rodrigo/server-mv
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
Rodrigo Bertoldo de Sousa Martins committed 2026-09-13 20:49:33 -03:00
commit 01d7cb1a80
34 files changed
+5723
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

xdp/Makefile
+20
View File
@@ -0,0 +1,20 @@
LLC ?= llc
CLANG ?= clang
CC ?= gcc
all: bridge_xdp.o loader
bridge_xdp.o: bridge_xdp.c
$(CLANG) -S \
-target bpf \
-D __BPF_TRACING__ \
-I/usr/include/x86_64-linux-gnu \
-Wall \
-O2 -emit-llvm -c -o bridge_xdp.ll bridge_xdp.c
$(LLC) -march=bpf -filetype=obj -o bridge_xdp.o bridge_xdp.ll
loader: loader.c
$(CC) -Wall -o loader loader.c -l:libbpf.a -lelf -lz
clean:
rm -f bridge_xdp.o bridge_xdp.ll loader
xdp/af_xdp_user
Executable
BIN
View File
Binary file not shown.
xdp/af_xdp_user.c
+158
View File
@@ -0,0 +1,158 @@
// Exemplo AF_XDP com RX, TX, multi-queue e recycling, sem libbpf/xsk.h
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <net/if.h>
#include <sys/socket.h>
#include <linux/if_xdp.h>
#include <linux/if_ether.h>
#include <sys/mman.h>
#include <poll.h>
#include <stdint.h>
#include <sys/types.h>
#define NUM_FRAMES 4096
#define FRAME_SIZE 2048
#define UMEM_SIZE (NUM_FRAMES * FRAME_SIZE)
#define RX_RING_SIZE 2048
#define TX_RING_SIZE 2048
#define FILL_RING_SIZE 2048
#define COMP_RING_SIZE 2048
#define BATCH_SIZE 64
static inline void die(const char *msg) {
perror(msg);
exit(1);
}
static size_t roundup_page(size_t sz) {
size_t pg = sysconf(_SC_PAGESIZE);
return ((sz + pg - 1) / pg) * pg;
}
// Helpers para acessar os pointers dos rings
#define RING_PROD_PTR(ring) ((volatile __u32 *)(ring))
#define RING_CONS_PTR(ring) ((volatile __u32 *)(ring) + 1)
#define RING_DESC(ring) ((void *)((volatile __u32 *)(ring) + 2))
int main(int argc, char **argv) {
if (argc < 2) {
printf("Uso: %s <iface> [queue_id]\n", argv[0]);
return 1;
}
const char *ifname = argv[1];
int queue_id = 0;
if (argc > 2)
queue_id = atoi(argv[2]);
int ifindex = if_nametoindex(ifname);
if (!ifindex) die("if_nametoindex");
// 1. Crie socket AF_XDP
int xdp_sock = socket(AF_XDP, SOCK_RAW, 0);
if (xdp_sock < 0) die("socket(AF_XDP)");
// 2. Alocar UMEM
void *umem_area = NULL;
if (posix_memalign(&umem_area, getpagesize(), UMEM_SIZE))
die("posix_memalign");
// 3. Registrar UMEM no kernel
struct xdp_umem_reg mr = {
.addr = (__u64)(uintptr_t)umem_area,
.len = UMEM_SIZE,
.chunk_size = FRAME_SIZE,
.headroom = 0,
.flags = 0,
};
if (setsockopt(xdp_sock, SOL_XDP, XDP_UMEM_REG, &mr, sizeof(mr)) < 0)
die("setsockopt(XDP_UMEM_REG)");
// 4. Configurar tamanho dos rings
int sz = FILL_RING_SIZE;
if (setsockopt(xdp_sock, SOL_XDP, XDP_UMEM_FILL_RING, &sz, sizeof(sz)) < 0)
die("setsockopt(XDP_UMEM_FILL_RING)");
sz = COMP_RING_SIZE;
if (setsockopt(xdp_sock, SOL_XDP, XDP_UMEM_COMPLETION_RING, &sz, sizeof(sz)) < 0)
die("setsockopt(XDP_UMEM_COMPLETION_RING)");
sz = RX_RING_SIZE;
if (setsockopt(xdp_sock, SOL_XDP, XDP_RX_RING, &sz, sizeof(sz)) < 0)
die("setsockopt(XDP_RX_RING)");
sz = TX_RING_SIZE;
if (setsockopt(xdp_sock, SOL_XDP, XDP_TX_RING, &sz, sizeof(sz)) < 0)
die("setsockopt(XDP_TX_RING)");
// 5. mmap dos rings (tamanho exato, sem roundup_page)
size_t fill_ring_sz = FILL_RING_SIZE * sizeof(__u64) + 8;
size_t comp_ring_sz = COMP_RING_SIZE * sizeof(__u64) + 8;
