Experiment: Split tunnelling with eBPF

[oskirby]

Description

In my recent travels, I stumbled across the BPF_PROG_TYPE_CGROUP_SOCK eBPF program type, which can be attached to control groups to manipulate the sockets that they create, and it takes a mere 4 instructions to set the fwmark on a socket. Doing it this way means that we no longer need NAT and rerouting to perform split tunnelling because we can now do it at socket creation.

This is not a serious PR, just yet, but I am thinking this would be a cool building block for a standalone split tunneling daemon that could run independently of the VPN. Or we could migrate the netfilter module into rust now that we no longer need the xt_cgroups module.

Reference

Inspired by test_cgrp2_sock.c

Checklist

• My code follows the style guidelines for this project
• I have not added any packages that contain high risk or unknown licenses (GPL, LGPL, MPL, etc. consult with DevOps if in question)
• I have performed a self review of my own code
• I have commented my code PARTICULARLY in hard to understand areas
• I have added thorough tests where needed