From 5700199297271db4fde4ecd293acca8ef871bbcd Mon Sep 17 00:00:00 2001 From: LinuxDev9002 Date: Sun, 19 Jul 2026 15:16:33 -0700 Subject: [PATCH] Add TCP iterator feature background --- src/51-tcp-quarantine/README.md | 6 ++++-- src/51-tcp-quarantine/README.zh.md | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/src/51-tcp-quarantine/README.md b/src/51-tcp-quarantine/README.md index 39b6c91..8d3c243 100644 --- a/src/51-tcp-quarantine/README.md +++ b/src/51-tcp-quarantine/README.md @@ -1,8 +1,10 @@ # eBPF Tutorial by Example: Targeted TCP Connection Quarantine -Suppose an egress destination has just been added to a policy or threat-intelligence blocklist. A firewall blocks future connects, but `netstat` shows the server already has an active TCP session to that address. You want to preview and close that exact established session while preserving the process and unrelated connections. +Suppose an egress destination has just been added to a threat-intelligence blocklist. A firewall blocks future connects, but `netstat` shows the server already has an active TCP session to that address. You want to close that exact session while preserving the process and unrelated traffic. -This tutorial builds `tcp_quarantine`, a one-shot CLI that matches an exact IPv4 destination address and port, finds all `ESTABLISHED` TCP connections matching that tuple, and counts or destroys them. The default mode is dry-run, which reports matches. The `--apply` flag directs the BPF program to call the kernel's `bpf_sock_destroy` kfunc on each match. The TCP BPF iterator's scan scope is the network namespace of the loading process. +This tutorial is part of the eBPF Tutorial by Example series. In eBPF, user space loads a verifier-checked BPF program and attaches it to a kernel execution interface. A BPF TCP iterator drives typed callbacks over sockets in the loading process's network namespace. This lesson's program aggregates counters in those callbacks for its user-space loader to read after traversal. + +Linux 6.5 introduced the `bpf_sock_destroy` kfunc, available from BPF TCP and UDP iterator contexts. The iterator filters sockets and the kfunc synchronously invokes the protocol-specific destroy path for selected sockets. The `tcp_quarantine` tool uses that capability. It finds exact established IPv4 destination-and-port matches, counts them in `dry-run` mode, and destroys selected sockets in `--apply` mode. > Complete source: diff --git a/src/51-tcp-quarantine/README.zh.md b/src/51-tcp-quarantine/README.zh.md index fe41d7c..9bd5e5d 100644 --- a/src/51-tcp-quarantine/README.zh.md +++ b/src/51-tcp-quarantine/README.zh.md @@ -1,8 +1,10 @@ # eBPF 教程：精准隔离已建立的 TCP 连接 -假设某个出站目标地址刚被添加到威胁情报黑名单，防火墙已更新规则来阻止后续连接。然而 `netstat` 显示某台服务器上已经存在一条到该地址的活跃 TCP 会话，你需要精准关闭这条连接，同时保留进程和其他无关流量。 +假设某个出站目标地址刚被添加到威胁情报黑名单，防火墙已更新规则阻止后续连接。然而 `netstat` 显示某台服务器上已经存在一条到该地址的活跃 TCP 会话，你需要精准关闭这条连接，同时保留进程和其他无关流量。 -本教程构建 `tcp_quarantine`，一个单次执行的 eBPF 命令行工具，用于精确匹配指定的 IPv4 目标地址和端口，找到所有符合该元组的 `ESTABLISHED` TCP 连接并统计或销毁它们。默认模式是 dry-run，只报告匹配结果；`--apply` 模式调用内核的 `bpf_sock_destroy` kfunc 销毁每个匹配的套接字。BPF TCP 迭代器的扫描范围是加载它的进程所在的网络命名空间。 +本教程属于 eBPF Tutorial by Example 系列。eBPF 允许用户态程序加载经过验证器检查的 BPF 程序并附加到内核执行接口，BPF TCP 迭代器为加载进程所在网络命名空间内的套接字驱动类型化回调。本教程的 BPF 程序在这些回调中聚合计数器，供用户态加载器在遍历结束后读取。 + +Linux 6.5 引入了 `bpf_sock_destroy` kfunc，可从 BPF TCP 和 UDP 迭代器上下文调用，迭代器筛选套接字后由该 kfunc 同步执行协议特定的销毁路径。`tcp_quarantine` 工具利用这一能力找出精确匹配 IPv4 目标地址和端口的已建立连接，`dry-run` 模式统计匹配数量，`--apply` 模式销毁选中的套接字。 > 完整源码：