Skip to content

Add support for cgroup/connect_authorization4 and cgroup/connect_authorization6#4750

Open
Alan-Jowett wants to merge 16 commits intomicrosoft:mainfrom
Alan-Jowett:auth_connect_attach_point
Open

Add support for cgroup/connect_authorization4 and cgroup/connect_authorization6#4750
Alan-Jowett wants to merge 16 commits intomicrosoft:mainfrom
Alan-Jowett:auth_connect_attach_point

Conversation

@Alan-Jowett
Copy link
Copy Markdown
Member

@Alan-Jowett Alan-Jowett commented Oct 21, 2025 •
edited
Loading

Description

Resolves: #4751

This pull request introduces support for new eBPF attach types for socket authorization on Windows, specifically BPF_CGROUP_INET4_CONNECT_AUTHORIZATION and BPF_CGROUP_INET6_CONNECT_AUTHORIZATION. These attach types allow eBPF programs to make authorization decisions after route selection, enabling policies based on network interface, tunnel type, and route-dependent metadata.

The design is documented in docs/ConnectAuthorizationAttachTypes.md.

New Attach Types and Program Invocation Logic

  • Added BPF_CGROUP_INET4_CONNECT_AUTHORIZATION and BPF_CGROUP_INET6_CONNECT_AUTHORIZATION attach types in ebpf_structs.h with GUIDs in ebpf_program_attach_type_guids.h.
  • Section names: cgroup/connect_authorization4 and cgroup/connect_authorization6.
  • WFP layer mapping: FWPM_LAYER_ALE_AUTH_CONNECT_V4 / FWPM_LAYER_ALE_AUTH_CONNECT_V6.
  • Updated internal arrays and filter parameter mappings in net_ebpf_ext_sock_addr.c to register and handle the new attach types.
  • Extended section info in net_ebpf_ext_program_info.h for the new program sections.

Filtered Program Invocation

  • Refactored program invocation logic to support filtered invocation via net_ebpf_extension_hook_invoke_filtered_programs and net_ebpf_extension_hook_expand_stack_and_invoke_filtered_programs.
  • Each hook client tracks its attach type for correct filtering.

Additional Helper Function

  • Added bpf_sock_addr_get_network_context() helper returning bpf_sock_addr_network_context_t with fields: version, interface_type, tunnel_type, next_hop_interface_luid, sub_interface_index.
  • Available for CONNECT_AUTHORIZATION and RECV_ACCEPT attach types (next_hop_interface_luid only for CONNECT_AUTHORIZATION).

Read-Only Context Enforcement

  • CONNECT_AUTHORIZATION context is read-only; modifications override the verdict to REJECT.

Reauthorization Support

  • CONNECT_AUTHORIZATION programs are invoked during WFP reauthorization cycles.

Generalization and Backward Compatibility

  • Generalized functions to recognize all CONNECT and CONNECT_AUTHORIZATION attach types, maintaining backward compatibility.

Testing

New sample programs (cgroup_connect_authorization4.c, cgroup_connect_authorization6.c) and unit tests covering authorization, reauth, context modification rejection, and combined CONNECT + CONNECT_AUTHORIZATION scenarios.

Documentation

Design doc published separately in PR #4767: docs/ConnectAuthorizationAttachTypes.md.

Installation

No installer impact.

keith-horton
keith-horton reviewed Oct 22, 2025
View reviewed changes
Comment thread include/ebpf_structs.h Outdated
@Alan-Jowett
Copy link
Copy Markdown
Member Author

Alan-Jowett commented Oct 22, 2025

Note:
There is still an issue in this PR. The code maintains a list of programs attached to the filter context and invokes all of them for both connect and auth_connect callouts, which is wrong.