size_t rx_ring_sz = RX_RING_SIZE * sizeof(struct xdp_desc) + 8;
size_t tx_ring_sz = TX_RING_SIZE * sizeof(struct xdp_desc) + 8;
void *fill_ring = mmap(NULL, fill_ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE, xdp_sock, XDP_UMEM_PGOFF_FILL_RING);
if (fill_ring == MAP_FAILED) die("mmap(FILL_RING)");
void *comp_ring = mmap(NULL, comp_ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE, xdp_sock, XDP_UMEM_PGOFF_COMPLETION_RING);
if (comp_ring == MAP_FAILED) die("mmap(COMP_RING)");
void *rx_ring = mmap(NULL, rx_ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE, xdp_sock, XDP_PGOFF_RX_RING);
if (rx_ring == MAP_FAILED) die("mmap(RX_RING)");
void *tx_ring = mmap(NULL, tx_ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE, xdp_sock, XDP_PGOFF_TX_RING);
if (tx_ring == MAP_FAILED) die("mmap(TX_RING)");
printf("fill_ring: %p, comp_ring: %p, rx_ring: %p, tx_ring: %p\n", fill_ring, comp_ring, rx_ring, tx_ring);
// Cheque ponteiros dos rings
printf("fill_prod_ptr: %p, fill_desc: %p\n", RING_PROD_PTR(fill_ring), RING_DESC(fill_ring));
printf("rx_prod_ptr: %p, rx_desc: %p\n", RING_PROD_PTR(rx_ring), RING_DESC(rx_ring));
printf("tx_prod_ptr: %p, tx_desc: %p\n", RING_PROD_PTR(tx_ring), RING_DESC(tx_ring));
printf("comp_prod_ptr: %p, comp_desc: %p\n", RING_PROD_PTR(comp_ring), RING_DESC(comp_ring));
// 6. Preencher fill ring com endereços dos frames
__u64 *fill = (__u64 *)RING_DESC(fill_ring);
for (int i = 0; i < NUM_FRAMES; i++) {
fill[i] = i * FRAME_SIZE;
}
// Atualizar producer pointer do fill ring
*RING_PROD_PTR(fill_ring) = NUM_FRAMES;
// 7. Bind socket AF_XDP à interface/fila
struct sockaddr_xdp sxdp = {
.sxdp_family = AF_XDP,
.sxdp_ifindex = ifindex,
.sxdp_queue_id = queue_id,
.sxdp_flags = 0,
};
if (bind(xdp_sock, (struct sockaddr *)&sxdp, sizeof(sxdp)) < 0)
die("bind(AF_XDP)");
printf("Socket AF_XDP ligado na interface %s (fila %d)\n", ifname, queue_id);
// 8. Poll para pacotes
struct pollfd fds = { .fd = xdp_sock, .events = POLLIN };
struct xdp_desc *rx = (struct xdp_desc *)RING_DESC(rx_ring);
while (1) {
int ret = poll(&fds, 1, 1000);
if (ret < 0) die("poll");
if (ret == 0) continue;
__u32 rx_cons = *RING_CONS_PTR(rx_ring);
__u32 rx_prod = *RING_PROD_PTR(rx_ring);
if (!rx || rx_prod == rx_cons) continue;
while (rx_cons != rx_prod) {
struct xdp_desc *desc = &rx[rx_cons % RX_RING_SIZE];
if (!desc) break;
void *pkt = (char *)umem_area + desc->addr;
printf("Pacote RX: %u bytes (addr=%llu)\n", desc->len, (unsigned long long)desc->addr);
rx_cons++;
}
*RING_CONS_PTR(rx_ring) = rx_cons;
}
// Cleanup (não alcançado neste exemplo)
close(xdp_sock);
free(umem_area);
return 0;
}
xdp/bridge_xdp.c
+77
View File
@@ -0,0 +1,77 @@
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
#include <linux/if_ether.h>
#include <linux/if_vlan.h>
#include "bridge_xdp.h"
// Definição local para struct vlan_hdr (caso não esteja disponível)
#ifndef VLAN_HLEN
#define VLAN_HLEN 4
#endif
struct vlan_hdr {
__be16 h_vlan_TCI;
__be16 h_vlan_encapsulated_proto;
};
struct {
__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
__uint(max_entries, 1);
__type(key, __u32);
__type(value, struct packet_stats);
} stats_map SEC(".maps");
SEC("xdp")
