C2b-1: FlowSpec auto-mitigation core (selection + controller + manager + gate) #86

New issue

Closed

opened 2026-07-03 09:49:21 +00:00 by vxfemboy · 0 comments

vxfemboy commented

2026-07-03 09:49:21 +00:00

(Migrated from github.com)

First increment of C2b — a detection auto-becomes the right mitigation.

Pure concentration-based select() (blackwall-flow): a flow-concentrated attack → FlowSpec drop rules (drop the attack flow, victim's other services stay up); a diffuse attack → RTBH whole-IP blackhole.
FlowSpecController + single-owner FlowSpecManager (blackwall-rtbh), mirroring the RTBH controller/manager (eligibility, cap, hold-down + deferred-withdraw + TTL, origin, mirror self-heal); shared iBGP session via an extended BgpExecutor.
SelectorSink routes each detection to the FlowSpec or RTBH manager.
flowspec-auto-bird lab gate: concentrated → FlowSpec rule in real BIRD's flow4tab; diffuse → RTBH /32 blackhole — both auto-mitigation paths proven against real BIRD2.

Codec-first cadence (C1b→C1c style). C2b-2 (persistence + flowspec config directive + blackwalld flowspec CLI + daemon wiring) follows. Sub-project C, epic #6.

First increment of C2b — a detection auto-becomes the *right* mitigation. - Pure concentration-based `select()` (`blackwall-flow`): a flow-concentrated attack → FlowSpec drop rules (drop the attack flow, victim's other services stay up); a diffuse attack → RTBH whole-IP blackhole. - `FlowSpecController` + single-owner `FlowSpecManager` (`blackwall-rtbh`), mirroring the RTBH controller/manager (eligibility, cap, hold-down + deferred-withdraw + TTL, origin, mirror self-heal); shared iBGP session via an extended `BgpExecutor`. - `SelectorSink` routes each detection to the FlowSpec or RTBH manager. - `flowspec-auto-bird` lab gate: concentrated → FlowSpec rule in real BIRD's `flow4tab`; diffuse → RTBH `/32` blackhole — both auto-mitigation paths proven against real BIRD2. Codec-first cadence (C1b→C1c style). C2b-2 (persistence + `flowspec` config directive + `blackwalld flowspec` CLI + daemon wiring) follows. Sub-project C, epic #6.