[B] DDoS data plane (XDP/eBPF) #5

New issue

Closed

opened 2026-06-24 23:48:57 +00:00 by vxfemboy · 0 comments

vxfemboy commented

2026-06-24 23:48:57 +00:00

(Migrated from github.com)

Independent sub-project — high-speed attack filtering. Own spec → plan when scheduled.

XDP/eBPF first-pass drop + AF_XDP zero-copy path
SYNPROXY for SYN-flood absorption
conntrack + rate limiting
Compose in front of the existing nftables policy plane

Complete. Shipped as crates blackwall-xdp (userspace loader/manager/control/sink), blackwall-xdp-ebpf (aya XDP program), blackwall-xdp-common, and blackwall-cookie (no_std SipHash SYN cookies shared userspace↔eBPF):

First-pass drop + AF_XDP zero-copy: fail-closed XDP gating (PROTECT_V4/PROTECT_V6 LpmTrie + PROTECT_PORT) with XDP_DROP, and a xdpilone zero-copy AF_XDP RX/TX path (XSKMAP redirect) for the UDP responder.
SYN-flood absorption: in-kernel SYN-cookie SYN-ACK via XDP_TX (SipHash-2-4 cookies, byte-identical in userspace and eBPF).
Rate limiting: per-source keyed drop / pps rate-limit maps driven by the auto-sink.
Composed ahead of nft: blackwalld attaches the XDP fast path in front of the existing nftables policy plane.

Verified by the XDP BPF_PROG_TEST_RUN and AF_XDP lab gates (green in CI). Remaining niche items are tracked separately (multi-queue AF_XDP needs multi-queue-NIC hardware; realistic DDoS-scale stress testing is #67). Closing.

Independent sub-project — high-speed attack filtering. Own spec → plan when scheduled. - [x] XDP/eBPF first-pass drop + AF_XDP zero-copy path - [x] SYNPROXY for SYN-flood absorption - [x] conntrack + rate limiting - [x] Compose in front of the existing nftables policy plane **Complete.** Shipped as crates `blackwall-xdp` (userspace loader/manager/control/sink), `blackwall-xdp-ebpf` (aya XDP program), `blackwall-xdp-common`, and `blackwall-cookie` (no_std SipHash SYN cookies shared userspace↔eBPF): - **First-pass drop + AF_XDP zero-copy**: fail-closed XDP gating (`PROTECT_V4`/`PROTECT_V6` LpmTrie + `PROTECT_PORT`) with `XDP_DROP`, and a `xdpilone` zero-copy AF_XDP RX/TX path (XSKMAP redirect) for the UDP responder. - **SYN-flood absorption**: in-kernel SYN-cookie SYN-ACK via `XDP_TX` (SipHash-2-4 cookies, byte-identical in userspace and eBPF). - **Rate limiting**: per-source keyed drop / pps rate-limit maps driven by the auto-sink. - **Composed ahead of nft**: blackwalld attaches the XDP fast path in front of the existing nftables policy plane. Verified by the XDP `BPF_PROG_TEST_RUN` and AF_XDP lab gates (green in CI). Remaining niche items are tracked separately (multi-queue AF_XDP needs multi-queue-NIC hardware; realistic DDoS-scale stress testing is #67). Closing.