Today, you will create an eBPF XDP script. You will include everything that i have provided in my instructions (as long as they ARE possible). You will not skip a single step, even if it is extreamely complex, YOU WILL still make it. Think carefully about how you want to structure your code, to minimise security risks, aswell as making it efficient. You will provide me the Makefile i will use for it. You will explain in detail how i will run it on an ubuntu 22.04 machine.

You will study SSH packets to see what should and should not be in the packet, using that or deep packet inspection (Knowing what packets to drop). You MUST code me the advanced packet inspection code, You CANNOT skip any of my instructions. This is meant to be an advanced eBPF XDP script, so if i have missed anything vital, include it. THis should be put into one long script.

Here are my instructions:

1.Port 22 Restriction: The script should only allow packets destined for port 22, which is the default port for SSH connections (supporting both SSH 1 and SSH 2 protocols). All other packets targeting different ports must be dropped.
2.Automatic Stateful Packet Inspection: Implement automatic stateful packet inspection. The script should monitor and enforce the correct state of connections, allowing only established and related connections. It should track connection states (e.g., SYN, ACK, FIN) and permit only those packets that match the expected states. Any packets that do not conform to these states should be dropped.
3.Dropping Invalid and Non-SSH Packets: Continuously drop any invalid or malformed packets. The script must flag and drop packets that do not adhere to TCP/IP standards. Additionally, any packets that do not carry SSH-specific traffic should also be dropped.
4.Full SSH Protocol Validation: Implement comprehensive validation of the SSH protocol. The script must ensure that the SSH handshake and subsequent communication fully adhere to the SSH protocol standards.
5.Deep Packet Inspection for SSH Protocol Validation: The script should perform deep packet inspection, parsing the SSH protocol sequence within the TCP payload. This includes: Validating the entire SSH handshake process, including version exchange, key exchange algorithm negotiation, encryption and MAC algorithm negotiation, host key verification, and user authentication, Ensuring that each phase of the SSH connection, from key exchange to user authentication, is thoroughly checked for compliance with the protocol, Employing egress filtering to ensure outgoing packets also conform to the SSH protocol.
6.SSH Connection Rate Limiting: Implement rate limiting to protect against brute-force attacks. The script should limit SSH connection attempts to 3 per 30 seconds per IP address. Any attempts exceeding this limit within the specified time window should result in the connections being dropped. Additionally, the script should trigger alerts for IPs that exceed this limit, flagging them for further monitoring or potential blacklisting.
7.Limiting Active SSH Connections: Enforce a cap on active SSH sessions. The script should allow a maximum of 3 concurrent SSH connections. Any new connection requests that would exceed this limit should be automatically dropped.
8.Tracking and Logging XDP Drops: Implement a tracking system for XDP_DROP actions. The script should maintain a real-time counter that tracks the number of times the XDP_DROP action is invoked. This count should be logged or printed to the console every second to facilitate system health monitoring and attack detection.

If you cannot include any of these, because it is IMPOSSIBLE, then skip it. If you can do it, but dont want to do it because its complex, you must still do it.