_addr *ctx)
{
struct sockaddr_in sa = {};
struct svc_addr *orig;
/* Force local address to 127.0.0.1:22222. */
sa.sin_family = AF_INET;
sa.sin_port = bpf_htons(22222);
sa.sin_addr.s_addr = bpf_htonl(0x7f000001);
if (bpf_bind(ctx, (struct sockaddr *)&sa, sizeof(sa)) != 0)
return 0;
/* Rewire service 1.2.3.4:60000 to backend 127.0.0.1:60123. */
if (ctx->user_port == bpf_htons(60000)) {
orig = bpf_sk_storage_get(&service_mapping, ctx->sk, 0,
BPF_SK_STORAGE_GET_F_CREATE);
if (!orig)
return 0;
orig->addr = ctx->user_ip4;
orig->port = ctx->user_port;
ctx->user_ip4 = bpf_htonl(0x7f000001);
ctx->user_port = bpf_htons(60123);
}
return 1;
}
```
Relevant Helper function:
- [ ] bpf_bind
### Proposed solution
Enhance the netebpfext to implement callouts at ALE connect/bind redirect layers.
Calling bpf_bind() may not be possible from INETx_CONNECT attach type. For that, INETx_BIND attach time may be needed.
### Additional context
_No response_
Contributor guide
Research direction
Start with the referenced Linux selftest connect_force_port4.c and the proposed netebpfext ALE connect/bind redirect layers. Determine how BPF_PROG_TYPE_SOCK_ADDR programs attach to BPF_CGROUP_INETx_CONNECT and INETx_BIND, including the bpf_bind helper. Done means connect and bind redirect or rebind behavior is implemented and covered by tests for the relevant IPv4 and IPv6 paths.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100