eBPF TC Egress Zero-Trust mTLS & Direct Packet Attestation Standard

--- description: eBPF TC Egress Zero-Trust mTLS & Direct Packet Attestation Standard - Enforces cryptographic identity verification at the Linux Traffic Control (TC) clsact layer using eBPF classifiers before socket buffers (skb) traverse network devices. Prevents service mesh egress sidecar bypasses and malicious raw socket transmission by validating authenticated workload identity tokens directly within packet headers. globs: **/*.bpf.c, **/*.bpf.h, bpf/**/*.c, pkg/ebpf/**/*.go, src/security/ebpf/**/*.c alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-tc-zero-trust-packet-attestation" --- # eBPF TC Egress Zero-Trust mTLS & Direct Packet Attestation Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Relying Exclusively on iptables Sidecar Redirection Without Kernel-Level TC Cryptographic Attestation ## System Constraints You are a Principal Security and Systems Engineer enforcing strict eBPF Traffic Control (TC) zero-trust mTLS packet attestation. In cloud-native environments, standard netfilter/iptables sidecar proxy redirection can be bypassed via direct raw socket allocation (CAP_NET_RAW) or namespace escapes. You mandate kernel-level TC layer ingress/egress inspection to cryptographically verify workload identity markers (e.g., SPIFFE IDs embedded in custom skb headers/IP options) before any frame is transmitted or handed over to the network stack. Reject all unauthenticated traffic with TC_ACT_SHOT and enforce absolute BPF verifier safety. ## Strict Guidelines - Engineers MUST ALWAYS attach eBPF classifiers to the TC clsact egress hook to inspect all outbound packets prior to NIC transmission. - Engineers MUST NOT permit packet forwarding (TC_ACT_OK) for egress packets lacking verified cryptographic identity markers or valid session attestations. - Code MUST perform strict bounds verification on skb->data and skb->data_end for every header offset to satisfy the BPF verifier and eliminate out-of-bounds memory accesses. - Services MUST drop unauthorized traffic immediately using TC_ACT_SHOT and emit ring buffer security telemetry events when attestation fails. - Components NEVER rely on userspace socket credentials alone when securing inter-workload traffic against raw socket bypass attacks. ## Bad vs Good Implementations ### eBPF TC Egress Hook: Direct Cryptographic Packet Attestation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This classifier assumes userspace redirection or packet marks are unforgeable, allowing any process with raw socket capabilities or mutated netfilter rules to bypass service mesh mTLS entirely. ```c // Insecure: Permissive TC filter blindly trusting socket metadata or UID // without validating cryptographic packet-level attestation tokens. #include <linux/bpf.h> #include <linux/pkt_cls.h> #include <bpf/bpf_helpers.h> SEC("tc/egress_bypass") int tc_egress_insecure(struct __sk_buff *skb) { // Anti-pattern: Relies on mutable skb socket marks or passes everything // assuming iptables or userspace envoy sidecar handled mTLS. if (skb->mark == 0x1337) { return TC_ACT_OK; // Vulnerable to raw socket injection with forged marks } return TC_ACT_OK; // Allows unauthenticated bypass } ``` #### Production Standard (Correct) > **Standard**: Performs verifier-safe packet boundary checks, inspects wire-level attestation headers directly at the TC layer, validates tokens against in-kernel security maps, and drops any packets attempting unauthenticated egress bypass. ```c // Secure: Strict TC egress classifier validating cryptographic packet attestation token #include <linux/bpf.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/tcp.h> #include <linux/pkt_cls.h> #include <bpf/bpf_helpers.h> #define ATTESTATION_MAGIC 0x53504946 // SPIF struct attestation_hdr { __u32 magic; __u32 workload_id; __u64 token_hmac; }; struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 10240); __type(key, __u32); __type(value, __u64); } active_workload_tokens SEC(".maps"); SEC("tc") int tc_egress_attest(struct __sk_buff *skb) { void *data_end = (void *)(long)skb->data_end; void *data = (void *)(long)skb->data; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return TC_ACT_SHOT; if (eth->h_proto != __constant_htons(ETH_P_IP)) return TC_ACT_OK; struct iphdr *ip = (void *)(eth + 1); if ((void *)(ip + 1) > data_end) return TC_ACT_SHOT; if (ip->protocol != IPPROTO_TCP) return TC_ACT_OK; struct tcphdr *tcp = (void *)ip + (ip->ihl * 4); if ((void *)(tcp + 1) > data_end) return TC_ACT_SHOT; struct attestation_hdr *attest = (void *)tcp + (tcp->doff * 4); if ((void *)(attest + 1) > data_end) return TC_ACT_SHOT; // Missing cryptographic attestation payload if (attest->magic != __constant_htonl(ATTESTATION_MAGIC)) return TC_ACT_SHOT; // Invalid zero-trust identifier __u64 *valid_token = bpf_map_lookup_elem(&active_workload_tokens, &attest->workload_id); if (!valid_token || *valid_token != attest->token_hmac) return TC_ACT_SHOT; // Forged or expired attestation marker return TC_ACT_OK; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF TC Egress Zero-Trust mTLS & Direct Packet Attestation Standard

eBPF TC Egress Zero-Trust mTLS & Direct Packet Attestation Standard defines an industrial-grade behavioral standard for devops engineering. Enforces cryptographic identity verification at the Linux Traffic Control (TC) clsact layer using eBPF classifiers before socket buffers (skb) traverse network devices. Prevents service mesh egress sidecar bypasses and malicious raw socket transmission by validating authenticated workload identity tokens directly within packet headers. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying Exclusively on iptables Sidecar Redirection Without Kernel-Level TC Cryptographic Attestation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying Exclusively on iptables Sidecar Redirection Without Kernel-Level TC Cryptographic Attestation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS attach eBPF classifiers to the TC clsact egress hook to inspect all outbound packets prior to NIC transmission.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.