1
#include <linux/bpf.h>
2
#include <bpf/bpf_helpers.h>
3
#include <linux/if_ether.h>
4
#include <linux/ip.h>
5
#include <linux/tcp.h>
6

7
// Map：IP 黑名单
8
struct {
9
    __uint(type, BPF_MAP_TYPE_HASH);
10
    __uint(max_entries, 10000);
11
    __type(key, __u32);    // IP 地址
12
    __type(value, __u32);  // 0=黑名单
13
} blacklist SEC(".maps");
14

15
// Map：速率限制计数器
16
struct {
17
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
18
    __uint(max_entries, 10000);
19
    __type(key, __u32);    // IP 地址
20
    __type(value, struct rate_counter);
21
} rate_limit SEC(".maps");
22

23
struct rate_counter {
24
    __u64 packets;     // 包计数
25
    __u64 last_reset;  // 上次重置时间
26
};
27

28
// Map：统计指标
29
struct {
30
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
31
    __uint(max_entries, 4);
32
    __type(key, __u32);
33
    __type(value, __u64);
34
} stats SEC(".maps");
35

36
#define STAT_TOTAL   0
37
#define STAT_BLOCKED 1
38
#define STAT_PASSED  2
39
#define STAT_RATE    3
40

41
#define MAX_PPS 1000  // 每秒最大包数
42

43
SEC("xdp")
44
int xdp_security(struct xdp_md *ctx) {
45
    void *data = (void *)(long)ctx->data;
46
    void *data_end = (void *)(long)ctx->data_end;
47

48
    // 解析以太网头
49
    struct ethhdr *eth = data;
50
    if ((void *)(eth + 1) > data_end) return XDP_PASS;
51
    if (eth->h_proto != bpf_htons(ETH_P_IP)) return XDP_PASS;
52

53
    // 解析 IP 头
54
    struct iphdr *ip = (void *)(eth + 1);
55
    if ((void *)(ip + 1) > data_end) return XDP_PASS;
56

57
    __u32 src_ip = ip->saddr;
58
    __u32 idx = STAT_TOTAL;
59
    __u64 *val = bpf_map_lookup_elem(&stats, &idx);
60
    if (val) (*val)++;
61

62
    // 1. 黑名单检查
63
    __u32 *blocked = bpf_map_lookup_elem(&blacklist, &src_ip);
64
    if (blocked) {
65
        idx = STAT_BLOCKED;
66
        val = bpf_map_lookup_elem(&stats, &idx);
67
        if (val) (*val)++;
68
        return XDP_DROP;
69
    }
70

71
    // 2. 速率限制
72
    struct rate_counter *rc = bpf_map_lookup_elem(&rate_limit, &src_ip);
73
    if (!rc) {
74
        struct rate_counter new_rc = {1, bpf_ktime_get_ns()};
75
        bpf_map_update_elem(&rate_limit, &src_ip, &new_rc, BPF_ANY);
76
    } else {
77
        __u64 now = bpf_ktime_get_ns();
78
        __u64 elapsed = now - rc->last_reset;
79
        if (elapsed > 1000000000ULL) {  // 1 秒
80
            rc->packets = 1;
81
            rc->last_reset = now;
82
        } else {
83
            rc->packets++;
84
            if (rc->packets > MAX_PPS) {
85
                idx = STAT_RATE;
86
                val = bpf_map_lookup_elem(&stats, &idx);
87
                if (val) (*val)++;
88
                return XDP_DROP;
89
            }
90
        }
91
    }
92

93
    // 3. SYN Flood 检测（简化）
94
    if (ip->protocol == IPPROTO_TCP) {
95
        struct tcphdr *tcp = (void *)(ip + 1);
96
        if ((void *)(tcp + 1) > data_end) return XDP_PASS;
97
        if (tcp->syn && !tcp->ack) {
98
            // SYN 包：可进一步检测
99
            bpf_trace_printk("SYN from %x\\n", src_ip);
100
        }
101
    }
102

103
    idx = STAT_PASSED;
104
    val = bpf_map_lookup_elem(&stats, &idx);
105
    if (val) (*val)++;
106

107
    return XDP_PASS;
108
}
109

110
char LICENSE[] SEC("license") = "GPL";

1
#include <linux/bpf.h>
2
#include <bpf/bpf_helpers.h>
3
#include <linux/pkt_cls.h>
4

5
// Map：端口过滤规则
6
struct {
7
    __uint(type, BPF_MAP_TYPE_HASH);
8
    __uint(max_entries, 100);
9
    __type(key, __u16);    // 端口号
10
    __type(value, __u32);  // 0=允许, 1=拒绝
11
} port_filter SEC(".maps");
12

13
// Map：带宽限制
14
struct {
15
    __uint(type, BPF_MAP_TYPE_HASH);
16
    __uint(max_entries, 100);
17
    __type(key, __u32);    // IP 地址
18
    __type(value, struct bw_limit);
19
} bandwidth SEC(".maps");
20