int bridge_filter(struct xdp_md *ctx)
{
void *data_end = (void *)(long)ctx->data_end;
void *data = (void *)(long)ctx->data;
struct ethhdr *eth = data;
__u16 h_proto;
struct iphdr *iph;
int action = XDP_PASS;
__u32 key = 0;
struct packet_stats *stats;
if ((void*)(eth + 1) > data_end)
return XDP_ABORTED;
h_proto = eth->h_proto;
// Tráfego broadcast/multicast: libera imediatamente
if (eth->h_dest[0] & 1)
goto stats;
// VLAN
if (h_proto == bpf_htons(ETH_P_8021Q) || h_proto == bpf_htons(ETH_P_8021AD)) {
struct vlan_hdr *vhdr = (void *)(eth + 1);
if ((void *)(vhdr + 1) > data_end)
return XDP_ABORTED;
h_proto = vhdr->h_vlan_encapsulated_proto;
iph = (void *)(vhdr + 1);
} else {
iph = (void *)(eth + 1);
}
// IPv4 local: libera imediatamente
if (h_proto == bpf_htons(ETH_P_IP)) {
if ((void*)(iph + 1) > data_end)
goto stats;
if ((iph->daddr & bpf_htonl(0xffff0000)) == bpf_htonl(0x0a0f0000))
goto stats;
}
// ...outros filtros podem ser adicionados aqui...
stats:
// Atualizar estatísticas apenas uma vez
stats = bpf_map_lookup_elem(&stats_map, &key);
if (stats) {
stats->packets++;
stats->bytes += (data_end - data);
}
return action;
}
char _license[] SEC("license") = "GPL";
xdp/bridge_xdp.h
+15
View File
@@ -0,0 +1,15 @@
#ifndef BRIDGE_XDP_H
#define BRIDGE_XDP_H
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>
// Estrutura para estatísticas
struct packet_stats {
__u64 packets;
__u64 bytes;
};
#endif
xdp/bridge_xdp.ll
+250
View File
@@ -0,0 +1,250 @@
; ModuleID = 'bridge_xdp.c'
source_filename = "bridge_xdp.c"
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "bpf"
%struct.anon = type { ptr, ptr, ptr, ptr }
%struct.xdp_md = type { i32, i32, i32, i32, i32, i32 }
%struct.ethhdr = type { [6 x i8], [6 x i8], i16 }
%struct.packet_stats = type { i64, i64 }
@stats_map = dso_local global %struct.anon zeroinitializer, section ".maps", align 8, !dbg !0
@_license = dso_local global [4 x i8] c"GPL\00", section "license", align 1, !dbg !30
@llvm.compiler.used = appending global [3 x ptr] [ptr @_license, ptr @bridge_filter, ptr @stats_map], section "llvm.metadata"
; Function Attrs: nounwind
define dso_local noundef i32 @bridge_filter(ptr nocapture noundef readonly %0) #0 section "xdp" !dbg !67 {
%2 = alloca i32, align 4, !DIAssignID !129
call void @llvm.dbg.assign(metadata i1 undef, metadata !95, metadata !DIExpression(), metadata !129, metadata ptr %2, metadata !DIExpression()), !dbg !130
tail call void @llvm.dbg.value(metadata ptr %0, metadata !80, metadata !DIExpression()), !dbg !130
%3 = getelementptr inbounds %struct.xdp_md, ptr %0, i64 0, i32 1, !dbg !131
%4 = load i32, ptr %3, align 4, !dbg !131, !tbaa !132
%5 = zext i32 %4 to i64, !dbg !137
%6 = inttoptr i64 %5 to ptr, !dbg !138
tail call void @llvm.dbg.value(metadata ptr %6, metadata !81, metadata !DIExpression()), !dbg !130
%7 = load i32, ptr %0, align 4, !dbg !139, !tbaa !140
%8 = zext i32 %7 to i64, !dbg !141
%9 = inttoptr i64 %8 to ptr, !dbg !142
tail call void @llvm.dbg.value(metadata ptr %9, metadata !82, metadata !DIExpression()), !dbg !130
tail call void @llvm.dbg.value(metadata ptr %9, metadata !83, metadata !DIExpression()), !dbg !130
%10 = getelementptr inbounds %struct.ethhdr, ptr %9, i64 1, !dbg !143
