Epic: eBPF virtual patching (deny rules → cleartext signatures → userspace WAF)

[hsinatfootprintai]

Epic: eBPF virtual patching

Virtual patching = a temporary, network-level rule that blocks a known
exploit before it reaches vulnerable software, buying time until the real
vendor patch ships (zero downtime, no app change). The classic form is a
WAF/IPS signature; the cheap-and-reliable form is an L3/L4 block rule.

Containarium already ships the enforcement substrate from the eBPF
network-isolation work (#315): per-container-veth TC clsact hooks that can
TC_ACT_SHOT, a per-tenant LPM-trie allow-list, a reconcile loop that pushes
rules into BPF maps with zero downtime, and audit perf events on every deny.
What's missing is a deny primitive and the inspection depth for signatures.

This epic tracks turning that substrate into a virtual-patching capability,
in three tiers of increasing depth and cost.

Tiers

• Tier 1 — L3/L4 virtual patch (deny rules). Add a per-tenant deny
  LPM-trie (CIDR + optional port/proto) evaluated before the allow logic,
  returning TC_ACT_SHOT. Covers the large class of "a network-reachable
  service / upstream is vulnerable — block it now." Pure eBPF, reuses the
  whole substrate. Ships first. → Tier 1: L3/L4 virtual patch — per-tenant eBPF deny rules #660.

• Tier 2 — bounded cleartext signature match (kernel). Extend the BPF
  program with bpf_skb_load_bytes over the first ~256 payload bytes and a
  small bpf_loop scan for a curated set of cleartext signatures (Log4Shell
  ${jndi:, Shellshock () {). Caveats spelled out: single-packet only
  (segment-split evasion), cleartext only (no TLS), verifier-bounded pattern
  count/length. → Tier 2: bounded cleartext signature matching in eBPF (best-effort IPS) #661.

• Tier 3 — userspace WAF behind eBPF steering. eBPF redirects flagged
  flows into a host-side WAF (Coraza / ModSec CRS) that does reassembly, TLS
  termination, and vendor signature sets. The only WAF-grade path; eBPF's role
  shrinks to a fast classifier/redirector. → Tier 3: userspace WAF behind eBPF flow steering (WAF-grade virtual patching) #662.

Product hook

Wire to the existing security scanner: a CVE finding emits a virtual-patch
deny rule → reconcile pushes it → reconcile auto-expires it when the scanner
confirms the upstream patch landed. "Band-Aid until the real patch ships, then
auto-removed," end to end.

Honest constraints (why tiers, not one feature)

• Pure-kernel eBPF sees one packet at a time (no reassembly) and can't read
  TLS payloads — so signature matching past Tier 1 is genuinely limited.
• All tiers inherit the existing two opt-ins: feature off unless
  CONTAINARIUM_NETWORK_POLICY_BPF_OBJECT is set, and drops disarmed unless
  CONTAINARIUM_NETWORK_POLICY_ENFORCE=1. A misbroad deny rule must not
  blackhole a container by default.

Design doc: docs/security/VIRTUAL-PATCHING-DESIGN.md (added with Tier 1).

Prior art in-tree: docs/security/NETWORK-ISOLATION-DESIGN.md,
experimental/ebpf-phaseA/netpolicy.bpf.c, internal/netbpf/,
internal/server/network_policy_enforcer.go.

[hsinatfootprintai]

Progress — Tier 1 (#660) implemented

Tier 1 (L3/L4 deny rules) is code-complete in PR #664 (ready for review).

Delivered:

• proto NetworkPolicy.deny_rules + NetworkPolicyDenyRule (cidr, port, proto, note, expires_at)
• BPF deny_cidr LPM trie evaluated before the allow-list (deny beats allow); deny_event.reason distinguishes a virtual-patch drop in the audit log
• daemon reconcile installs/expires deny entries (diffDeny, expiry self-removal); audit action network_policy.virtual_patch
• CLI network-policy patch add/rm/list; set preserves deny rules
• design doc docs/security/VIRTUAL-PATCHING-DESIGN.md + runnable runbook experimental/ebpf-phaseA/validate-virtual-patch.sh + CHANGELOG

