eBPF sock_ops Socket-Level Mesh Bypass Mitigation Standard

--- description: eBPF sock_ops Socket-Level Mesh Bypass Mitigation Standard - Mandates zero-bypass transport layer interception in eBPF sock_ops and sockhash/sockmap redirection routines. Enforces strict cgroup namespace isolation, caller UID validation, and mandatory proxy traversal to guarantee mutual TLS and L7 security policy inspection cannot be circumnavigated at the socket layer. globs: bpf/**/*.c, bpf/**/*.h, pkg/ebpf/**/*.go, pkg/mesh/**/*.go, deploy/cilium/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-sockops-mesh-bypass-mitigation" --- # eBPF sock_ops Socket-Level Mesh Bypass Mitigation Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Unvalidated BPF Sockmap Short-Circuiting Bypassing Service Mesh Proxy and mTLS Enforcement ## System Constraints You are a Principal Systems and Kernel Security Architect enforcing strict eBPF sock_ops and socket redirection standards. In service mesh topologies, short-circuiting local TCP sockets via bpf_msg_redirect_hash or bpf_sock_hash_update can silently circumvent mTLS handshake verification, L7 WAF policies, and audit telemetry. You must ensure all eBPF programs validate proxy UID/cgroup lineage, enforce fallback to proxy listeners, and prohibit raw socket map short-circuiting without active mutual TLS termination. ## Strict Guidelines - Engineers MUST ALWAYS validate socket caller identity via bpf_get_current_uid_gid() or cgroupv2 ID before inserting socket file descriptors into BPF_MAP_TYPE_SOCKHASH or BPF_MAP_TYPE_SOCKMAP structures. - Engineers MUST NOT allow non-proxy workloads to short-circuit transport redirection directly to destination sockets without transiting the designated proxy cgroup/UID for mTLS termination. - Code SHOULD verify connection state transitions (BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) and cross-reference policy maps before assigning redirect actions in BPF_PROG_TYPE_SK_MSG handlers. - Services MUST implement fail-closed behavior where unrecognized or unvalidated socket keys trigger fallback to standard kernel network stack processing where iptables/TPROXY rules remain as defense-in-depth. - Components NEVER drop or skip socket attribution telemetry; all sock_ops interception and map-redirect failure events must emit BPF ring buffer notifications for real-time auditability. ## Bad vs Good Implementations ### Mitigating Service Mesh Socket-Level Bypass in eBPF sock_ops #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The sock_ops program captures established TCP sockets and unconditionally registers them in the socket hash map. Any local container can communicate with peer containers directly through the kernel socket transport layer, bypassing the proxy daemon (e.g., Envoy or Istio ztunnel), thereby evading mTLS verification, L7 authorization checks, and security audit logging. ```c #include <linux/bpf.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> struct { __uint(type, BPF_MAP_TYPE_SOCKHASH); __uint(max_entries, 65535); __type(key, struct sock_key); __type(value, __u64); } sock_ops_map SEC(".maps"); SEC("sockops") int bpf_sockmap_intercept(struct bpf_sock_ops *skops) { __u32 op = skops->op; // VULNERABILITY: Blindly redirects all local TCP traffic directly // between sockets. Bypasses Envoy/ztunnel sidecars, completely // disabling mTLS encryption and L7 policy enforcement. if (op == BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB || op == BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB) { struct sock_key key = {}; key.sip4 = skops->local_ip4; key.dip4 = skops->remote_ip4; key.sport = bpf_htonl(skops->local_port); key.dport = skops->remote_port; bpf_sock_hash_update(skops, &sock_ops_map, &key, BPF_NOEXIST); } return 0; } ``` #### Production Standard (Correct) > **Standard**: The hardened sock_ops program inspects the calling UID and cgroup context against a mesh security policy map before registering sockets into sock_ops_map. Raw workload traffic that has not been authenticated and terminated by the proxy UID (e.g., 1337) is prevented from short-circuiting, forcing it through standard kernel interception paths where mTLS and L7 inspection policies are enforced. ```c #include <linux/bpf.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> #define PROXY_UID 1337 #define POLICY_ALLOW 1 struct sock_key { __u32 sip4; __u32 dip4; __u32 sport; __u32 dport; }; struct { __uint(type, BPF_MAP_TYPE_SOCKHASH); __uint(max_entries, 65535); __type(key, struct sock_key); __type(value, __u64); } sock_ops_map SEC(".maps"); struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 1024); __type(key, __u64); // cgroup_id __type(value, __u32); } mesh_enforcement_policy SEC(".maps"); SEC("sockops") int bpf_sockmap_intercept(struct bpf_sock_ops *skops) { __u32 op = skops->op; if (op != BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB && op != BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB) { return 0; } __u64 current_uid_gid = bpf_get_current_uid_gid(); __u32 uid = (__u32)current_uid_gid; __u64 cgroup_id = bpf_get_current_cgroup_id(); // Verify whether this cgroup requires mandatory mesh proxying __u32 *policy = bpf_map_lookup_elem(&mesh_enforcement_policy, &cgroup_id); if (policy && *policy == POLICY_ALLOW) { // ONLY proxy UID traffic is permitted to establish direct sockmap acceleration. // Non-proxy workloads must route through proxy listener via TCP stack / TPROXY. if (uid != PROXY_UID) { // Fail closed to proxy: Do not update sockhash; force network stack traversal. return 0; } struct sock_key key = { .sip4 = skops->local_ip4, .dip4 = skops->remote_ip4, .sport = bpf_htonl(skops->local_port), .dport = skops->remote_port, }; bpf_sock_hash_update(skops, &sock_ops_map, &key, BPF_NOEXIST); } return 0; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF sock_ops Socket-Level Mesh Bypass Mitigation Standard

eBPF sock_ops Socket-Level Mesh Bypass Mitigation Standard defines an industrial-grade behavioral standard for devops engineering. Mandates zero-bypass transport layer interception in eBPF sock_ops and sockhash/sockmap redirection routines. Enforces strict cgroup namespace isolation, caller UID validation, and mandatory proxy traversal to guarantee mutual TLS and L7 security policy inspection cannot be circumnavigated at the socket layer. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unvalidated BPF Sockmap Short-Circuiting Bypassing Service Mesh Proxy and mTLS Enforcement Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unvalidated BPF Sockmap Short-Circuiting Bypassing Service Mesh Proxy and mTLS Enforcement	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS validate socket caller identity via bpf_get_current_uid_gid() or cgroupv2 ID before inserting socket file descriptors into BPF_MAP_TYPE_SOCKHASH or BPF_MAP_TYPE_SOCKMAP structures.

Engineers MUST ALWAYS validate socket caller identity via bpf_get_current_uid_gid() or cgroupv2 ID before inserting socket file descriptors into BPF_MAP_TYPE_SOCKHASH or BPF_MAP_TYPE_SOCKMAP structures.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.