@Alan-Jowett Alan-Jowett force-pushed the auth_connect_attach_point branch from 933f0d4 to 393b85f Compare October 22, 2025 20:01
matthewige
matthewige reviewed Oct 22, 2025
View reviewed changes
Comment thread docs/ConnectAuthorizationAttachTypes.md Outdated
Comment thread docs/AuthConnectAttachTypes.md Outdated
Comment thread netebpfext/net_ebpf_ext_sock_addr.c Outdated
@Alan-Jowett Alan-Jowett force-pushed the auth_connect_attach_point branch from 7da8bcf to 9d30eed Compare October 23, 2025 15:06
@Alan-Jowett Alan-Jowett marked this pull request as ready for review October 23, 2025 17:14
dthaler
dthaler reviewed Oct 23, 2025
View reviewed changes
Comment thread docs/AuthConnectAttachTypes.md Outdated
Comment thread ebpf-for-windows.sln
Comment thread docs/ConnectAuthorizationAttachTypes.md Outdated
Comment thread docs/AuthConnectAttachTypes.md Outdated
keith-horton
keith-horton reviewed Oct 24, 2025
View reviewed changes
Comment thread netebpfext/net_ebpf_ext_sock_addr.c Outdated
keith-horton
keith-horton reviewed Oct 24, 2025
View reviewed changes
Comment thread tests/end_to_end/netsh_test.cpp Outdated
dthaler
dthaler reviewed Oct 24, 2025
View reviewed changes
Comment thread docs/AuthConnectAttachTypes.md Outdated
dthaler
dthaler reviewed Oct 24, 2025
View reviewed changes
Comment thread docs/ConnectAuthorizationAttachTypes.md Outdated
dthaler
dthaler reviewed Oct 24, 2025
View reviewed changes
Comment thread docs/AuthConnectAttachTypes.md Outdated
shankarseal
shankarseal reviewed Oct 24, 2025
View reviewed changes
Comment thread include/ebpf_nethooks.h Outdated
shankarseal
shankarseal reviewed Oct 24, 2025
View reviewed changes
Comment thread tests/socket/socket_tests.cpp Outdated
shankarseal
shankarseal reviewed Oct 27, 2025
View reviewed changes
Comment thread docs/ConnectAuthorizationAttachTypes.md Outdated
shankarseal
shankarseal reviewed Oct 27, 2025
View reviewed changes
Comment thread docs/ConnectAuthorizationAttachTypes.md Outdated
shankarseal
shankarseal reviewed Oct 27, 2025
View reviewed changes
Comment thread docs/ConnectAuthorizationAttachTypes.md Outdated
shankarseal
shankarseal reviewed Oct 27, 2025
View reviewed changes
Comment thread docs/ConnectAuthorizationAttachTypes.md Outdated
shankarseal
shankarseal reviewed Oct 27, 2025
View reviewed changes
Comment thread docs/ConnectAuthorizationAttachTypes.md Outdated
shankarseal
shankarseal reviewed Oct 27, 2025
View reviewed changes
Comment thread netebpfext/net_ebpf_ext_sock_addr.c Outdated
dthaler
dthaler reviewed Oct 27, 2025
View reviewed changes
Comment thread include/ebpf_program_attach_type_guids.h Outdated
Comment thread include/ebpf_program_attach_type_guids.h Outdated
Comment thread netebpfext/net_ebpf_ext_sock_addr.c Outdated
Comment thread netebpfext/net_ebpf_ext_sock_addr.c Outdated
Comment thread netebpfext/net_ebpf_ext_sock_addr.c Outdated
Comment thread tests/sample/cgroup_sock_addr_helpers.c Outdated
Comment thread tests/sample/cgroup_sock_addr_helpers.c Outdated
Comment thread tests/socket/socket_tests_common.h Outdated
Comment thread tests/socket/socket_tests_common.h Outdated
Comment thread tests/socket/socket_tests.cpp Outdated
dthaler
dthaler reviewed Oct 28, 2025
View reviewed changes
Comment thread tests/sample/cgroup_sock_addr_helpers.c Outdated
Comment thread tests/sample/cgroup_sock_addr_helpers.c Outdated
Comment thread tests/sample/cgroup_sock_addr_helpers.c Outdated
Comment thread tests/socket/socket_tests.cpp Outdated
Comment thread tests/socket/socket_tests.cpp Outdated
dthaler
dthaler reviewed Oct 28, 2025
View reviewed changes
Comment thread tests/socket/socket_tests.cpp Outdated
@Alan-Jowett Alan-Jowett force-pushed the auth_connect_attach_point branch 4 times, most recently from 56205cd to 091f978 Compare April 9, 2026 15:43
@Alan-Jowett Alan-Jowett force-pushed the auth_connect_attach_point branch from 6b56d2d to ce4e632 Compare April 13, 2026 17:45
dthaler
dthaler reviewed Apr 13, 2026
View reviewed changes
Comment thread netebpfext/net_ebpf_ext_sock_addr.c Outdated
Comment thread tests/socket/socket_tests.cpp Outdated
@Alan-Jowett Alan-Jowett force-pushed the auth_connect_attach_point branch from ce4e632 to 8fb23ef Compare April 14, 2026 15:12
dthaler
dthaler reviewed Apr 14, 2026
View reviewed changes
Comment thread tests/socket/socket_tests.cpp Outdated
Comment thread tests/socket/socket_tests.cpp Outdated
Comment thread tests/socket/socket_tests.cpp Outdated
@Alan-Jowett Alan-Jowett force-pushed the auth_connect_attach_point branch from 6cfe735 to 89cd487 Compare April 14, 2026 20:38
Alan Jowett and others added 14 commits April 14, 2026 13:45
@Alan-Jowett
Add support for cgroup/auth_connect4 and cgroup/auth_connect6 attach …
986bced 
…types

