eBPF & XDP at Scale: 10 Million Packets/Sec DDoS Mitigation & Driver-Level Filtering

// bpf_ddos_mitigator.c
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>

// Define a structure for LPM trie keys
// This structure is critical for the LPM trie map.
// The 'prefixlen' field determines how many bits of the 'data' field are used for matching.
// For IPv4, prefixlen can be 32 for a host match, or less for a subnet.
// For IPv6, prefixlen can be 128 for a host match.
struct bpf_lpm_trie_key {
    __u32 prefixlen; // Must be the first field
    __u32 ip_addr;   // IPv4 address in network byte order
};

// Map for blacklisted IPs (LPM Trie)
// Key: bpf_lpm_trie_key (prefixlen + IP)
// Value: __u8 (e.g., 1 to indicate blacklisted)
struct {
    __uint(type, BPF_MAP_TYPE_LPM_TRIE);
    __uint(max_entries, 10240); // Max 10k blacklist entries
    __uint(key_size, sizeof(struct bpf_lpm_trie_key));
    __uint(value_size, sizeof(__u8));
    __uint(map_flags, BPF_F_NO_PREALLOC); // Don't preallocate all memory
} blacklist_ips SEC(".maps");

// Map for packet counters (per-CPU array)
// Key: __u32 (index for counter type, e.g., 0 for dropped, 1 for passed)
// Value: __u64 (counter)
struct {
    __uint(type, BPF_MAP_TYPE_ARRAY);
    __uint(max_entries, 2); // 0: dropped_packets, 1: passed_packets
    __uint(key_size, sizeof(__u32));
    __uint(value_size, sizeof(__u64));
} xdp_stats_map SEC(".maps");

// Helper macro to increment a counter in the xdp_stats_map
static __always_inline void increment_counter(__u32 index) {
    __u64 *counter = bpf_map_lookup_elem(&xdp_stats_map, &index);
    if (counter) {
        __sync_fetch_and_add(counter, 1);
    }
}

SEC("xdp")
int xdp_ddos_mitigator(struct xdp_md *ctx) {
    void *data_end = (void *)(long)ctx->data_end;
    void *data = (void *)(long)ctx->data;

    struct ethhdr *eth = data;
    if (eth + 1 > data_end) {
        return XDP_PASS; // Malformed Ethernet header
    }

    // Only process IPv4 for this example
    if (bpf_ntohs(eth->h_proto) != ETH_P_IP) {
        return XDP_PASS;
    }

    struct iphdr *iph = data + sizeof(*eth);
    if (iph + 1 > data_end) {
        return XDP_PASS; // Malformed IP header
    }

    // Check if source IP is blacklisted
    struct bpf_lpm_trie_key key = {
        .prefixlen = 32, // Exact match for source IP
        .ip_addr = iph->saddr // Source IP in network byte order
    };
    __u8 *blacklisted = bpf_map_lookup_elem(&blacklist_ips, &key);
    if (blacklisted) {
        // IP is blacklisted, drop the packet
        increment_counter(0); // Increment dropped_packets counter
        return XDP_DROP;
    }

    // Basic SYN flood mitigation (TCP SYN packets without ACK)
    if (iph->protocol == IPPROTO_TCP) {
        struct tcphdr *tcph = (void *)iph + (iph->ihl * 4);
        if (tcph + 1 > data_end) {
            return XDP_PASS; // Malformed TCP header
        }

        // Check for SYN flag set and ACK flag not set
        if (tcph->syn && !tcph->ack) {
            // Potentially a SYN flood packet.
            // For production, this would be more sophisticated,
            // e.g., rate limiting, SYN cookie implementation, or state tracking.
            // For now, we'll just drop it if it's a simple SYN.
            // This is a very aggressive rule and might drop legitimate SYNs.
            // A real-world solution would involve more context.
            // For demonstration, we'll drop if source IP is not whitelisted.
            // (No whitelist implemented here, so it's a direct drop for SYN)
            // increment_counter(0); // Increment dropped_packets counter
            // return XDP_DROP;
        }
    }

    // Basic UDP amplification mitigation (e.g., DNS, NTP, SSDP)
    // This is a simplified example. Real mitigation involves
    // checking payload size, specific protocol headers, and known amplification vectors.
    if (iph->protocol == IPPROTO_UDP) {
        struct udphdr *udph = (void *)iph + (iph->ihl * 4);
        if (udph + 1 > data_end) {
            return XDP_PASS; // Malformed UDP header
        }

        // Example: Drop UDP packets to common amplification ports if source is not trusted
        // This is a placeholder. A real system would check for specific
        // query types, response sizes, or use a dynamic trust list.
        __u16 dest_port = bpf_ntohs(udph->dest);
        if (dest_port == 53 || dest_port == 123 || dest_port == 1900) { // DNS, NTP, SSDP
            // For demonstration, we'll drop these if source is not whitelisted.
            // A real system would have more sophisticated logic.
            // increment_counter(0); // Increment dropped_packets counter
            // return XDP_DROP;
        }
    }

    // If not dropped by any rule, pass to the kernel
    increment_counter(1); // Increment passed_packets counter
    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

# Install necessary packages on Debian/Ubuntu
sudo apt update
sudo apt install clang llvm libelf-dev libbpf-dev build-essential

# Compile the BPF program
clang -O2 -target bpf -g -c bpf_ddos_mitigator.c -o bpf_ddos_mitigator.o

// main.go
package main

import (
	"fmt"
	"log"
	"net"
	"os"
	"os/signal"
	"syscall"
	"time"

