[CWS] Register connected flows from __inet_hash_connect

security_sk_classify_flow runs in tcp_{v4,v6}_connect before the ephemeral
source port and the source address have been picked, so the flow it reports
for a connecting socket is incomplete. Until now the transmit path called the
hook again once both were known; since Linux 7.0 inet6_csk_xmit only routes on
a dst cache miss, so that second call never happens and IPv6 TCP client flows
are either registered under a wildcard address or, when the socket was never
bound, not registered at all.

Register the flow on the return of __inet_hash_connect instead, reading the
final port and source address from the socket, and drop the entry the earlier
classification left behind. Both address families funnel into that function,
so a single hook point covers them.

Author: YoannGh

pkg/security/ebpf/c/include/hooks/network/flow.h

@@ -695,6 +695,41 @@ __attribute__((always_inline)) int register_connected_flow(struct sock *sk, u64
     return 0;
 }
 
+// __inet_hash_connect is what assigns the source port for both IP v4 and v6, so its
+// return is the first point where the full flow is known. security_sk_classify_flow can't be relied
+// on for connected sockets because tcp_{v4,v6}_connect call it before the port and the source address are
+// picked, and since Linux 7.0 the transmit path no longer calls it.
+HOOK_ENTRY("__inet_hash_connect")
+int hook_inet_hash_connect(ctx_t *ctx) {
+    struct inet_hash_connect_args_t args = {
+        .sk = (struct sock *)CTX_PARM2(ctx),
+    };
+    u64 pid_tgid = bpf_get_current_pid_tgid();
+    bpf_map_update_elem(&inet_hash_connect_args, &pid_tgid, &args, BPF_ANY);
+    return 0;
+}
+
+HOOK_EXIT("__inet_hash_connect")
+int rethook_inet_hash_connect(ctx_t *ctx) {
+    u64 pid_tgid = bpf_get_current_pid_tgid();
+    struct inet_hash_connect_args_t *args = bpf_map_lookup_elem(&inet_hash_connect_args, &pid_tgid);
+    if (args == NULL) {
+        // should never happen, ignore
+        return 0;
+    }
+    struct sock *sk = args->sk;
+
+    // delete the entry in inet_hash_connect_args to make sure we don't leak entries
+    bpf_map_delete_elem(&inet_hash_connect_args, &pid_tgid);
+
+    if ((int)CTX_PARMRET(ctx) < 0 || sk == NULL) {
+        // we only care about successful connect operations
+        return 0;
+    }
+
+    return register_connected_flow(sk, pid_tgid);
+}
+
 // The socket returned by accept() holds the concrete local address the connection landed on, which
 // the BIND_ENTRY of a wildcard listener doesn't cover. Before Linux 7.0 that IPv6 socket was classified
 // on its first transmit, causing security_sk_classify_flow to be called and classify the flow.

pkg/security/ebpf/c/include/maps.h

@@ -62,6 +62,7 @@ BPF_HASH_MAP(cgroup_mount_id, u32, u32, 1)
 
 BPF_HASH_MAP_FLAGS(active_flows, u32, struct active_flows_t, 1, BPF_F_NO_PREALLOC) // max entry will be overridden at runtime
 BPF_HASH_MAP_FLAGS(inet_bind_args, u64, struct inet_bind_args_t, 1, BPF_F_NO_PREALLOC) // max entries will be overridden at runtime
+BPF_HASH_MAP_FLAGS(inet_hash_connect_args, u64, struct inet_hash_connect_args_t, 1, BPF_F_NO_PREALLOC) // max entries will be overridden at runtime
 
 BPF_LRU_MAP(activity_dumps_config, u64, struct activity_dump_config, 1) // max entries will be overridden at runtime
 BPF_LRU_MAP(cgroup_wait_list, u64, u64, 1) // max entries will be overridden at runtime

pkg/security/ebpf/c/include/structs/network.h

@@ -75,6 +75,10 @@ struct inet_bind_args_t {
     struct socket *sock;
 };
 
+struct inet_hash_connect_args_t {
+    struct sock *sk;
+};
+
 struct device_t {
     char name[16];
     u32 netns;

pkg/security/ebpf/probes/all.go

@@ -407,6 +407,11 @@ func AllMapSpecEditors(numCPU int, opts MapSpecEditorOpts, kv *kernel.Version) m
 			Flags:      unix.BPF_ANY,
 			EditorFlag: manager.EditMaxEntries | manager.EditFlags,
 		}
+		editors["inet_hash_connect_args"] = manager.MapSpecEditor{
+			MaxEntries: superReducedProcPidCacheSize,
+			Flags:      unix.BPF_ANY,
+			EditorFlag: manager.EditMaxEntries | manager.EditFlags,
+		}
 	} else {
 		editors["active_flows"] = manager.MapSpecEditor{
 			MaxEntries: activeFlowsMaxEntries,
@@ -416,6 +421,10 @@ func AllMapSpecEditors(numCPU int, opts MapSpecEditorOpts, kv *kernel.Version) m
 			MaxEntries: superReducedProcPidCacheSize,
 			EditorFlag: manager.EditMaxEntries,
 		}
+		editors["inet_hash_connect_args"] = manager.MapSpecEditor{
+			MaxEntries: superReducedProcPidCacheSize,
+			EditorFlag: manager.EditMaxEntries,
+		}
 	}
 
 	return editors

pkg/security/ebpf/probes/event_types.go

@@ -60,6 +60,8 @@ func NetworkSelectors(hasCgroupSocket bool) []manager.ProbesSelector {
 		&manager.BestEffort{Selectors: []manager.ProbesSelector{
 			hookFunc("hook_inet6_bind"),
 			hookFunc("rethook_inet6_bind"),
+			hookFunc("hook_inet_hash_connect"),
+			hookFunc("rethook_inet_hash_connect"),
 		}},
 
 		// network device probes

pkg/security/ebpf/probes/flow.go

@@ -78,6 +78,18 @@ func getFlowProbes() []*manager.Probe {
 				EBPFFuncName: "rethook_inet6_bind",
 			},
 		},
+		{
+			ProbeIdentificationPair: manager.ProbeIdentificationPair{
+				UID:          SecurityAgentUID,
+				EBPFFuncName: "hook_inet_hash_connect",
+			},
+		},
+		{
+			ProbeIdentificationPair: manager.ProbeIdentificationPair{
+				UID:          SecurityAgentUID,
+				EBPFFuncName: "rethook_inet_hash_connect",
+			},
+		},
 		{
 			ProbeIdentificationPair: manager.ProbeIdentificationPair{
 				UID:          SecurityAgentUID,