21
struct bw_limit {
22
    __u64 bytes_sent;
23
    __u64 last_reset;
24
    __u64 max_bytes;  // 每秒最大字节
25
};
26

27
SEC("tc")
28
int tc_security(struct __sk_buff *skb) {
29
    void *data = (void *)(long)skb->data;
30
    void *data_end = (void *)(long)skb->data_end;
31

32
    struct ethhdr *eth = data;
33
    if ((void *)(eth + 1) > data_end) return TC_ACT_OK;
34
    if (eth->h_proto != bpf_htons(ETH_P_IP)) return TC_ACT_OK;
35

36
    struct iphdr *ip = (void *)(eth + 1);
37
    if ((void *)(ip + 1) > data_end) return TC_ACT_OK;
38

39
    // 端口过滤
40
    if (ip->protocol == IPPROTO_TCP) {
41
        struct tcphdr *tcp = (void *)(ip + 1);
42
        if ((void *)(tcp + 1) > data_end) return TC_ACT_OK;
43

44
        __u16 dst_port = bpf_ntohs(tcp->dest);
45
        __u32 *action = bpf_map_lookup_elem(&port_filter, &dst_port);
46
        if (action && *action == 1) {
47
            return TC_ACT_SHOT;  // 拒绝
48
        }
49
    }
50

51
    // 带宽限制
52
    __u32 src_ip = ip->saddr;
53
    struct bw_limit *bw = bpf_map_lookup_elem(&bandwidth, &src_ip);
54
    if (bw) {
55
        __u64 now = bpf_ktime_get_ns();
56
        __u64 elapsed = now - bw->last_reset;
57
        if (elapsed > 1000000000ULL) {
58
            bw->bytes_sent = skb->len;
59
            bw->last_reset = now;
60
        } else {
61
            bw->bytes_sent += skb->len;
62
            if (bw->bytes_sent > bw->max_bytes) {
63
                return TC_ACT_SHOT;  // 超出带宽限制
64
            }
65
        }
66
    }
67

68
    return TC_ACT_OK;
69
}
70

71
char LICENSE[] SEC("license") = "GPL";

1
#include <linux/bpf.h>
2
#include <bpf/bpf_helpers.h>
3

4
// Map：监控规则
5
struct {
6
    __uint(type, BPF_MAP_TYPE_HASH);
7
    __uint(max_entries, 100);
8
    __type(key, __u32);    // UID
9
    __type(value, __u32);  // 0=监控, 1=阻止
10
} exec_rules SEC(".maps");
11

12
// Map：事件日志
13
struct {
14
    __uint(type, BPF_MAP_TYPE_RINGBUF);
15
    __uint(max_entries, 256 * 1024);
16
} events SEC(".maps");
17

18
struct exec_event {
19
    __u32 uid;
20
    __u32 pid;
21
    char comm[16];
22
    char filename[256];
23
};
24

25
// Hook：进程执行
26
SEC("lsm/bprm_check_security")
27
int BPF_PROG(check_exec, struct linux_binprm *bprm) {
28
    __u32 uid = bpf_get_current_uid_gid() >> 32;
29
    __u32 pid = bpf_get_current_pid_tgid() >> 32;
30

31
    // 检查规则
32
    __u32 *rule = bpf_map_lookup_elem(&exec_rules, &uid);
33
    if (rule && *rule == 1) {
34
        // 阻止执行
35
        struct exec_event *e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
36
        if (e) {
37
            e->uid = uid;
38
            e->pid = pid;
39
            bpf_get_current_comm(e->comm, sizeof(e->comm));
40
            bpf_probe_read_kernel_str(e->filename, sizeof(e->filename),
41
                                      bprm->filename);
42
            bpf_ringbuf_submit(e, 0);
43
        }
44
        return -EPERM;  // 阻止
45
    }
46

47
    // 记录事件
48
    struct exec_event *e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
49
    if (e) {
50
        e->uid = uid;
51
        e->pid = pid;
52
        bpf_get_current_comm(e->comm, sizeof(e->comm));
53
        bpf_probe_read_kernel_str(e->filename, sizeof(e->filename),
54
                                  bprm->filename);
55
        bpf_ringbuf_submit(e, 0);
56
    }
57

58
    return 0;  // 允许
59
}
60

61
// Hook：文件打开（检测敏感文件访问）
62
SEC("lsm/file_open")
63
int BPF_PROG(check_file_open, struct file *file) {
64
    // 检测 /etc/shadow, /etc/passwd 等敏感文件访问
65
    char filename[64];
66
    bpf_probe_read_kernel_str(filename, sizeof(filename),
67
                              file->f_path.dentry->d_name.name);
68

69
    if (filename[0] == 's' && filename[1] == 'h' &&
70
        filename[2] == 'a' && filename[3] == 'd') {
71
        // shadow 文件访问
72
        bpf_trace_printk("sensitive file access: %s\\n", filename);
73
    }
74

75
    return 0;
76
}
77

78
char LICENSE[] SEC("license") = "GPL";