	"github.com/cilium/ebpf"
	"github.com/cilium/ebpf/link"
	"github.com/cilium/ebpf/rlimit"
	"github.com/prometheus/client_golang/prometheus"
	"github.com/prometheus/client_golang/prometheus/promhttp"
	"net/http"
)

//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang -cflags "-O2 -g -Wall" bpf bpf_ddos_mitigator.c -- -I./headers

// bpf_lpm_trie_key matches the C struct
type bpfLpmTrieKey struct {
	Prefixlen uint32
	IPAddr    uint32 // Network byte order
}

var (
	droppedPackets = prometheus.NewCounter(
		prometheus.CounterOpts{
			Name: "xdp_dropped_packets_total",
			Help: "Total number of packets dropped by XDP DDoS mitigator.",
		},
	)
	passedPackets = prometheus.NewCounter(
		prometheus.CounterOpts{
			Name: "xdp_passed_packets_total",
			Help: "Total number of packets passed by XDP DDoS mitigator.",
		},
	)
)

func init() {
	prometheus.MustRegister(droppedPackets)
	prometheus.MustRegister(passedPackets)
}

func main() {
	if len(os.Args) < 2 {
		log.Fatalf("Usage: %s <interface>", os.Args[0])
	}
	ifaceName := os.Args[1]

	// Allow the current process to lock memory for eBPF maps.
	if err := rlimit.RemoveMemlock(); err != nil {
		log.Fatalf("Failed to remove memlock rlimit: %v", err)
	}

	// Load pre-compiled programs and maps into the kernel.
	objs := bpfObjects{}
	if err := loadBpfObjects(&objs, nil); err != nil {
		log.Fatalf("Loading eBPF objects: %v", err)
	}
	defer objs.Close()

	iface, err := net.InterfaceByName(ifaceName)
	if err != nil {
		log.Fatalf("Getting interface %s: %v", ifaceName, err)
	}

	// Attach the XDP program to the network interface.
	// Use XDP_FLAGS_DRV_MODE for best performance if driver supports it.
	// Fallback to XDP_FLAGS_SKB_MODE if driver mode fails.
	l, err := link.AttachXDP(link.XDPOptions{
		Program:   objs.XdpDdosMitigator,
		Interface: iface,
		Flags:     uint32(link.XDPDriverMode),
	})
	if err != nil {
		log.Printf("Failed to attach XDP in driver mode, trying SKB mode: %v", err)
		l, err = link.AttachXDP(link.XDPOptions{
			Program:   objs.XdpDdosMitigator,
			Interface: iface,
			Flags:     uint32(link.XDPSkbMode),
		})
		if err != nil {
			log.Fatalf("Failed to attach XDP in SKB mode: %v", err)
		}
	}
	defer l.Close()

	log.Printf("Successfully attached XDP program to interface %q (ID: %d)", ifaceName, objs.XdpDdosMitigator.ID())

	// Example: Add a blacklisted IP (e.g., 192.0.2.1)
	// This would typically come from a dynamic threat feed or detection system.
	blacklistIP := net.ParseIP("192.0.2.1").To4()
	if blacklistIP == nil {
		log.Fatalf("Invalid IP address")
	}
	key := bpfLpmTrieKey{
		Prefixlen: 32, // Exact match
		IPAddr:    uint32(blacklistIP[0])<<24 | uint32(blacklistIP[1])<<16 | uint32(blacklistIP[2])<<8 | uint32(blacklistIP[3]),
	}
	value := uint8(1) // Value doesn't matter, just its presence
	if err := objs.BlacklistIps.Put(key, value); err != nil {
		log.Fatalf("Failed to add IP to blacklist: %v", err)
	}
	log.Printf("Added %s to blacklist.", blacklistIP.String())

	// Start Prometheus metrics server
	go func() {
		http.Handle("/metrics", promhttp.Handler())
		log.Fatal(http.ListenAndServe(":9090", nil))
	}()
	log.Println("Prometheus metrics exposed on :9090/metrics")

	// Periodically read and update Prometheus counters
	ticker := time.NewTicker(1 * time.Second)
	defer ticker.Stop()

	stop := make(chan os.Signal, 1)
	signal.Notify(stop, os.Interrupt, syscall.SIGTERM)

	var prevDropped, prevPassed uint64

	for {
		select {
		case <-ticker.C:
			var currentDropped, currentPassed uint64
			var zero uint32 = 0
			var one uint32 = 1

			if err := objs.XdpStatsMap.Lookup(zero, &currentDropped); err != nil {
				log.Printf("Failed to lookup dropped_packets counter: %v", err)
			}
			if err := objs.XdpStatsMap.Lookup(one, &currentPassed); err != nil {
				log.Printf("Failed to lookup passed_packets counter: %v", err)
			}

			// Update Prometheus counters with delta
			droppedPackets.Add(float64(currentDropped - prevDropped))
			passedPackets.Add(float64(currentPassed - prevPassed))

			prevDropped = currentDropped
			prevPassed = currentPassed

			log.Printf("Dropped: %d, Passed: %d", currentDropped, currentPassed)

		case <-stop:
			log.Println("Detaching XDP program...")
			return
		}
	}
}

go generate ./...

go build -o xdp-mitigator main.go
sudo ./xdp-mitigator eth0 # Replace eth0 with your network interface