BruceFan's Blog

Stay hungry, stay foolish

0%

eBPF LSM阻断网络连接

发表于 Edited on

编写eBPF程序

本文主要介绍eBPF LSM在网络连接方面的基本用法，hook点为socket_connect，在主机尝试连接外部IP时进行监控。如果IP在黑名单中，则阻断主机连接，可以用来对抗反弹shell。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_endian.h>

char LICENSE[] SEC("license") = "GPL";

#define EPERM  1
#define AF_INET 2

const __u32 blockip = 0xac12c05a; // 172.18.192.90

SEC("lsm/socket_connect")
int BPF_PROG(restricted_connect, struct socket *sock, struct sockaddr *address, int addrlen)
{
    if (address->sa_family == AF_INET) {
        u32 pid = bpf_get_current_pid_tgid() >> 32;
        struct sockaddr_in *addr = (struct sockaddr_in *)address;

        if (addr->sin_addr.s_addr == bpf_htonl(blockip)) {
            bpf_printk("[LSM] PID: %d, Block ip: 0x%x connect", pid, addr->sin_addr.s_addr);
            return -EPERM;
        }
    }
    return 0;
}

编写用户态程序

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
#include <stdio.h>
#include <unistd.h>
#include <sys/resource.h>
#include <bpf/libbpf.h>
#include "lsm_socket.skel.h"

static int libbpf_print_fn(enum libbpf_print_level level, const char *format, va_list args)
{
	return vfprintf(stderr, format, args);
}

int main(int argc, char **argv)
{
	struct lsm_socket_bpf *skel;
	int err;
	/* Set up libbpf errors and debug info callback */
	libbpf_set_print(libbpf_print_fn);
	/* Open, load, and verify BPF application */
	skel = lsm_socket_bpf__open_and_load();
	if (!skel) {
		fprintf(stderr, "Failed to open and load BPF skeleton\n");
		goto cleanup;
	}
	/* Attach lsm handler */
	err = lsm_socket_bpf__attach(skel);
	if (err) {
		fprintf(stderr, "Failed to attach BPF skeleton\n");
		goto cleanup;
	}
	printf("Successfully started! Please run `sudo cat /sys/kernel/tracing/trace_pipe` "
	       "to see output of the BPF programs.\n");

	for (;;) {
		/* trigger our BPF program */
		fprintf(stderr, ".");
		sleep(1);
	}

cleanup:
	lsm_socket_bpf__destroy(skel);
	return -err;
}

编译运行

将程序放到libbpf-bootstrap中，在Makefile中添加lsm_socket选项，执行：

1
2
3
4
5
6
7
8
9
10
$ make lsm_socket
  BPF      .output/lsm_socket.bpf.o
  GEN-SKEL .output/lsm_socket.skel.h
  CC       .output/lsm_socket.o
  BINARY   lsm_socket
$ sudo ./lsm_socket
libbpf: map 'lsm_socket.rodata': created successfully, fd=3
libbpf: map '.rodata.str1.1': created successfully, fd=4
Successfully started! Please run `sudo cat /sys/kernel/tracing/trace_pipe` to see output of the BPF programs.
.........

另起一个终端，尝试连接172.18.192.90:

1
2
3
4
5
$ ssh fanrong@172.18.192.90
ssh: connect to host 172.18.192.90 port 22: Operation not permitted
$ curl 172.18.192.90:8000
curl: (7) Couldn't connect to server
$ nc 172.18.192.90 12345

查看eBPF输出：

1
2
3
4
$ sudo cat /sys/kernel/tracing/trace_pipe
             ssh-2345943 [009] ...11 5528714.988958: bpf_trace_printk: [LSM] PID: 2345943, Block ip: 0x5ac012ac connect
            curl-2345979 [013] ...11 5528721.954221: bpf_trace_printk: [LSM] PID: 2345979, Block ip: 0x5ac012ac connect
              nc-2346210 [002] ...11 5528826.776166: bpf_trace_printk: [LSM] PID: 2346210, Block ip: 0x5ac012ac connect

三种连接都被LSM阻断了。

reference
https://eunomia.dev/zh/tutorials/19-lsm-connect/
https://github.com/mrtc0/bouheki/blob/master/pkg/bpf/c/restricted-network.bpf.c