Add new BPF_CGROUP_INET4_AUTH_CONNECT and BPF_CGROUP_INET6_AUTH_CONNECT
attach points for authorization of outbound connections:
- Add new hook types and program types in ebpf_nethooks.h
- Add attach type GUIDs in ebpf_program_attach_type_guids.h
- Add network extension support in netebpfext
- Add tests and bpf2c expected outputs
@Alan-Jowett
Align CONNECT_AUTHORIZATION with spec
bef2860 
Replace 4 individual helper functions with single struct-based
bpf_sock_addr_get_network_context() helper as specified in
ConnectAuthorizationAttachTypes.md.

Enforce read-only context at CONNECT_AUTHORIZATION layer: if a program
modifies context fields (redirect), the connection is blocked.

Run AUTH_CONNECT programs for all non-REJECT verdicts (not just
PROCEED_SOFT), allowing auth programs to evaluate connections that
received PROCEED_HARD from the redirect layer.

Remove the FWP_CONDITION_FLAG_IS_REAUTHORIZE early-return that
auto-permitted reauth events, so programs are invoked for reauthorization.

Fix verdict reading in authorize_connection_classify to use accumulated
verdict from process_verdict callback instead of raw program return.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Regenerate cgroup_sock_addr bpf2c expected output
b65906b 
The cgroup_sock_addr expected output files were stale — the branch's
bpf2c generates different formatting for struct initializers since
merging main. Regenerated the 3 affected files (dll, raw, sys).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Document sentinel values for unavailable WFP fields in net_ebpf_sock_…
aa475e7 
…addr_t

Clarify in struct member comments that interface_type, tunnel_type,
next_hop_interface_luid, and sub_interface_index are set to their
respective MAX values when the field is not available for the current
attach type.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Fix spurious period in bpf_link_type comment
1dfe7b1 
Remove period from middle of sentence in the comment above enum
bpf_link_type as suggested by dthaler.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Rename AUTH_CONNECT/auth_connect to CONNECT_AUTHORIZATION/connect_aut…
c07b777 
…horization

Rename variables, comments, test case names, and trace strings to use
the full CONNECT_AUTHORIZATION naming instead of abbreviated
AUTH_CONNECT/auth_connect per style guidelines.

WFP API names (FWPM_LAYER_ALE_AUTH_CONNECT_V4, etc.) are unchanged
as those are external API constants.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Make get_network_context backward compatible with older programs
4058b2e 
Copy min(context_size, sizeof(net_ctx)) instead of rejecting callers
with a smaller struct. This allows programs compiled against an older
version of the struct to still receive the fields they know about
when the extension adds new fields in future versions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Reject get_network_context from unsupported attach types
ba57ace 
Return -1 if the helper is called from CONNECT_REDIRECT or any
attach type other than CONNECT_AUTHORIZATION or RECV_ACCEPT, where
the network layer metadata is not available.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Replace remaining 'auth' abbreviations with full names in comments
88303d8 
Replace auth/auth-connect with authorization/connect-authorization
in comments per style guidelines (no abbreviations).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Assert network context map lookup succeeds in helper validation test
d4f7c79 
Replace conditional 'if (result == 0)' with SAFE_REQUIRE(result == 0)
to ensure the test fails if the network context map lookup fails
instead of silently skipping validation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Address remaining shankarseal review comments
c284bdf 
- Add /*filter_function*/ comment for NULL parameter
- Use conditional operator for simple field assignments
- Add tracelog when CONNECT_AUTHORIZATION program attempts redirect

