Add Basic Firewall Example

basic-node-firewall/.cargo/config.toml

@@ -0,0 +1,2 @@
+[alias]
+xtask = "run --package xtask --"

basic-node-firewall/.dockerignore

@@ -0,0 +1,2 @@
+/.git 
+/target

basic-node-firewall/.gitignore

@@ -0,0 +1,13 @@
+### https://raw.github.com/github/gitignore/master/Rust.gitignore
+
+# Generated by Cargo
+# will have compiled files and executables
+debug/
+target/
+
+# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
+# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
+Cargo.lock
+
+# These are backup files generated by rustfmt
+**/*.rs.bk

basic-node-firewall/.vim/coc-settings.json

@@ -0,0 +1,3 @@
+{
+  "rust-analyzer.linkedProjects": ["Cargo.toml", "basic-node-firewall-ebpf/Cargo.toml"]
+}

basic-node-firewall/.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "rust-analyzer.linkedProjects": ["Cargo.toml", "basic-node-firewall-ebpf/Cargo.toml"]
+}

basic-node-firewall/Cargo.toml

@@ -0,0 +1,5 @@
+[workspace]
+members = ["basic-node-firewall-loader", "basic-node-firewall", "basic-node-firewall-common", "xtask"]
+
+[patch.crates-io]
+aya = { git = "https://github.com/astoycos/aya", branch="try-from-async-perf" }

basic-node-firewall/README.md

@@ -0,0 +1,28 @@
+# basic-node-firewall
+
+## Prerequisites
+
+1. Install a rust stable toolchain: `rustup install stable`
+1. Install a rust nightly toolchain: `rustup install nightly`
+1. Install bpf-linker: `cargo install bpf-linker`
+
+## Build eBPF
+
+```bash
+cargo xtask build-ebpf
+```
+
+To perform a release build you can use the `--release` flag.
+You may also change the target architecture with the `--target` flag
+
+## Build Userspace
+
+```bash
+cargo build
+```
+
+## Run
+
+```bash
+cargo xtask run
+```

basic-node-firewall/basic-node-firewall-common/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "basic-node-firewall-common"
+version = "0.1.0"
+edition = "2021"
+
+[features]
+default = []
+user = [ "aya" ]
+
+[dependencies]
+aya = { version = ">=0.11", optional=true }
+
+[lib]
+path = "src/lib.rs"

basic-node-firewall/basic-node-firewall-common/src/lib.rs

@@ -0,0 +1,31 @@
+
+#![no_std]
+
+#[repr(C)]
+#[derive(Clone, Copy)]
+pub struct packet_log {
+    pub src_address: u32,
+    pub dst_address: u32,
+    pub src_port: u16,
+    pub dst_port: u16,
+    pub protocol: u8,
+    pub _pad: [u8; 3],
+
+}
+
+#[repr(C)]
+#[derive(Copy, Clone)]
+pub struct packet_five_tuple { 
+    pub src_address: u32, 
+    pub dst_address: u32,
+    pub src_port: u16,
+    pub dst_port: u16, 
+    pub protocol: u8,
+    pub _pad: [u8; 3],
+}
+
+#[cfg(feature = "user")]
+unsafe impl aya::Pod for packet_log {}
+
+#[cfg(feature = "user")]
+unsafe impl aya::Pod for packet_five_tuple {}

basic-node-firewall/basic-node-firewall-ebpf/.cargo/config.toml

@@ -0,0 +1,7 @@
+[build]
+target-dir = "../target"
+target = "bpfel-unknown-none"
+rustflags = ["-C", "link-arg=--btf"]
+
+[unstable]
+build-std = ["core"]

basic-node-firewall/basic-node-firewall-ebpf/.vim/coc-settings.json

@@ -0,0 +1,4 @@
+{
+    "rust-analyzer.cargo.target": "bpfel-unknown-none",
+    "rust-analyzer.checkOnSave.allTargets": false
+}

basic-node-firewall/basic-node-firewall-ebpf/.vscode/settings.json

@@ -0,0 +1,4 @@
+{
+    "rust-analyzer.cargo.target": "bpfel-unknown-none",
+    "rust-analyzer.checkOnSave.allTargets": false
+}

basic-node-firewall/basic-node-firewall-ebpf/Cargo.toml

@@ -0,0 +1,33 @@
+[package]
+name = "basic-node-firewall-ebpf"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+aya-bpf = { git = "https://github.com/aya-rs/aya", branch = "main" }
+aya-log-ebpf = { git = "https://github.com/aya-rs/aya", branch = "main" }
+basic-node-firewall-common = { path = "../basic-node-firewall-common" }
+memoffset = "0.6"
+
+[[bin]]
+name = "basic-node-firewall-loader"
+path = "src/main.rs"
+
+[profile.dev]
+opt-level = 3
+debug = true
+debug-assertions = true
+overflow-checks = false
+lto = true
+panic = "abort"
+incremental = false
+codegen-units = 1
+rpath = false
+
+[profile.release]
+lto = true
+panic = "abort"
+codegen-units = 1
+
+[workspace]
+members = []

basic-node-firewall/basic-node-firewall-ebpf/rust-toolchain.toml

@@ -0,0 +1,2 @@
+[toolchain]
+channel="nightly"