Challenge 2 (Resit): Blocked Connection

Important

Submission before Tuesday, August 21, 2026 (23:59:59).

You downloaded an executable named “client” from the internet. You suspect that it might try to leak data by connecting to arbitrary hosts and ports on the internet. You know that this program is only supposed to talk to your own server, which listens on port 5555, so you decide to make sure it can never connect anywhere else. Therefore, you decide to develop an eBPF program that only lets the “client” executable connect to port 5555, and blocks every other connection attempt.

Description

The executable “client” takes a hostname (or IP address) and a port as arguments and tries to open a TCP connection to that host and port. It prints whether the connection succeeded or failed.

Your objective is to develop an eBPF program that prevents any process whose name is “client” from connecting to any port other than 5555, while still letting it connect normally when the destination port is 5555.

This does not seem very hard at first, but preventing a process from opening a connection is actually not something that can be done with eBPF by default. To achieve this, you will have to use the eBPF Linux Security Modules (LSM) mechanism.

This challenge requires you to research by yourself how to use the eBPF LSM mechanism to prevent a process from connecting to a socket.

Important

BPF LSM is not enabled by default on your VM, you will have to enable it yourself. The VM on which your code will be tested will of course have BPF LSM enabled.

Setup

Download the files for this challenge using:

$ wget --no-check-certificate https://people.montefiore.uliege.be/~gain/courses/info0940/asset/blocked_connection.tar.gz
$ tar -xzvf blocked_connection.tar.gz

The suspicious program is located in blocked_connection/telnet/client, and a small server used as its legitimate destination is located in blocked_connection/telnet/server.

Start by launching the server on port 5555, in its own terminal, since that is the only destination the “client” program is allowed to reach:

$ ./server 5555
Server listening on port 5555...

Leave it running, and from another terminal, try connecting to it with the “client” program, as well as to a different, arbitrary port, to make sure everything works before you add any restriction:

$ ./client 127.0.0.1 5555
$ ./client 127.0.0.1 4444

The second command will simply fail with a connection error since nothing is listening on port 4444, which is expected: at this point, nothing is blocking the connection attempt itself, it just has no server to reach.

Inside blocked_connection/src, you will find the same template as in tutorial 3. Use it to implement the eBPF program that only allows the “client” program to connect to port 5555.

What you need to do

You are expected to implement an eBPF program that detects when a process named “client” attempts to open a connection to any port other than 5555. If detected, the eBPF program should block the connection.

Be careful: you must not kill the process, and you must not block connections to port 5555. The process should be able to connect normally to your server on port 5555; it must simply be refused whenever it tries to reach any other port. This is what it will look like when you run the “client” program with your eBPF program loaded (assuming your server is running on port 5555):

# Example with port 5555
$ ./server 5555 # in another terminal
Server listening on port 5555...
Accepted connection from 127.0.0.1:

$ ./client 127.0.0.1 5555
Attempting to connect to 127.0.0.1:5555...
Connected successfully.
Server said: Hello from server

# Example with another port (4444) - must be filtered
$ ./server 4444 # in another terminal
Server listening on port 4444...

$ ./client 127.0.0.1 4444
Attempting to connect to 127.0.0.1:4444...
Error when trying to connect: Operation not permitted

The solution to this challenge should be quite small (around 40 lines), but with the added difficulty of using the eBPF LSM mechanism, which is not covered in the tutorial.