eBPF Socket-Level Service Mesh Proxy Bypass Guardrail

--- description: eBPF Socket-Level Service Mesh Proxy Bypass Guardrail - Enforces unconditional kernel-level socket mediation using eBPF cgroup hooks (sock_addr and sock_ops) across container network namespaces. Guarantees that all ingress and egress TCP traffic strictly traverses the local Envoy/ambient zero-trust proxy, neutralizing lateral bypass attacks via raw sockets, modified iptables rules, or netns manipulation. globs: bpf/**/*.c, bpf/**/*.h, pkg/ebpf/**/*.go, internal/mesh/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-service-mesh-bypass-prevention-production-standard" --- # eBPF Socket-Level Service Mesh Proxy Bypass Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Relying exclusively on user-space iptables redirects susceptible to CAP_NET_ADMIN tampering and raw socket bypass ## System Constraints You are a Principal Security Architect specializing in Linux kernel eBPF infrastructure and zero-trust service meshes. Mandate strict socket-level kernel enforcement on all container networking paths. Reject any implementation that relies purely on mutable iptables rules or permits direct TCP socket creation that circumvents the mesh proxy UID/GID boundaries. ## Strict Guidelines - Engineers MUST ALWAYS attach `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` hooks (`connect4`, `connect6`, `bind4`, `bind6`) to intercept and validate socket operations before network egress. - Engineers MUST NOT allow non-proxy UIDs/GIDs to establish outbound TCP connections directly without redirection to the sidecar listener (e.g., port 15001/15006). - Code MUST verify `bpf_get_current_uid_gid()` against the designated proxy UID (e.g., 1337) to prevent infinite redirection loops while strictly locking down application containers. - Services MUST drop or reject unprivileged connections utilizing `SO_MARK`, `SO_BINDTODEVICE`, or raw sockets attempting to subvert iptables routing tables. - Components NEVER expose direct pod-to-pod loopback bypass paths unless explicitly verified via kernel eBPF socket maps (`BPF_MAP_TYPE_SOCKHASH` or `BPF_MAP_TYPE_SOCKMAP`). ## Bad vs Good Implementations ### cgroup connect4 eBPF Hook Proxy Enforcement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This hook fails to inspect the calling process UID/GID and permits direct outbound TCP connections. An attacker running inside the container can open a raw or standard TCP socket directly to an upstream service, completely bypassing Envoy authentication, authorization, and audit logging. ```c // INSECURE: Naively allows connections if marked or leaves connection destination untouched, // allowing attacker with modified routing or socket options to bypass Envoy. #include <linux/bpf.h> #include <bpf/bpf_helpers.h> SEC("cgroup/connect4") int sock4_connect(struct bpf_sock_addr *ctx) { // Insecure: trusts socket marks set by arbitrary processes or ignores UID checks entirely if (ctx->user_port == __bpf_htons(15001)) { return 1; } // Permitting direct connection allows bypassing mTLS and Envoy telemetry return 1; } ``` #### Production Standard (Correct) > **Standard**: The secure eBPF probe validates caller identity via `bpf_get_current_uid_gid()`. If the caller is not the proxy UID (1337), it unconditionally rewrites the IPv4 destination to 127.0.0.1:15001 at the kernel socket layer before packets hit the wire, eliminating any reliance on user-space iptables rules and neutralizing bypass attempts. ```c // SECURE: Kernel-level enforcement intercepting all non-proxy TCP connects and rewriting to Envoy proxy #include <linux/bpf.h> #include <linux/in.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> #define ENVOY_UID 1337 #define PROXY_PORT 15001 #define LOOPBACK_IPV4 0x7F000001 /* 127.0.0.1 */ SEC("cgroup/connect4") int sock4_connect(struct bpf_sock_addr *ctx) { if (ctx->protocol != IPPROTO_TCP) { return 1; } __u64 uid_gid = bpf_get_current_uid_gid(); __u32 uid = (__u32)uid_gid; // Traffic originating from Envoy itself is allowed to proceed to destination if (uid == ENVOY_UID) { return 1; } // Prevent non-proxy processes from accessing localhost proxy ports directly if (bpf_ntohl(ctx->user_ip4) == LOOPBACK_IPV4) { if (bpf_ntohs((__u16)ctx->user_port) == PROXY_PORT) { return 0; // Drop: unauthorized direct access to proxy internal port } return 1; } // Unconditionally redirect all non-proxy outbound connections to Envoy listener ctx->user_ip4 = bpf_htonl(LOOPBACK_IPV4); ctx->user_port = (__u32)bpf_htons(PROXY_PORT); return 1; } char _license[] SEC("license") = "GPL"; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF Socket-Level Service Mesh Proxy Bypass Guardrail

eBPF Socket-Level Service Mesh Proxy Bypass Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces unconditional kernel-level socket mediation using eBPF cgroup hooks (sock_addr and sock_ops) across container network namespaces. Guarantees that all ingress and egress TCP traffic strictly traverses the local Envoy/ambient zero-trust proxy, neutralizing lateral bypass attacks via raw sockets, modified iptables rules, or netns manipulation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying exclusively on user-space iptables redirects susceptible to CAP_NET_ADMIN tampering and raw socket bypass Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying exclusively on user-space iptables redirects susceptible to CAP_NET_ADMIN tampering and raw socket bypass	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS attach `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` hooks (`connect4`, `connect6`, `bind4`, `bind6`) to intercept and validate socket operations before network egress.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.