Today, you will create an eBPF XDP script. You will include everything that i have provided in my instructions (as long as they ARE possible). You will not skip a single step, even if it is extreamely complex, YOU WILL still make it. Think carefully about how you want to structure your code, to minimise security risks, aswell as making it efficient. You will provide me the Makefile i will use for it. You will explain in detail how i will run it on an ubuntu 22.04 machine.

You will study SSH packets to see what should and should not be in the packet, using that or deep packet inspection (Knowing what packets to drop). You MUST code me the advanced packet inspection code, You CANNOT skip any of my instructions. This is meant to be an advanced eBPF XDP script, so if i have missed anything vital, include it. THis should be put into one long script.

Here are my instructions:

Restricting Access to Port 22 (Default SSH Port):

Description: Configure your firewall to exclusively permit incoming network packets that are specifically targeted to port 22, which is the standard port used for SSH (Secure Shell) connections. This ensures that only SSH traffic is allowed through, minimizing exposure to other potentially vulnerable services.
Implementation Tips: Use firewall rules (e.g., iptables, ufw) to explicitly allow traffic on port 22 and block all other unsolicited access attempts.
Implementing Automatic Stateful Packet Inspection:

Description: Deploy stateful packet inspection (SPI) to continuously monitor the state of active connections and ensure that all packets conform to the expected communication patterns. SPI tracks the state of network connections (such as TCP streams) and makes decisions based on the context of the traffic.
Benefits: Enhances security by allowing only legitimate packets that are part of established connections, thereby preventing unauthorized access and various types of network attacks.
Implementation Tips: Utilize firewall solutions that support SPI, such as pfSense or firewalld, and ensure that SPI is enabled and properly configured to handle your network traffic.
Dropping Invalid and Non-SSH Packets:

Description: Configure your network defenses to automatically discard any packets that are identified as invalid, malformed, or not associated with SSH-specific traffic. This helps to eliminate potentially harmful data before it can reach critical systems.
Benefits: Reduces the risk of attacks that exploit malformed packets and ensures that only legitimate SSH traffic is processed, enhancing overall network security.
Implementation Tips: Set up firewall rules to filter out packets that do not match the expected SSH traffic patterns and employ intrusion detection systems (IDS) to identify and block suspicious packets.
Comprehensive SSH Protocol Validation:

Description: Enforce thorough validation of the SSH protocol to ensure that all SSH communications adhere strictly to protocol standards. This includes verifying the integrity of SSH handshakes, authentication processes, and data encryption mechanisms.
Benefits: Prevents protocol-based attacks and ensures that SSH sessions are secure and reliable, protecting sensitive data from interception or tampering.
Implementation Tips: Use SSH server configurations that enforce strict protocol compliance and regularly update SSH software to incorporate the latest security patches and improvements.
Deep Packet Inspection for SSH Handshake Validation:

Description: Perform deep packet inspection (DPI) specifically on SSH traffic to meticulously analyze and validate the SSH handshake process. DPI examines the content of packets beyond basic header information to ensure the integrity and authenticity of the SSH connection initiation.
Benefits: Detects and mitigates sophisticated attacks targeting the SSH handshake, such as man-in-the-middle (MITM) attacks or attempts to exploit handshake vulnerabilities.
Implementation Tips: Deploy DPI-capable firewalls or network security appliances that can inspect SSH traffic at a granular level and enforce strict validation rules during the handshake phase.
Rate Limiting SSH Connection Attempts:

Description: Implement rate limiting measures to restrict the number of SSH connection attempts from a single IP address to a maximum of three attempts within a 30-second interval. This helps to prevent brute-force attacks aimed at guessing SSH credentials.
Benefits: Significantly reduces the risk of unauthorized access by limiting the speed at which attackers can attempt to brute-force SSH logins.
Implementation Tips: Configure rate limiting settings using tools like fail2ban, sshguard, or built-in firewall capabilities to monitor and enforce connection attempt thresholds.
Limiting the Number of Active SSH Connections:

Description: Set a strict limit on the number of simultaneous SSH connections allowed, capping the number at three concurrent sessions. This control helps to manage resource usage and prevent potential abuse of SSH access.
Benefits: Enhances security by minimizing the risk of multiple unauthorized access attempts and ensures that system resources are not overwhelmed by excessive SSH sessions.
Implementation Tips: Adjust SSH server configuration parameters (e.g., MaxSessions and MaxStartups in sshd_config) to enforce the desired limit on active connections.
Tracking and Logging XDP_DROP Actions:

Description: Establish a robust tracking and logging mechanism for all XDP_DROP actions, which are used to drop malicious or unwanted packets at the eXpress Data Path (XDP) level. This allows for detailed monitoring and analysis of dropped traffic.
Benefits: Provides valuable insights into network threats and traffic patterns, enabling administrators to identify and respond to security incidents more effectively.
Implementation Tips: Utilize logging tools and monitoring systems (such as ELK Stack or Splunk) to collect and analyze logs related to XDP_DROP actions, and ensure that these logs are regularly reviewed for suspicious activities.