Andrew Stoycos astoycos

The Issue

SCTP based connect calls are not being recorded by BPF_PROG_TYPE_CGROUP_SOCK_ADDR BPF programs when attached to the BPF_CGROUP_INET4_CONNECT hook point in the default Cgroup.

As shown below (with strace) all TCP, UDP, and SCTP clients produce connect syscalls when sending data

Syscalls made by TCP Client

socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 5

SEC("cgroup/skb")
int bpf_sockops_sctp_load(struct __sk_buff *skb)
{
    void *data = (void *)(long)skb->data;
    struct eth_hdr *eth = data;
    void *data_end = (void *)(long)skb->data_end;

    __u32 dstAddr;
    int ret;

Spin up an ovn-k kind cluster

git clone https://github.com/ovn-org/ovn-kubernetes
./contrib/kind.sh

Start the Aya Loader pod

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod

This Describes how to spin up BPFD with IGNFW from https://github.com/astoycos/ingress-node-firewall/tree/bpfd-integration

(from https://github.com/redhat-et/bpfd) Spinup bpfd + Kind

cd bpfd-operator && make run-on-kind

(from https://github.com/astoycos/ingress-node-firewall/tree/bpfd-integration) Deploy the ignfw XDP program via bpfd

Create Kind Cluster

kind create cluster --name=test-bpfd

Deploy Cert manager

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml

	SEC("xdp")
	int xdp_nodeport_redirect(struct xdp_md *ctx)
	{
	void data_end = (void )(long)ctx->data_end;
	void data = (void )(long)ctx->data;
	struct bpf_fib_lookup fib_params = {};
	struct ethhdr *eth = data;
	struct tcphdr *tcph;
	u16 h_proto;
	u64 nh_off;

	{
	"start": {
	"connected": [{
	"socket": 5,
	"local_host": "192.168.122.1",
	"local_port": 47192,
	"remote_host": "192.168.122.91",
	"remote_port": 8789
	}],
	"version": "iperf 3.10.1",

	Using Socket proxy from -> https://github.com/astoycos/netns-proxy

	Native Socket redirction from -> https://github.com/astoycos/net-ebpf-playground/tree/demo/socket-redirection

	1. No bpf redirection

	```
	[astoycos@localhost net-ebpf-playground]$ iperf3 -4 -c 192.168.122.91 -p 8789
	Connecting to host 192.168.122.91, port 8789
	[ 5] local 192.168.122.1 port 58868 connected to 192.168.122.91 port 8789

	astoycos@astoycos-mac ~ % sudo ./apex-installer.sh -i

	WARNING -- This script will install software on your system. It will:
	* Install Homebrew (brew) if not already installed.
	* Install wireguard-tools with brew.
	* Download the apex agent and install it to /usr/local/sbin/apex
	Continue? (y/n): y
	[ ACTION ] Wireguard is not installed. Installing WireGuard...
	Error: Running Homebrew as root is extremely dangerous and no longer supported.
	As Homebrew does not drop privileges on installation you would be giving all

	// You can edit this code!
	// Click here and start typing.
	package main

	import (
	"context"
	"fmt"
	"time"

	"net/http"