eBPF TC Ingress Zero-Trust SPIFFE Identity Verification & Session Offload

--- description: eBPF TC Ingress Zero-Trust SPIFFE Identity Verification & Session Offload - Enforces pre-userspace kernel verification of mutual TLS (mTLS) session state and SPIFFE ID mapping directly at the Traffic Control (TC) ingress hook. Prevents unauthorized packets from traversing socket buffers into userspace sidecars (e.g., Envoy) by dropping unauthenticated traffic with BPF_DROP and caching validated SPIFFE Subject Alternative Names (SANs) in locked BPF map entries. globs: src/**/*.{c,h,bpf.c,rs,go,ts} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-tc-spiffe-zero-trust-ingress-standard" --- # eBPF TC Ingress Zero-Trust SPIFFE Identity Verification & Session Offload > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Bypassing Kernel Ingress Validation by Relying Exclusively on Userspace Envoy Proxy Handshakes ## System Constraints You are a Principal Systems & Security Architect enforcing zero-trust service mesh invariants via eBPF TC ingress filters. You must ensure all incoming service-to-service payloads undergo cryptographic verification or session-token matching at the kernel TC layer before packet buffers hit the userspace network stack. Enforce bounded loop compliance for the eBPF verifier, atomic updates to BPF session maps, and strict BPF_DROP policies for any non-verified SPIFFE identity payloads. ## Strict Guidelines - Engineers MUST ALWAYS validate packet headers and check session authentication maps at the TC ingress hook (clsact) before allowing socket buffers to advance (TC_ACT_OK). - Engineers MUST NOT allow unverified packets or untracked mTLS flows to transition past the kernel into userspace buffers, mandating an immediate return of TC_ACT_SHOT (BPF_DROP). - Code SHOULD leverage pinned BPF_MAP_TYPE_LRU_HASH maps populated by an authenticated SPIRE/userspace agent with mutual TLS connection fingerprints and verified SPIFFE IDs. - Services MUST implement atomic updates via BPF spinlocks or atomic CAS when synchronizing active SPIFFE connection session state between userspace agents and eBPF maps. - Components NEVER parse variable-length X.509 certificates unbounded in eBPF; cryptographic validation MUST occur once during the initial TLS handshake with subsequent packet flow enforced via cryptographic session hashes in kernel space. ## Bad vs Good Implementations ### Ingress SPIFFE Verification Guardrail in eBPF TC Filter #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: All packets are allowed through to the userspace proxy without kernel-level identity verification, exposing the service to kernel socket buffer exhaustion, sidecar DoS, and unauthenticated packet processing. ```c // Flawed implementation: Lets unverified packets into userspace socket buffers SEC("tc") int tc_ingress_verify(struct __sk_buff *skb) { void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; // Blindly forward all ingress traffic to userspace sidecar proxy // Vulnerable to socket buffer exhaustion and pre-proxy DoS attacks return TC_ACT_OK; } ``` #### Production Standard (Correct) > **Standard**: Inspects packet tuples at the TC ingress boundary, bounds-checks memory safely for the eBPF verifier, and looks up the SPIFFE authorization state directly in a kernel LRU hash map. Unauthorized or expired flows are immediately dropped (TC_ACT_SHOT) before memory is allocated in userspace socket buffers. ```c #include <linux/bpf.h> #include <linux/pkt_cls.h> #include <bpf/bpf_helpers.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/tcp.h> struct session_key { __u32 src_ip; __u32 dst_ip; __u16 src_port; __u16 dst_port; }; struct spiffe_identity { __u32 trust_domain_id; __u32 workload_id; __u64 session_expiry_ns; }; struct { __uint(type, BPF_MAP_TYPE_LRU_HASH); __uint(max_entries, 65536); __type(key, struct session_key); __type(value, struct spiffe_identity); } spiffe_auth_map SEC(".maps"); SEC("tc") int tc_ingress_spiffe_verify(struct __sk_buff *skb) { void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return TC_ACT_SHOT; if (eth->h_proto != __builtin_bswap16(ETH_P_IP)) return TC_ACT_OK; // Pass non-IP traffic to standard stack struct iphdr *ip = (void *)(eth + 1); if ((void *)(ip + 1) > data_end) return TC_ACT_SHOT; if (ip->protocol != IPPROTO_TCP) return TC_ACT_SHOT; // Strictly enforce TCP for mTLS/SPIFFE traffic struct tcphdr *tcp = (void *)((__u32 *)ip + ip->ihl); if ((void *)(tcp + 1) > data_end) return TC_ACT_SHOT; struct session_key key = { .src_ip = ip->saddr, .dst_ip = ip->daddr, .src_port = tcp->source, .dst_port = tcp->dest, }; struct spiffe_identity *id = bpf_map_lookup_elem(&spiffe_auth_map, &key); if (!id) return TC_ACT_SHOT; // Drop untrusted packets at NIC ingress hook if (bpf_ktime_get_ns() > id->session_expiry_ns) { bpf_map_delete_elem(&spiffe_auth_map, &key); return TC_ACT_SHOT; // Expired SPIFFE token / session } return TC_ACT_OK; // Cryptographically attested connection allowed } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF TC Ingress Zero-Trust SPIFFE Identity Verification & Session Offload

eBPF TC Ingress Zero-Trust SPIFFE Identity Verification & Session Offload defines an industrial-grade behavioral standard for security engineering. Enforces pre-userspace kernel verification of mutual TLS (mTLS) session state and SPIFFE ID mapping directly at the Traffic Control (TC) ingress hook. Prevents unauthorized packets from traversing socket buffers into userspace sidecars (e.g., Envoy) by dropping unauthenticated traffic with BPF_DROP and caching validated SPIFFE Subject Alternative Names (SANs) in locked BPF map entries. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Kernel Ingress Validation by Relying Exclusively on Userspace Envoy Proxy Handshakes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Kernel Ingress Validation by Relying Exclusively on Userspace Envoy Proxy Handshakes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS validate packet headers and check session authentication maps at the TC ingress hook (clsact) before allowing socket buffers to advance (TC_ACT_OK).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.