eBPF for Windows
ebpf_nethooks.h
Go to the documentation of this file.
1 // Copyright (c) Microsoft Corporation
2 // SPDX-License-Identifier: MIT
3 #pragma once
4 #include <stdint.h>
5 
6 // This file contains APIs for hooks and helpers that are
7 // exposed by netebpfext.sys for use by eBPF programs.
8 
9 // XDP hook. We use "struct xdp_md" for cross-platform compatibility.
10 typedef struct xdp_md
11 {
12  void* data;
13  void* data_end;
14  uint64_t data_meta;
15  uint32_t ingress_ifindex;
16 
17  /* size: 26, cachelines: 1, members: 4 */
18  /* last cacheline: 26 bytes */
20 
21 typedef enum _xdp_action
22 {
23  XDP_PASS = 1,
25  XDP_TX
27 
38 typedef xdp_action_t
39 xdp_hook_t(xdp_md_t* context);
40 
41 // XDP helper functions.
42 #define XDP_EXT_HELPER_FN_BASE 0xFFFF
43 
44 #ifndef __doxygen
45 #define EBPF_HELPER(return_type, name, args) typedef return_type(*name##_t) args
46 #endif
47 
48 typedef enum
49 {
52 
62 EBPF_HELPER(int, bpf_xdp_adjust_head, (xdp_md_t * ctx, int delta));
63 #ifndef __doxygen
64 #define bpf_xdp_adjust_head ((bpf_xdp_adjust_head_t)BPF_FUNC_xdp_adjust_head)
65 #endif
66 
67 // BIND hook
68 
69 typedef enum _bind_operation
70 {
75 
76 typedef struct _bind_md
77 {
78  uint8_t* app_id_start;
79  uint8_t* app_id_end;
80  uint64_t process_id;
81  uint8_t socket_address[16];
84  uint8_t protocol;
86 
87 typedef enum _bind_action
88 {
93 
104 typedef bind_action_t
106 
107 //
108 // CGROUP_SOCK_ADDR.
109 //
110 
111 #define BPF_SOCK_ADDR_VERDICT_REJECT 0
112 #define BPF_SOCK_ADDR_VERDICT_PROCEED 1
113 
114 #ifdef _MSC_VER
115 #pragma warning(push)
116 #pragma warning(disable : 4201)
117 #endif
121 typedef struct bpf_sock_addr
122 {
123  uint32_t family;
124  struct
125  {
130  union
131  {
132  uint32_t msg_src_ip4;
133  uint32_t msg_src_ip6[4];
134  };
135  uint16_t msg_src_port;
136  };
137  struct
138  {
139  /* @brief Destination IP address in network byte order.
140  * Local for egress, remote for ingress.
141  */
142  union
143  {
144  uint32_t user_ip4;
145  uint32_t user_ip6[4];
146  };
147  uint16_t user_port;
148  };
149  uint32_t protocol;
150  uint32_t compartment_id;
151  uint64_t interface_luid;
153 
171 typedef int
173 
174 typedef enum _bpf_sock_op_type
175 {
183 
184 typedef struct _bpf_sock_ops
185 {
187  uint32_t family;
188  struct
189  {
190  union
191  {
192  uint32_t local_ip4;
193  uint32_t local_ip6[4];
194  };
195  uint32_t local_port;
196  };
197  struct
198  {
199  union
200  {
201  uint32_t remote_ip4;
202  uint32_t remote_ip6[4];
203  };
204  uint32_t remote_port;
205  };
206  uint8_t protocol;
207  uint32_t compartment_id;
208  uint64_t interface_luid;
210 
223 typedef int
225 
226 #ifdef _MSC_VER
227 #pragma warning(pop)
228 #endif
enum _bind_operation bind_operation_t
enum _bpf_sock_op_type bpf_sock_op_type_t
int sock_addr_hook_t(bpf_sock_addr_t *context)
Handle socket operation. Currently supports ingress/egress connection initialization.
Definition: ebpf_nethooks.h:172
int sock_ops_hook_t(bpf_sock_ops_t *context)
Handle socket event notification. Currently notifies ingress/egress connection establishment and tear...
Definition: ebpf_nethooks.h:224
_xdp_action
Definition: ebpf_nethooks.h:22
@ XDP_TX
Bounce the received packet back out the same NIC it arrived on.
Definition: ebpf_nethooks.h:25
@ XDP_PASS
Allow the packet to pass.
Definition: ebpf_nethooks.h:23
@ XDP_DROP
Drop the packet.
Definition: ebpf_nethooks.h:24
_bind_operation
Definition: ebpf_nethooks.h:70
@ BIND_OPERATION_BIND
Entry to bind.
Definition: ebpf_nethooks.h:71
@ BIND_OPERATION_UNBIND
Release port.
Definition: ebpf_nethooks.h:73
@ BIND_OPERATION_POST_BIND
After port allocation.
Definition: ebpf_nethooks.h:72
xdp_action_t xdp_hook_t(xdp_md_t *context)
Handle an incoming packet as early as possible.
