Hardening Linux Kernel Network Interfaces Against Massive Volumetric DDoS Floods via Custom XDP Drivers

Klíčové body

• Understand XDP. It runs eBPF programs at the NIC driver level, before the kernel network stack.
• Choose the XDP mode. Native mode is fastest but requires driver support; generic mode works everywhere but is slower.
• Write drop rules. Filter by packet rate, source IP, and protocol to identify and drop attack traffic.
• Use XDP_REDIRECT for scrubbing. Redirect suspicious traffic to a scrubbing service instead of dropping outright.
• Monitor with metrics. Export XDP drop counts to Prometheus for visibility.
• Handle legitimate traffic. Ensure rules do not block real users during an attack.
• Test under load. Use traffic generators to verify XDP handles the expected packet rate.
• Plan for escalation. XDP handles millions of pps; for larger attacks, use upstream scrubbing.

Architecture

XDP programs attach to the NIC driver and inspect each packet before it enters the kernel. Malicious packets are dropped immediately, consuming minimal CPU. Legitimate packets pass to the network stack normally. Metrics are exported for monitoring.

Production configuration

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

SEC("xdp")
int xdp_drop(struct xdp_md *ctx) {
    void *data = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;
    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end) return XDP_PASS;
    // drop UDP floods from a single source
    if (eth->h_proto == __constant_htons(ETH_P_IP)) {
        struct iphdr *ip = data + sizeof(*eth);
        if ((void *)(ip + 1) > data_end) return XDP_PASS;
        if (ip->protocol == IPPROTO_UDP) return XDP_DROP;
    }
    return XDP_PASS;
}
char _license[] SEC("license") = "GPL";

clang -O2 -target bpf -c xdp_drop.c -o xdp_drop.o
ip link set dev eth0 xdp obj xdp_drop.o sec xdp

# verify
ip link show eth0 | grep xdp
# check drops
bpftool prog show
# unload
ip link set dev eth0 xdp off

bpftool map show
# export to Prometheus via xdp_exporter
xdp_exporter --interface eth0 --port 9101
# check metrics
curl -s localhost:9101/metrics | grep xdp_drop

Edge cases from production

• Native XDP requires driver support; check with ethtool before relying on it.
• XDP programs have a 1M instruction limit; complex logic must be split.
• Dropping all UDP breaks DNS and QUIC; filter by rate and source, not protocol alone.
• XDP and tc can conflict; use one or the other for a given interface.

Časté dotazy