core unify ebpf for linux & windows

[ZhidongPeng]

No description provided.

[Copilot]

Pull request overview

This PR unifies Linux and Windows eBPF data layouts by introducing shared headers for audit/policy structs, migrates Linux eBPF code to CO-RE-style kernel struct access, and updates the Rust user-space loaders/build pipeline to compile and consume the new layouts (with Windows maintaining backward compatibility for legacy audit entries).

Changes:

• Add canonical shared eBPF structs (gpa_*) and update Linux/Windows eBPF code to use them via typedef/aliases.
• Switch Linux kprobe reads to CO-RE field access (BPF_CORE_READ) with minimal preserve_access_index kernel struct definitions.
• Move Linux eBPF object compilation into proxy_agent/build.rs and adjust CI/scripts to install dependencies and verify the produced object.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
shared-ebpf/include/gpa_libbpf_helpers.h	Adds shared libbpf helper include shim for Linux eBPF sources.
shared-ebpf/include/gpa_audit_event.h	Introduces canonical shared struct layouts for audit/policy data exchanged with user space.
proxy_agent/src/redirector/windows/bpf_prog.rs	Updates audit map lookup to support new canonical layout with legacy fallback.
proxy_agent/src/redirector/windows/bpf_obj.rs	Aligns Windows Rust FFI structs to shared layouts; adds legacy struct + validation helper.
proxy_agent/src/redirector/windows.rs	Updates redirect-context decoding to prefer canonical layout with legacy fallback + trace logging.
proxy_agent/src/redirector/linux.rs	Adjusts Linux lookup API signature (logger passthrough) and updates tests accordingly.
proxy_agent/src/redirector.rs	Threads ConnectionLogger through audit lookup/stream-socket audit retrieval APIs.
proxy_agent/src/proxy/proxy_connection.rs	Updates call sites to pass logger into redirector audit lookup APIs.
proxy_agent/src/proxy.rs	Changes Claims.processName serde representation to a human-readable string.
proxy_agent/build.rs	Adds Linux CO-RE eBPF compilation via clang during Cargo build and copies object to deterministic locations.
linux-ebpf/socket.h	Replaces duplicated structs with shared aliases and adds CO-RE kernel type definitions (sock, sock_common).
linux-ebpf/ebpf_cgroup.c	Migrates map key/value types to shared structs and switches kprobe reads to BPF_CORE_READ.
ebpf/socket.h	Switches Windows eBPF typedefs to shared canonical structs.
ebpf/redirect.bpf.c	Adapts Windows eBPF audit entry fields to canonical layout (logon_id u32, is_root boolean).
doc/plans/Innovation-4.2-core-unify-ebpf.md	Updates the design doc to reflect the implemented approach and constraints discovered.
cspell.json	Adds new technical terms used by the updated docs/build logic.
build.cmd	Minor whitespace-only adjustment.
build-linux.sh	Removes direct clang compilation and verifies the object produced by proxy_agent/build.rs.
.github/workflows/spelling.yml	Updates cspell action version.
.github/workflows/ci.yml	Installs Linux eBPF build dependencies in CI.
.github/workflows/bloat.yml	Installs Linux eBPF build dependencies in bloat workflow matrix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.