%11 = icmp ugt ptr %10, %6, !dbg !145
br i1 %11, label %23, label %12, !dbg !146
12: ; preds = %1
call void @llvm.lifetime.start.p0(i64 4, ptr nonnull %2) #4, !dbg !147
store i32 0, ptr %2, align 4, !dbg !148, !tbaa !149, !DIAssignID !150
call void @llvm.dbg.assign(metadata i32 0, metadata !95, metadata !DIExpression(), metadata !150, metadata ptr %2, metadata !DIExpression()), !dbg !130
%13 = call ptr inttoptr (i64 1 to ptr)(ptr noundef nonnull @stats_map, ptr noundef nonnull %2) #4, !dbg !151
tail call void @llvm.dbg.value(metadata ptr %13, metadata !96, metadata !DIExpression()), !dbg !130
%14 = icmp eq ptr %13, null, !dbg !152
br i1 %14, label %22, label %15, !dbg !154
15: ; preds = %12
%16 = load i64, ptr %13, align 8, !dbg !155, !tbaa !157
%17 = add i64 %16, 1, !dbg !155
store i64 %17, ptr %13, align 8, !dbg !155, !tbaa !157
%18 = sub nsw i64 %5, %8, !dbg !160
%19 = getelementptr inbounds %struct.packet_stats, ptr %13, i64 0, i32 1, !dbg !161
%20 = load i64, ptr %19, align 8, !dbg !162, !tbaa !163
%21 = add i64 %18, %20, !dbg !162
store i64 %21, ptr %19, align 8, !dbg !162, !tbaa !163
br label %22, !dbg !164
22: ; preds = %15, %12
call void @llvm.lifetime.end.p0(i64 4, ptr nonnull %2) #4, !dbg !165
br label %23
23: ; preds = %1, %22
%24 = phi i32 [ 2, %22 ], [ 0, %1 ], !dbg !130
ret i32 %24, !dbg !165
}
; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #1
; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #1
; Function Attrs: mustprogress nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare void @llvm.dbg.assign(metadata, metadata, metadata, metadata, metadata, metadata) #2
; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare void @llvm.dbg.value(metadata, metadata, metadata) #3
attributes #0 = { nounwind "frame-pointer"="all" "no-trapping-math"="true" "stack-protector-buffer-size"="8" }
attributes #1 = { mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { mustprogress nocallback nofree nosync nounwind speculatable willreturn memory(none) }
attributes #3 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
attributes #4 = { nounwind }
!llvm.dbg.cu = !{!2}
!llvm.module.flags = !{!61, !62, !63, !64, !65}
!llvm.ident = !{!66}
!0 = !DIGlobalVariableExpression(var: !1, expr: !DIExpression())
!1 = distinct !DIGlobalVariable(name: "stats_map", scope: !2, file: !3, line: 12, type: !36, isLocal: false, isDefinition: true)
!2 = distinct !DICompileUnit(language: DW_LANG_C11, file: !3, producer: "clang version 18.1.8 ( 18.1.8-3.0.1.el9)", isOptimized: true, runtimeVersion: 0, emissionKind: FullDebug, enums: !4, retainedTypes: !14, globals: !20, splitDebugInlining: false, nameTableKind: None)
!3 = !DIFile(filename: "bridge_xdp.c", directory: "/root/xdp_filter")
!4 = !{!5}
!5 = !DICompositeType(tag: DW_TAG_enumeration_type, name: "xdp_action", file: !6, line: 6313, baseType: !7, size: 32, elements: !8)
!6 = !DIFile(filename: "/usr/include/linux/bpf.h", directory: "")
!7 = !DIBasicType(name: "unsigned int", size: 32, encoding: DW_ATE_unsigned)
!8 = !{!9, !10, !11, !12, !13}
!9 = !DIEnumerator(name: "XDP_ABORTED", value: 0)
!10 = !DIEnumerator(name: "XDP_DROP", value: 1)
!11 = !DIEnumerator(name: "XDP_PASS", value: 2)
!12 = !DIEnumerator(name: "XDP_TX", value: 3)
