bsc_ebpf.c

1. Overview

Kernel-side eBPF connection monitor. Captures TCP state transitions, TCP connect attempts and UDP send operations, enriches them with process identity and emits deduplicated connection events through a BPF ring buffer.

The original source path is:

ebpf/bsc_ebpf.c

2. Role in the Daemon

This file participates in the privileged BastionGuard Secure Connection daemon. It uses the shared bsc models and follows the daemon-wide fallback strategy: optional high-fidelity backends are used when available, while portable polling or stub behavior preserves service startup.

3. Dependencies and Included Interfaces

  • vmlinux.h
  • bpf/bpf_helpers.h
  • bpf/bpf_tracing.h
  • bpf/bpf_core_read.h
  • bpf/bpf_endian.h

4. Declared Types

  • struct bsc_conn_event
  • struct dedup_key
  • struct trace_event_raw_inet_sock_set_state
  • struct sock
  • struct msghdr
  • struct sockaddr_in
  • struct sockaddr_in6

5. API and Functions

The file declares or implements the following callable entry points:

  • fill_proc(struct bsc_conn_event* ev)
  • should_emit(const struct dedup_key* k, __u64 now_ns, __u64 window_ns)
  • SEC("tracepoint/sock/inet_sock_set_state") int bsc_inet_sock_set_state(struct trace_event_raw_inet_sock_set_state *ctx)
  • SEC("kprobe/tcp_v4_connect") int BPF_KPROBE(bsc_tcp_v4_connect, struct sock* sk)
  • SEC("kprobe/tcp_v6_connect") int BPF_KPROBE(bsc_tcp_v6_connect, struct sock* sk)
  • extract_msg_v4(struct msghdr* msg, __u32* out_daddr, __u16* out_dport)
  • extract_msg_v6(struct msghdr* msg, __u8 out_daddr[16], __u16* out_dport)
  • SEC("kprobe/udp_sendmsg") int BPF_KPROBE(bsc_udp_sendmsg, struct sock* sk, struct msghdr* msg)
  • SEC("kprobe/udpv6_sendmsg") int BPF_KPROBE(bsc_udpv6_sendmsg, struct sock* sk, struct msghdr* msg)
  • int bsc_inet_sock_set_state(struct trace_event_raw_inet_sock_set_state *ctx)
  • int BPF_KPROBE(bsc_tcp_v4_connect, struct sock* sk)
  • int BPF_KPROBE(bsc_tcp_v6_connect, struct sock* sk)
  • int BPF_KPROBE(bsc_udp_sendmsg, struct sock* sk, struct msghdr* msg)
  • int BPF_KPROBE(bsc_udpv6_sendmsg, struct sock* sk, struct msghdr* msg)

6. Constants and Compile-Time Controls

  • __u64 pid_tgid = bpf_get_current_pid_tgid()
  • __u64 uid_gid = bpf_get_current_uid_gid()
  • __u16 family = ctx->family
  • __u8 proto = (__u8)ctx->protocol
  • __u64 now = bpf_ktime_get_ns()
  • #define AF_INET 2
  • #define AF_INET6 10
  • #define TCP_ESTABLISHED 1
  • #define IPPROTO_TCP 6
  • #define IPPROTO_UDP 17
  • #define RINGBUF_SIZE (8 * 1024 * 1024)
  • #define UDP_DEDUP_WINDOW_NS (5ULL * 1000ULL * 1000ULL * 1000ULL)
  • #define TCP_DEDUP_WINDOW_NS (2ULL * 1000ULL * 1000ULL * 1000ULL)

7. Operational Flow

  1. Kernel probes build a compact connection event containing PID/TID, UID/GID, address family, protocol, source/destination endpoints and an event kind.
  2. An LRU hash map suppresses repeated events for the same process and destination inside a short time window.
  3. Accepted events are submitted to a BPF ring buffer and consumed by EBPFMon in userspace.

8. External Resources and Protocol Values

Relevant paths, endpoints, command names or policy values referenced by this file include:

  • tracepoint/sock/inet_sock_set_state
  • kprobe/tcp_v4_connect
  • kprobe/tcp_v6_connect
  • kprobe/udp_sendmsg
  • kprobe/udpv6_sendmsg

9. Security Considerations

  • Runs in the kernel verifier sandbox and must use bounded memory access.
  • Ring-buffer and LRU-map limits prevent unbounded userspace or kernel memory growth.
  • The captured process and endpoint metadata is security-sensitive and should only be exposed to the privileged daemon.

10. Implementation Considerations

  • The file follows the daemon-wide convention of returning status values or optional objects instead of making recoverable conditions fatal.

11. Licensing and Attribution

  • SPDX-License-Identifier: GPL-2.0-only
  • Copyright (C) 2025–2026 Calogero Scarnà

12. Source Metrics

MetricValue
File size15954 bytes
Lines447
Detected API entries14
Detected types7

Published on:
Last updated on: