eBPF for Windows
Loading...
Searching...
No Matches
ebpf_nethooks.h
Go to the documentation of this file.
1// Copyright (c) eBPF for Windows contributors
2// SPDX-License-Identifier: MIT
3#pragma once
4#include <stdint.h>
5
6// This file contains APIs for hooks and helpers that are
7// exposed by netebpfext.sys for use by eBPF programs.
8
9#ifndef __doxygen
10#define EBPF_HELPER(return_type, name, args) typedef return_type(*const name##_t) args
11#endif
12
13// BIND hook
14
21
32
39
50typedef bind_action_t
52
53//
54// CGROUP_SOCK_ADDR.
55//
56
63
64#ifdef _MSC_VER
65#pragma warning(push)
66#pragma warning(disable : 4201)
67#endif
71typedef struct bpf_sock_addr
72{
73 uint32_t family;
74 struct
75 {
80 union
81 {
82 uint32_t msg_src_ip4;
83 uint32_t msg_src_ip6[4];
84 };
85 uint16_t msg_src_port;
86 };
87 struct
88 {
89 /* @brief Destination IP address in network byte order.
90 * Local for egress, remote for ingress.
91 */
92 union
93 {
94 uint32_t user_ip4;
95 uint32_t user_ip6[4];
96 };
97 uint16_t user_port;
98 };
99 uint32_t protocol;
100 uint32_t compartment_id;
101 uint64_t interface_luid;
103
104#define SOCK_ADDR_EXT_HELPER_FN_BASE 0xFFFF
105
111
123EBPF_HELPER(int, bpf_sock_addr_set_redirect_context, (bpf_sock_addr_t * ctx, void* data, uint32_t data_size));
124#ifndef __doxygen
125#define bpf_sock_addr_set_redirect_context \
126 ((bpf_sock_addr_set_redirect_context_t)BPF_FUNC_sock_addr_set_redirect_context)
127#endif
128
149
159
160typedef struct _bpf_sock_ops
161{
163 uint32_t family;
164 struct
165 {
166 union
167 {
168 uint32_t local_ip4;
169 uint32_t local_ip6[4];
170 };
171 uint32_t local_port;
172 };
173 struct
174 {
175 union
176 {
177 uint32_t remote_ip4;
178 uint32_t remote_ip6[4];
179 };
180 uint32_t remote_port;
181 };
182 uint8_t protocol;
183 uint32_t compartment_id;
184 uint64_t interface_luid;
186
199typedef int
201
202#ifdef _MSC_VER
203#pragma warning(pop)
204#endif
enum _bind_operation bind_operation_t
#define SOCK_ADDR_EXT_HELPER_FN_BASE
Definition ebpf_nethooks.h:104
ebpf_sock_addr_verdict_t sock_addr_hook_t(bpf_sock_addr_t *context)
Handle socket operation. Currently supports ingress/egress connection initialization.
Definition ebpf_nethooks.h:148
enum _ebpf_sock_addr_verdict ebpf_sock_addr_verdict_t
ebpf_sock_addr_helper_id_t
Definition ebpf_nethooks.h:107
@ BPF_FUNC_sock_addr_set_redirect_context
Definition ebpf_nethooks.h:109
@ BPF_FUNC_sock_addr_get_current_pid_tgid
Definition ebpf_nethooks.h:108
enum _bpf_sock_op_type bpf_sock_op_type_t
int sock_ops_hook_t(bpf_sock_ops_t *context)
Handle socket event notification. Currently notifies ingress/egress connection establishment and tear...
Definition ebpf_nethooks.h:200
int bpf_sock_addr_set_redirect_context(bpf_sock_addr_t *ctx, void *data, uint32_t data_size)
Set a context for consumption by a user-mode application (sock_addr specific only)....
_bind_operation
Definition ebpf_nethooks.h:16
@ BIND_OPERATION_BIND
Entry to bind.
Definition ebpf_nethooks.h:17
@ BIND_OPERATION_UNBIND
Release port.
Definition ebpf_nethooks.h:19
@ BIND_OPERATION_POST_BIND
After port allocation.
Definition ebpf_nethooks.h:18
_bind_action
Definition ebpf_nethooks.h:34
@ BIND_REDIRECT
Change the bind endpoint.
