eBPF sock_ops L4 Direct Socket Redirection and Namespace Boundary Enforcement

--- description: eBPF sock_ops L4 Direct Socket Redirection and Namespace Boundary Enforcement - Mandates strict network namespace (netns) cookie verification, socket state validation, and symmetric hash lifecycle cleanup in eBPF sock_ops and sk_msg programs. Prevents cross-tenant socket hijacking, policy enforcement bypasses, and kernel memory corruption during L4 TCP/IP short-circuiting in sidecarless mesh architectures. globs: bpf/**/*.c, bpf/**/*.h, pkg/ebpf/**/*.go, src/**/*.bpf.c alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-sockops-netns-boundary-redirection-invariant" --- # eBPF sock_ops L4 Direct Socket Redirection and Namespace Boundary Enforcement > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Blind 4-Tuple Socket Redirection Without Namespace Cookie Validation and State Cleanup ## System Constraints You are a Principal Systems Engineer and Kernel Security Architect enforcing strict namespace isolation and socket lifecycle invariants in eBPF sock_ops and sk_msg programs for sidecarless ambient service meshes. You must reject any socket redirection implementation that omits netns cookie checks, fails to guard against cross-tenant socket collisions, or neglects deterministic cleanup on connection termination. ## Strict Guidelines - Engineers MUST ALWAYS validate network namespace isolation using `bpf_get_netns_cookie(skops)` before inserting sockets into `BPF_MAP_TYPE_SOCKHASH` or `BPF_MAP_TYPE_SOCKMAP`. - Engineers MUST NOT bypass the host network namespace boundary or allow unauthenticated intra-host redirection between isolated cgroups/pods. - Code SHOULD include the 64-bit network namespace cookie as a composite key component alongside the 4-tuple (src_ip, dst_ip, src_port, dst_port) to prevent cross-netns hash collisions. - Services MUST explicitly handle `BPF_SOCK_OPS_STATE_CB` transitions and delete corresponding entries from the redirection maps upon `BPF_TCP_CLOSE` to prevent dangling references and socket reuse corruption. - Components NEVER redirect raw sockets across transport boundaries without asserting `skops->family == AF_INET || skops->family == AF_INET6` and `skops->sk->sk_protocol == IPPROTO_TCP`. ## Bad vs Good Implementations ### eBPF sock_ops Socket Hash Registration with Namespace Boundary Checking #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The code omits network namespace validation via bpf_get_netns_cookie and uses a bare 4-tuple key. Pods sharing overlapping loopback or private addresses across separate netns domains will experience cross-tenant socket hijacking and bypass L4/L7 mTLS policy enforcement. ```c // BAD: Blind 4-tuple insertion without netns isolation or state validation SEC("sockops") int bpf_sockmap_redirection(struct bpf_sock_ops *skops) { if (skops->op != BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB && skops->op != BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) { return 0; } struct sock_key key = { .sip4 = skops->local_ip4, .dip4 = skops->remote_ip4, .sport = skops->local_port, .dport = bpf_ntohl(skops->remote_port), }; // Blind update: Allows cross-pod socket hijacking across namespaces bpf_sock_hash_update(skops, &sock_hash_map, &key, BPF_NOEXIST); return 0; } ``` #### Production Standard (Correct) > **Standard**: Validates socket family, extracts the kernel netns cookie via bpf_get_netns_cookie(skops) for the composite map key, and symmetrically removes the socket entry on BPF_TCP_CLOSE to ensure strict namespace isolation and leak prevention. ```c // GOOD: Composite key with netns cookie verification and lifecycle cleanup SEC("sockops") int bpf_sockmap_redirection(struct bpf_sock_ops *skops) { __u32 op = skops->op; // Handle TCP teardown to prevent stale socket memory leak and reuse collision if (op == BPF_SOCK_OPS_STATE_CB) { if (skops->args[1] == BPF_TCP_CLOSE) { struct sock_key key = { .netns_cookie = bpf_get_netns_cookie(skops), .sip4 = skops->local_ip4, .dip4 = skops->remote_ip4, .sport = skops->local_port, .dport = bpf_ntohl(skops->remote_port), }; bpf_map_delete_elem(&sock_hash_map, &key); } return 0; } if (op != BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB && op != BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) { return 0; } if (skops->family != AF_INET) { return 0; } __u64 netns = bpf_get_netns_cookie(skops); if (netns == 0) { return 0; // Reject sockets outside verified container namespaces } struct sock_key key = { .netns_cookie = netns, .sip4 = skops->local_ip4, .dip4 = skops->remote_ip4, .sport = skops->local_port, .dport = bpf_ntohl(skops->remote_port), }; bpf_sock_hash_update(skops, &sock_hash_map, &key, BPF_ANY); return 0; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF sock_ops L4 Direct Socket Redirection and Namespace Boundary Enforcement

eBPF sock_ops L4 Direct Socket Redirection and Namespace Boundary Enforcement defines an industrial-grade behavioral standard for devops engineering. Mandates strict network namespace (netns) cookie verification, socket state validation, and symmetric hash lifecycle cleanup in eBPF sock_ops and sk_msg programs. Prevents cross-tenant socket hijacking, policy enforcement bypasses, and kernel memory corruption during L4 TCP/IP short-circuiting in sidecarless mesh architectures. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Blind 4-Tuple Socket Redirection Without Namespace Cookie Validation and State Cleanup Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Blind 4-Tuple Socket Redirection Without Namespace Cookie Validation and State Cleanup	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS validate network namespace isolation using `bpf_get_netns_cookie(skops)` before inserting sockets into `BPF_MAP_TYPE_SOCKHASH` or `BPF_MAP_TYPE_SOCKMAP`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.