eBPF

Collection of BPF programs for Linux.

• Host Isolation

Host Isolation

Programs

• KprobeConnectHook hooks into tcp_v4_connect and adds destination IP to allowlist if PID is allowed
• TcFilter attaches to network interface and filters packets based on allowed IPs

Demo

• UpdateIPsDemo Userspace tool for updating IP and subnet allowlist
• UpdatePidsDemo Userspace tool for updating PID allowlist
• KprobeConnectHookDemo Loader for KprobeConnectHook eBPF program
• TcLoaderDemo Loader for TcFilter eBPF program, attaches to ens33 interface by default

Tests (BPF_PROG_TEST_RUN)

BPFTcFilterTests

BPFTcFilterTests test suite for the TcFilter.bpf.o program

Usage

cd build/target/ebpf
sudo ../test/BPFTcFilterTests

Or if you want to use a custom path for the eBPF object file.

sudo ELASTIC_EBPF_TC_FILTER_OBJ_PATH=build/target/ebpf/TcFilter.bpf.o  build/target/test/BPFTcFilterTests

Build dependencies

Some distros might not have bmake or an older CMake, compiling them from source is usually a good alternative.

bmake is the NetBSD make tool and it's used to build elftoolchain's libelf, the BSD Licensed ELF library we use as alternative to the GNU/Linux licensed elfutils's libelf.

Ubuntu/Debian

apt install clang llvm cmake bmake zlib1g-dev m4 gcc g++ libc6-dev-i386

CentOS/Fedora/AL2

yum install gcc g++ clang llvm zlib-devel m4 bmake

Build

The build is a pretty standard CMake project.

mkdir build
cd build
cmake ..
make

Besides the usual CMake variables, you can set the following variables which are specific to this project.

target
├── ebpf
│   ├── KprobeConnectHook.bpf.o
│   └── TcFilter.bpf.o
├── include
│   ├── Common.h
│   ├── KprobeLoader.h
│   ├── TcLoader.h
│   └── UpdateMaps.h
├── libeBPF.a
└── test
    └── BPFTcFilterTests

Directory layout:

• contrib/ external dependencies, libraries
  • contrib/elftoolchain repo: github.com/elftoolchain/elftoolchain@11d16eab
  • contrib/kernel_hdrs headers with eBPF definitions, copied 1:1 from kernel sources
  • contrib/libbpf repo: github.com/libbpf/[email protected]
  • contrib/googletest repo: github.com/google/googletest@955c7f83
• GPL eBPF programs which are GPL licensed
• non-GPL tools, utilities with Elastic non-GPL license