Definition: ebpf_nethooks.h:39
enum _xdp_action xdp_action_t
_bind_action
Definition: ebpf_nethooks.h:88
@ BIND_REDIRECT
Change the bind endpoint.
Definition: ebpf_nethooks.h:91
@ BIND_PERMIT
Permit the bind operation.
Definition: ebpf_nethooks.h:89
@ BIND_DENY
Deny the bind operation.
Definition: ebpf_nethooks.h:90
_bpf_sock_op_type
Definition: ebpf_nethooks.h:175
@ BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB
Indicates when a passive (inbound) connection is established.
Definition: ebpf_nethooks.h:179
@ BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB
Indicates when an active (outbound) connection is established.
Definition: ebpf_nethooks.h:177
@ BPF_SOCK_OPS_CONNECTION_DELETED_CB
Indicates when a connection is deleted.
Definition: ebpf_nethooks.h:181
bind_action_t bind_hook_t(bind_md_t *context)
Handle an AF_INET socket bind() request.
Definition: ebpf_nethooks.h:105
struct bpf_sock_addr bpf_sock_addr_t
Data structure used as context for BPF_PROG_TYPE_CGROUP_SOCK_ADDR program type.
ebpf_nethook_helper_id_t
Definition: ebpf_nethooks.h:49
@ BPF_FUNC_xdp_adjust_head
Definition: ebpf_nethooks.h:50
#define XDP_EXT_HELPER_FN_BASE
Definition: ebpf_nethooks.h:42
struct xdp_md xdp_md_t
enum _bind_action bind_action_t
struct _bind_md bind_md_t
struct _bpf_sock_ops bpf_sock_ops_t
int bpf_xdp_adjust_head(xdp_md_t *ctx, int delta)
Adjust XDP context data pointer.
Definition: ebpf_nethooks.h:77
uint8_t protocol
Protocol number (e.g., IPPROTO_TCP).
Definition: ebpf_nethooks.h:84
bind_operation_t operation
Operation to do.
Definition: ebpf_nethooks.h:83
uint8_t * app_id_end
Pointer to end of App ID.
Definition: ebpf_nethooks.h:79
uint8_t socket_address[16]
Socket address to bind to.
Definition: ebpf_nethooks.h:81
uint64_t process_id
Process ID.
Definition: ebpf_nethooks.h:80
uint8_t * app_id_start
Pointer to start of App ID.
Definition: ebpf_nethooks.h:78
uint8_t socket_address_length
Length in bytes of the socket address.
Definition: ebpf_nethooks.h:82
Definition: ebpf_nethooks.h:185
uint32_t local_ip4
Definition: ebpf_nethooks.h:192
uint32_t family
IP address family.
Definition: ebpf_nethooks.h:187
uint32_t remote_ip4
Definition: ebpf_nethooks.h:201
uint32_t compartment_id
Network compartment Id.
Definition: ebpf_nethooks.h:207
uint8_t protocol
IP protocol.
Definition: ebpf_nethooks.h:206
uint32_t remote_port
Definition: ebpf_nethooks.h:204
uint64_t interface_luid
Interface LUID.
Definition: ebpf_nethooks.h:208
uint32_t local_ip6[4]
Definition: ebpf_nethooks.h:193
bpf_sock_op_type_t op
Definition: ebpf_nethooks.h:186
uint32_t remote_ip6[4]
Definition: ebpf_nethooks.h:202
uint32_t local_port
Definition: ebpf_nethooks.h:195
Data structure used as context for BPF_PROG_TYPE_CGROUP_SOCK_ADDR program type.
Definition: ebpf_nethooks.h:122
uint32_t protocol
IP protocol.
Definition: ebpf_nethooks.h:149
uint16_t user_port
Destination port in network byte order.
Definition: ebpf_nethooks.h:147
uint16_t msg_src_port
Source port in network byte order.
Definition: ebpf_nethooks.h:135
uint32_t user_ip4
Definition: ebpf_nethooks.h:144
uint32_t user_ip6[4]
Definition: ebpf_nethooks.h:145
uint32_t compartment_id
Network compartment Id.
Definition: ebpf_nethooks.h:150
uint32_t msg_src_ip6[4]
Definition: ebpf_nethooks.h:133
uint64_t interface_luid
Interface LUID.
Definition: ebpf_nethooks.h:151
uint32_t msg_src_ip4
Definition: ebpf_nethooks.h:132
uint32_t family
IP address family.
Definition: ebpf_nethooks.h:123
Definition: ebpf_nethooks.h:11
void * data_end
Pointer to end of packet data.
Definition: ebpf_nethooks.h:13
void * data
Pointer to start of packet data.
Definition: ebpf_nethooks.h:12
uint64_t data_meta
Packet metadata.
Definition: ebpf_nethooks.h:14
uint32_t ingress_ifindex
Ingress interface index.
Definition: ebpf_nethooks.h:15