Today, you will create an eBPF XDP script that adheres strictly to the following specifications, ensuring comprehensive coverage with no logic gaps, including advanced features such as deep packet inspection. The script should fully implement each requirement, with no steps missed, and no shortcuts taken (NOTHING should be simplified for illustration). This script is built for efficiency, so make sure you think about every line of code carefully, and deeply think about the methods you are going to use.



Instructions:

Port 22 Restriction:
The script should only allow packets destined for port 22, which is the default port for SSH connections (supporting both SSH 1 and SSH 2 protocols). All other packets targeting different ports must be dropped.

Automatic Stateful Packet Inspection:
Implement automatic stateful packet inspection. The script should monitor and enforce the correct state of connections, allowing only established and related connections. It should track connection states (e.g., SYN, ACK, FIN) and permit only those packets that match the expected states. Any packets that do not conform to these states should be dropped.

Dropping Invalid and Non-SSH Packets:
Continuously drop any invalid or malformed packets. The script must flag and drop packets that do not adhere to TCP/IP standards. Additionally, any packets that do not carry SSH-specific traffic should also be dropped.

Full SSH Protocol Validation:
Implement comprehensive validation of the SSH protocol. The script must ensure that the SSH handshake and subsequent communication fully adhere to the SSH protocol standards.

Deep Packet Inspection for SSH Protocol Validation:
The script should perform deep packet inspection (DPI) by parsing the SSH protocol sequence within the TCP payload. This includes:
Validating the entire SSH handshake process, including version exchange, key exchange algorithm negotiation, encryption and MAC algorithm negotiation, host key verification, and user authentication.
Ensuring that each phase of the SSH connection, from key exchange to user authentication, is thoroughly checked for compliance with the protocol.
Employing egress filtering to ensure outgoing packets also conform to the SSH protocol.

SSH Connection Rate Limiting:
Implement rate limiting to protect against brute-force attacks. The script should limit SSH connection attempts to 3 per 30 seconds per IP address. Any attempts exceeding this limit within the specified time window should result in the connections being dropped. Additionally, the script should trigger alerts for IPs that exceed this limit, flagging them for further monitoring or potential blacklisting.

Limiting Active SSH Connections:
Enforce a cap on active SSH sessions. The script should allow a maximum of 3 concurrent SSH connections. Any new connection requests that would exceed this limit should be automatically dropped.

Tracking and Logging XDP Drops:
Implement a tracking system for XDP_DROP actions. The script should maintain a real-time counter that tracks the number of times the XDP_DROP action is invoked. This count should be logged or printed to the console every second to facilitate system health monitoring and attack detection.