Definition ebpf_nethooks.h:37
@ BIND_PERMIT
Permit the bind operation.
Definition ebpf_nethooks.h:35
@ BIND_DENY
Deny the bind operation.
Definition ebpf_nethooks.h:36
_bpf_sock_op_type
Definition ebpf_nethooks.h:151
@ BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB
Indicates when a passive (inbound) connection is established.
Definition ebpf_nethooks.h:155
@ BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB
Indicates when an active (outbound) connection is established.
Definition ebpf_nethooks.h:153
@ BPF_SOCK_OPS_CONNECTION_DELETED_CB
Indicates when a connection is deleted.
Definition ebpf_nethooks.h:157
bind_action_t bind_hook_t(bind_md_t *context)
Handle an AF_INET socket bind() request.
Definition ebpf_nethooks.h:51
struct bpf_sock_addr bpf_sock_addr_t
Data structure used as context for BPF_PROG_TYPE_CGROUP_SOCK_ADDR program type.
_ebpf_sock_addr_verdict
Definition ebpf_nethooks.h:58
@ BPF_SOCK_ADDR_VERDICT_REJECT
Definition ebpf_nethooks.h:59
@ BPF_SOCK_ADDR_VERDICT_PROCEED_SOFT
Definition ebpf_nethooks.h:60
@ BPF_SOCK_ADDR_VERDICT_PROCEED_HARD
Definition ebpf_nethooks.h:61
enum _bind_action bind_action_t
struct _bind_md bind_md_t
struct _bpf_sock_ops bpf_sock_ops_t
Definition ebpf_nethooks.h:23
uint8_t protocol
Protocol number (e.g., IPPROTO_TCP).
Definition ebpf_nethooks.h:30
bind_operation_t operation
Operation to do.
Definition ebpf_nethooks.h:29
uint8_t * app_id_end
Pointer to end of App ID.
Definition ebpf_nethooks.h:25
uint8_t socket_address[16]
Socket address to bind to.
Definition ebpf_nethooks.h:27
uint64_t process_id
Process ID.
Definition ebpf_nethooks.h:26
uint8_t * app_id_start
Pointer to start of App ID.
Definition ebpf_nethooks.h:24
uint8_t socket_address_length
Length in bytes of the socket address.
Definition ebpf_nethooks.h:28
Definition ebpf_nethooks.h:161
uint32_t local_ip4
Definition ebpf_nethooks.h:168
uint32_t family
IP address family.
Definition ebpf_nethooks.h:163
uint32_t remote_ip4
Definition ebpf_nethooks.h:177
uint32_t compartment_id
Network compartment Id.
Definition ebpf_nethooks.h:183
uint8_t protocol
IP protocol.
Definition ebpf_nethooks.h:182
uint32_t remote_port
Definition ebpf_nethooks.h:180
uint64_t interface_luid
Interface LUID.
Definition ebpf_nethooks.h:184
uint32_t local_ip6[4]
Definition ebpf_nethooks.h:169
bpf_sock_op_type_t op
Definition ebpf_nethooks.h:162
uint32_t remote_ip6[4]
Definition ebpf_nethooks.h:178
uint32_t local_port
Definition ebpf_nethooks.h:171
Data structure used as context for BPF_PROG_TYPE_CGROUP_SOCK_ADDR program type.
Definition ebpf_nethooks.h:72
uint32_t protocol
IP protocol.
Definition ebpf_nethooks.h:99
uint16_t user_port
Destination port in network byte order.
Definition ebpf_nethooks.h:97
uint16_t msg_src_port
Source port in network byte order.
Definition ebpf_nethooks.h:85
uint32_t user_ip4
Definition ebpf_nethooks.h:94
uint32_t user_ip6[4]
Definition ebpf_nethooks.h:95
uint32_t compartment_id
Network compartment Id.
Definition ebpf_nethooks.h:100
uint32_t msg_src_ip6[4]
Definition ebpf_nethooks.h:83
uint64_t interface_luid
Interface LUID.
Definition ebpf_nethooks.h:101
uint32_t msg_src_ip4
Definition ebpf_nethooks.h:82
uint32_t family
IP address family.
Definition ebpf_nethooks.h:73