コンテナやコマンドなどのリソース単位で外部への意図しない通信をブロックする

SEC("lsm/socket_connect")
int BPF_PROG(socket_connect, struct socket *sock, struct sockaddr *address, int addrlen) {
  struct sockaddr_in *inet_addr = (struct sockaddr_in*)address;

  // denylist は BPF map
  if (bpf_map_lookup_elem(&denylist, &inet_addr->sin_addr))
    return -EPERM;

  return 0;
}

network:
  # block か monitor を設定
  # block ... 接続をブロックする
  # monitor ... 接続をブロックせずにログに出力するだけ
  mode: block
  # container か host を設定
  # container ... コンテナの通信のみを対象
  # host ... ホスト全体の通信を対象
  target: container
  # 許可/制限するネットワークを指定
  cidr:
    allow:
      - 10.0.1.1/24
    deny:
      - 10.0.1.71/32

$ sudo ./bouheki -config config/container.yaml

# コンテナから 10.0.1.1 へのアクセスはできる
$ docker run --rm curlimages/curl:latest -s -I http://10.0.1.1
HTTP/1.1 301 Moved Permanently
Location: https://10.0.1.1:443/
Date: Sun, 26 Sep 2021 13:21:36 GMT
Server: Server

# コンテナから 10.0.1.71 へのアクセスはできない
$ docker run --rm curlimages/curl:latest http://10.0.1.71
curl: (7) Couldn't connect to server

# ホストからは自由に通信可能
$ curl -I -s 10.0.1.71
HTTP/1.1 301 Moved Permanently
Date: Sun, 26 Sep 2021 13:23:10 GMT
Location: https://10.0.1.71/
Connection: close
Content-Type: text/html
Content-Length: 56

{
  "Action": "BLOCKED",
  "Addr": "10.0.1.71",
  "Comm": "curl",
  "Hostname": "cdb99d181368",
  "PID": 936350,
  "Port": 80,
  "level": "info",
  "msg": "Traffic is trapped in the filter.",
  "time": "2021-09-26T13:21:58Z"
}

network:
  mode: block
  target: host
  cidr:
    allow:
      - 0.0.0.0/0
    deny:
      - 93.184.216.34/32
  command:
    allow:
      - 'wget'
    deny:
      - 'curl'
log:
  format: json

$ sudo ./bouheki -config testdata/command_deny.yml
...
$ curl 93.184.216.34
curl: (7) Couldn't connect to server

$ wget 93.184.216.34/index.html
--2021-09-26 13:31:38--  http://93.184.216.34/index.html
Connecting to 93.184.216.34:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 94 [text/html]
Saving to: ‘index.html’

index.html                        100%[==========================================================>]      94  --.-KB/s    in 0s

2021-09-26 13:31:39 (17.5 MB/s) - ‘index.html’ saved [94/94]

network:
  mode: block
  target: host
  cidr:
    allow:
      - 0.0.0.0/0
    deny: []
  uid:
    allow:
      - 0
    deny:
      - 1000
log:
  format: json

$ curl 93.184.216.34
curl: (7) Couldn't connect to server

$ sudo su
[sudo] password for mrtc0:
# curl http://93.184.216.34
<?xml version="1.0" encoding="iso-8859-1"?>
...