Validation:

• ✅ full Go unit coverage (compile / plan / diff / expiry / CIDR-dedup / CLI)
• ✅ kernel verifier accepts the new map + deny-first branch on a real 6.8 kernel (isolated bpftool prog loadall)
• ⏳ end-to-end armed-drop test deferred to the normal backend release-upgrade cycle (won't swap a released binary on a live multi-tenant node just to test)

Status:

• Tier 1 (Tier 1: L3/L4 virtual patch — per-tenant eBPF deny rules #660) — code-complete, PR feat(netpolicy): eBPF virtual patching — Tier 1 L3/L4 deny rules (#660) #664 in review
• Tier 2 (Tier 2: bounded cleartext signature matching in eBPF (best-effort IPS) #661) — designed, not started
• Tier 3 (Tier 3: userspace WAF behind eBPF flow steering (WAF-grade virtual patching) #662) — designed, not started

[hsinatfootprintai]

Progress — Tier 2 (#661) PR-A implemented

Tier 2 PR-A (inbound cleartext signature scanning) is in PR #665 (draft, pending on-backend runtime validation).

Delivered:

• In-kernel payload scan on the container-receive path (veth TC_EGRESS) — one bpf_loop over a (signature × offset) space, per-CPU scratch buffer, tiered constant-size loads. The verifier-acceptance unknown is resolved — proven on a 6.8 backend (three earlier shapes rejected; documented).
• Built-in curated signature set (Log4Shell, Shellshock, Spring4Shell, path-traversal, /etc/passwd); network_policy.signature_match audit naming the signature.
• Three independent opt-ins: BPF_OBJECT (load) / SIGNATURES=1 (scan) / ENFORCE=1 (drop). sig_config gate so the scan cost is only paid when enabled.
• Design + runbook: docs/security/VIRTUAL-PATCHING-TIER2.md, validate-signature-scan.sh.

Honest constraints (documented, not hidden): single-packet (segment-split evasion), cleartext-only (TLS opaque), first 256 bytes — best-effort pre-filter, not a WAF.

Status:

• Tier 1 (Tier 1: L3/L4 virtual patch — per-tenant eBPF deny rules #660) — ✅ merged
• Tier 2 (Tier 2: bounded cleartext signature matching in eBPF (best-effort IPS) #661) — PR-A in review (feat(netpolicy): eBPF virtual patching Tier 2 PR-A — inbound cleartext signature scan (#661) #665); PR-B (operator signature CRUD API/CLI) is the follow-up
• Tier 3 (Tier 3: userspace WAF behind eBPF flow steering (WAF-grade virtual patching) #662) — designed, not started

[hsinatfootprintai]

Progress — Tier 2 (#661) PR-B implemented

Operator-managed signatures (PR-B) are in PR #666 (draft, stacked on #665).

Adds containarium network-policy signature add/rm/list — global operator exploit signatures that augment PR-A's built-in set:

• proto NetworkPolicySignature + Set/List/Delete RPCs (admin-only)
• dedicated global store (mem + Postgres network_policy_signatures); stable ids in a reserved range (OperatorIDBase=1000) so audit matches name their source
• enforcer merges built-ins + enabled operator sigs (capped to 32 slots), re-syncs on reconcile with a fingerprint to skip no-op rewrites
• full unit coverage; gosec G115 clean

Status:

• Tier 1 (Tier 1: L3/L4 virtual patch — per-tenant eBPF deny rules #660) — ✅ merged
• Tier 2 (Tier 2: bounded cleartext signature matching in eBPF (best-effort IPS) #661) — PR-A feat(netpolicy): eBPF virtual patching Tier 2 PR-A — inbound cleartext signature scan (#661) #665 + PR-B feat(netpolicy): Tier 2 PR-B — operator-managed exploit signatures (#661) #666 (both draft pending the shared on-backend runtime validation). Tier 2: bounded cleartext signature matching in eBPF (best-effort IPS) #661 is now feature-complete pending that.
• Tier 3 (Tier 3: userspace WAF behind eBPF flow steering (WAF-grade virtual patching) #662) — designed, not started