Skip connections bind to local IPAddress - #389
Skip connections bind to local IPAddress#389Zhidong Peng (ZhidongPeng) wants to merge 9 commits into
Conversation
…into bindLocalIP
|
|
||
| #[repr(C)] | ||
| #[derive(Clone, Copy, Debug)] | ||
| pub struct audit_only_event { |
There was a problem hiding this comment.
it does not match gpa_audit_event.h
// Audit-only ring-buffer record. The kernel timestamp is monotonic; user mode
// adds UTC at receipt because eBPF does not expose a UTC clock on all platforms.
struct gpa_audit_only_event
{
__u64 kernel_timestamp_ns;
__u32 local_ipv4;
struct gpa_audit_event audit;
};
|
|
||
| pub struct AuditOnlyRecord { | ||
| pub entry: AuditEntry, | ||
| pub kernel_timestamp_ns: u64, |
There was a problem hiding this comment.
we need to use this kernel_timestamp_ns to tell this pid is a valid one or not.
| pub entry: AuditEntry, | ||
| pub kernel_timestamp_ns: u64, | ||
| pub timestamp_utc_ns: i128, | ||
| pub local_ipv4: u32, |
There was a problem hiding this comment.
we may need to have ipv6?
| .await | ||
| { | ||
| Ok(claims) => format!( | ||
| "eBPF audit-only connection: timestampUtcNs={}, kernelTimestampNs={}, localIp={}, userName={}, processId={}, processName={}, processFullPath={}, processCmdLine={}, runAsElevated={}, destination={}:{}", |
There was a problem hiding this comment.
message prefix is unnecessary.
There was a problem hiding this comment.
timestampUtcNs and kernelTimestampNs are not human readable
| let destination_port = entry.destination_port_in_host_byte_order(); | ||
| let message = match Claims::from_audit_entry( | ||
| &entry, | ||
| std::net::IpAddr::V4(std::net::Ipv4Addr::UNSPECIFIED), // not used for audit-only, so just use unspecified |
There was a problem hiding this comment.
please indicate why they are not used, are they included into the telemetry message?
There was a problem hiding this comment.
client_ip is needed,
local_port is not needed/used.
| }; | ||
| event_logger::write_event( | ||
| LoggerLevel::Warn, | ||
| message, |
There was a problem hiding this comment.
how to query or filter the message? let's use json format for the message.
1 participant
Context:
Client http request bind to local ip (ex 10.0.0.4) when communicating to the host endpoints, for example:
curl --interface 10.0.0.4curl(1) - Linux manual page.GPA ProxyServer listens to loopback/localhost IP, but OS networking kernel, not eBPF, could NOT redirect such requests to loopback/localhost IP address. The OS rejects this because:
Changes:
config_mapto accept settingsGPA_CONFIG_LOCAL_IP_BIND_MONITOR_ONLYaudit_only_mapto cache connections bind to local IP addressGPA_CONFIG_LOCAL_IP_BIND_MONITOR_ONLYset, skip the redirect if the connections bind to local IP Addresspoll_audit_onlytask to read/pop the elem from ebpf mapaudit_only_mapand emit telemetry event every few seconds.Known issue:
poll_audit_onlytask to read/pop every few seconds, the process details may not available if the process exits quickly