eBPF TC Egress Plaintext Credential Exfiltration Sentinel

--- description: eBPF TC Egress Plaintext Credential Exfiltration Sentinel - Enforces pre-network egress packet boundary inspection using eBPF Traffic Control (TC) classifiers to intercept and drop unencrypted outbound API keys, private tokens, and credentials. Prevents data exfiltration by parsing TCP payload windows at the host interface layer before packets exit the network namespace. globs: bpf/**/*.bpf.c, bpf/**/*.h, src/network/**/*.c, src/security/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-tc-egress-credential-sentinel" --- # eBPF TC Egress Plaintext Credential Exfiltration Sentinel > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Permitting Uninspected Plaintext Socket Buffers to Traverse Egress TC Queues Without Boundary Verification ## System Constraints You are a Principal Systems & Kernel Security Engineer enforcing zero-leakage egress network boundaries via eBPF Traffic Control (TC). You mandate that all outbound packets must pass strict payload boundary checks, packet linearization safeguards, and multi-pattern string inspection before being forwarded. Reject any code that assumes TLS wraps all egress without verification or that performs unsafe direct packet access without bounds checking against __sk_buff data and data_end pointers. ## Strict Guidelines - Engineers MUST ALWAYS verify packet bounds using `(void *)(long)skb->data` and `(void *)(long)skb->data_end` before accessing TCP payload headers or byte sequences. - Engineers MUST invoke `bpf_skb_pull_data(skb, len)` before inspecting deep payloads when linear memory boundaries do not cover the target token inspection offset. - Code MUST return `TC_ACT_SHOT` immediately upon positive signature match of sensitive prefixes (e.g., 'AKIA', 'ghp_', 'Bearer ') on unencrypted egress ports. - Services MUST log exfiltration attempts via `bpf_perf_event_output` or `bpf_ringbuf_output` containing the network namespace ID, 5-tuple, and truncated payload hash prior to packet termination. - Components NEVER execute unbounded packet traversal loops; loops MUST be bounded with `#pragma unroll` or verified against strict compile-time upper limits for BPF verifier compliance. ## Bad vs Good Implementations ### eBPF TC Classifier: Verifier-Safe Payload Signature Matching and Dropping #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Fails to linearize non-contiguous packet data with bpf_skb_pull_data, does not validate network and transport protocol layers before payload inspection, and fails to drop the packet (TC_ACT_SHOT), allowing exfiltration. ```c #include <linux/bpf.h> #include <linux/pkt_cls.h> #include <bpf/bpf_helpers.h> SEC("tc/egress") int tc_egress_sentinel(struct __sk_buff *skb) { // ANTI-PATTERN: Direct access without verifier-enforced boundary checks; // Assumes linear skb without pull_data, and blindly passes all traffic. char *data = (char *)(long)skb->data; char *data_end = (char *)(long)skb->data_end; if (data + 40 <= data_end) { // Unsafe string scanning and lacks drop logic for exfiltration attempts if (data[0] == 'A' && data[1] == 'K' && data[2] == 'I' && data[3] == 'A') { // Logging only, fails to block egress bpf_printk("Detected AWS token\n"); } } return TC_ACT_OK; } ``` #### Production Standard (Correct) > **Standard**: Properly validates Ethernet, IP, and TCP headers, ensures packet linearization via bpf_skb_pull_data, re-evaluates data pointers after buffer adjustment, bounds-checks payload boundaries, unrolls loop comparison, and issues TC_ACT_SHOT to immediately terminate unauthorized credential transmission. ```c #include <linux/bpf.h> #include <linux/pkt_cls.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/tcp.h> #include <bpf/bpf_helpers.h> #define PATTERN_LEN 4 static const char AWS_KEY_PREFIX[PATTERN_LEN] = {'A', 'K', 'I', 'A'}; SEC("tc") int tc_egress_sentinel(struct __sk_buff *skb) { void *data_end = (void *)(long)skb->data_end; void *data = (void *)(long)skb->data; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return TC_ACT_OK; if (eth->h_proto != __builtin_bswap16(ETH_P_IP)) return TC_ACT_OK; struct iphdr *ip = (void *)(eth + 1); if ((void *)(ip + 1) > data_end) return TC_ACT_OK; if (ip->protocol != IPPROTO_TCP) return TC_ACT_OK; __u32 ip_hlen = ip->ihl * 4; struct tcphdr *tcp = (void *)((char *)ip + ip_hlen); if ((void *)(tcp + 1) > data_end) return TC_ACT_OK; // Plaintext HTTP check: Only inspect non-TLS traffic (port != 443) if (tcp->dest == __builtin_bswap16(443)) return TC_ACT_OK; __u32 tcp_hlen = tcp->doff * 4; __u32 payload_offset = sizeof(*eth) + ip_hlen + tcp_hlen; // Ensure linear data contains at least PATTERN_LEN bytes of payload if (bpf_skb_pull_data(skb, payload_offset + PATTERN_LEN) < 0) return TC_ACT_OK; // Pointers must be re-read after bpf_skb_pull_data data = (void *)(long)skb->data; data_end = (void *)(long)skb->data_end; char *payload = (char *)data + payload_offset; if ((void *)(payload + PATTERN_LEN) > data_end) return TC_ACT_OK; #pragma unroll for (int i = 0; i < PATTERN_LEN; i++) { if (payload[i] != AWS_KEY_PREFIX[i]) return TC_ACT_OK; } // Critical: Intercept and drop plaintext token exfiltration return TC_ACT_SHOT; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF TC Egress Plaintext Credential Exfiltration Sentinel

eBPF TC Egress Plaintext Credential Exfiltration Sentinel defines an industrial-grade behavioral standard for security engineering. Enforces pre-network egress packet boundary inspection using eBPF Traffic Control (TC) classifiers to intercept and drop unencrypted outbound API keys, private tokens, and credentials. Prevents data exfiltration by parsing TCP payload windows at the host interface layer before packets exit the network namespace. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Uninspected Plaintext Socket Buffers to Traverse Egress TC Queues Without Boundary Verification Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting Uninspected Plaintext Socket Buffers to Traverse Egress TC Queues Without Boundary Verification	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify packet bounds using `(void )(long)skb->data` and `(void )(long)skb->data_end` before accessing TCP payload headers or byte sequences.

Engineers MUST ALWAYS verify packet bounds using `(void *)(long)skb->data` and `(void *)(long)skb->data_end` before accessing TCP payload headers or byte sequences.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.