Problem statement 2: Drop packets only for a given process

Write an eBPF code to allow traffic only at a specific TCP port (default 4040) for a given process name (for e.g, "myprocess"). All the traffic to all other ports for only that process should be dropped.

Solution

A simple program written in Golang along with eBPF/XDP and kprobe/inet_bind programs written in C to drop incoming network packets on all ports except port P in the given process.

How to run

For linux

Step 1:

# install the necessary dependencies to run the program

sudo apt update
sudo apt install clang llvm gcc golang-go
sudo apt install linux-headers-$(uname -r)

sudo apt-get update
sudo apt-get install bpfcc-tools libbpfcc-dev

Step 2:

# clone the repository
git clone github.com/zakisk/drop-packets-for-process

Step 3:

# build and run program
cd drop-packets-for-process
make build && sudo ./drop-packets-for-process