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Fix C6101: zero context_ptr on error paths in get_network_context
7241fe7 
The _Out_writes_ SAL annotation on context_ptr requires the buffer
to be initialized on all paths. Zero the output buffer upfront to
satisfy the code analyzer on early-return error paths.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Use SDK-defined sentinel values and interface type constants
08e32bc 
Replace hardcoded UINT32_MAX/UINT64_MAX sentinel values for
sub_interface_index and next_hop_interface_luid with the SDK-defined
NET_IFINDEX_UNSPECIFIED (0) and NET_IFLUID_UNSPECIFIED (0) from
shared/ifdef.h.

Replace magic numbers in socket_tests.cpp interface type validation
with IF_TYPE_ETHERNET_CSMACD, IF_TYPE_SOFTWARE_LOOPBACK,
IF_TYPE_IEEE80211, and IF_TYPE_TUNNEL from ipifcons.h.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Regenerate bpf2c expected output
7ea0365 
Run generate_expected_bpf2c_output.ps1 to update all expected output
files after the connect_authorization helper changes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett Alan-Jowett force-pushed the auth_connect_attach_point branch from 89cd487 to 7ea0365 Compare April 14, 2026 20:45
Alan-Jowett and others added 2 commits April 15, 2026 13:14
@Alan-Jowett
Fix IPv6 connection ID hash mismatch in connect_authorization test
e9978a0 
The test was using in6addr_loopback.u.Word[] (uint16_t[8]) to compute the
IPv6 connection ID, but the eBPF program uses ctx->user_ip6[] (uint32_t[4]).
This caused the map lookup to fail with ENOENT because the keys didn't match.

Fix by casting the IPv6 address to uint32_t* to match the eBPF program's
indexing granularity.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett
Address review: use SDK-defined unspecified values for network context
04a26ba 
Replace (uint32_t)-1 sentinel values with proper SDK constants:
- interface_type: use 0 (unspecified) instead of UINT32_MAX
- tunnel_type: use TUNNEL_TYPE_NONE instead of (uint32_t)-1
- next_hop_interface_luid: use NET_IFLUID_UNSPECIFIED in test mock
- sub_interface_index: use NET_IFINDEX_UNSPECIFIED in test mock

Replace magic number 100 in tunnel_type range check with explicit
enumeration of valid IANA tunnel type constants.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
dthaler
dthaler approved these changes Apr 16, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@dthaler dthaler left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good now, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@matthewige matthewige matthewige left review comments

@saxena-anurag saxena-anurag saxena-anurag left review comments

@keith-horton keith-horton keith-horton left review comments

@shankarseal shankarseal shankarseal left review comments

Copilot code review Copilot Copilot left review comments

@dthaler dthaler dthaler approved these changes

@LakshK98 LakshK98 Awaiting requested review from LakshK98 LakshK98 is a code owner

@mikeagun mikeagun Awaiting requested review from mikeagun mikeagun is a code owner

@mtfriesen mtfriesen Awaiting requested review from mtfriesen mtfriesen is a code owner

@poornagmsft poornagmsft Awaiting requested review from poornagmsft poornagmsft is a code owner

At least 2 approving reviews are required to merge this pull request.

Assignees

@matthewige matthewige

@saxena-anurag saxena-anurag

Labels

None yet

Projects

eBPF for Windows Triage
Status: Todo

Milestone

2603

Development

Successfully merging this pull request may close these issues.

Need a new attach point for bpf_sock_addr, that provides interface type, tunnel type, and other route metadata to the program.

7 participants

@Alan-Jowett @matthewige @dthaler @saxena-anurag @keith-horton @shankarseal