!13 = !DIEnumerator(name: "XDP_REDIRECT", value: 4)
!14 = !{!15, !16, !17}
!15 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: null, size: 64)
!16 = !DIBasicType(name: "long", size: 64, encoding: DW_ATE_signed)
!17 = !DIDerivedType(tag: DW_TAG_typedef, name: "__u16", file: !18, line: 24, baseType: !19)
!18 = !DIFile(filename: "/usr/include/asm-generic/int-ll64.h", directory: "")
!19 = !DIBasicType(name: "unsigned short", size: 16, encoding: DW_ATE_unsigned)
!20 = !{!21, !30, !0}
!21 = !DIGlobalVariableExpression(var: !22, expr: !DIExpression())
!22 = distinct !DIGlobalVariable(name: "bpf_map_lookup_elem", scope: !2, file: !23, line: 56, type: !24, isLocal: true, isDefinition: true)
!23 = !DIFile(filename: "/usr/include/bpf/bpf_helper_defs.h", directory: "")
!24 = !DIDerivedType(tag: DW_TAG_const_type, baseType: !25)
!25 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !26, size: 64)
!26 = !DISubroutineType(types: !27)
!27 = !{!15, !15, !28}
!28 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !29, size: 64)
!29 = !DIDerivedType(tag: DW_TAG_const_type, baseType: null)
!30 = !DIGlobalVariableExpression(var: !31, expr: !DIExpression())
!31 = distinct !DIGlobalVariable(name: "_license", scope: !2, file: !3, line: 52, type: !32, isLocal: false, isDefinition: true)
!32 = !DICompositeType(tag: DW_TAG_array_type, baseType: !33, size: 32, elements: !34)
!33 = !DIBasicType(name: "char", size: 8, encoding: DW_ATE_signed_char)
!34 = !{!35}
!35 = !DISubrange(count: 4)
!36 = distinct !DICompositeType(tag: DW_TAG_structure_type, file: !3, line: 7, size: 256, elements: !37)
!37 = !{!38, !44, !49, !52}
!38 = !DIDerivedType(tag: DW_TAG_member, name: "type", scope: !36, file: !3, line: 8, baseType: !39, size: 64)
!39 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !40, size: 64)
!40 = !DICompositeType(tag: DW_TAG_array_type, baseType: !41, size: 192, elements: !42)
!41 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)
!42 = !{!43}
!43 = !DISubrange(count: 6)
!44 = !DIDerivedType(tag: DW_TAG_member, name: "max_entries", scope: !36, file: !3, line: 9, baseType: !45, size: 64, offset: 64)
!45 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !46, size: 64)
!46 = !DICompositeType(tag: DW_TAG_array_type, baseType: !41, size: 32, elements: !47)
!47 = !{!48}
!48 = !DISubrange(count: 1)
!49 = !DIDerivedType(tag: DW_TAG_member, name: "key", scope: !36, file: !3, line: 10, baseType: !50, size: 64, offset: 128)
!50 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !51, size: 64)
!51 = !DIDerivedType(tag: DW_TAG_typedef, name: "__u32", file: !18, line: 27, baseType: !7)
!52 = !DIDerivedType(tag: DW_TAG_member, name: "value", scope: !36, file: !3, line: 11, baseType: !53, size: 64, offset: 192)
!53 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !54, size: 64)
!54 = distinct !DICompositeType(tag: DW_TAG_structure_type, name: "packet_stats", file: !55, line: 10, size: 128, elements: !56)
!55 = !DIFile(filename: "./bridge_xdp.h", directory: "/root/xdp_filter")
!56 = !{!57, !60}
!57 = !DIDerivedType(tag: DW_TAG_member, name: "packets", scope: !54, file: !55, line: 11, baseType: !58, size: 64)
!58 = !DIDerivedType(tag: DW_TAG_typedef, name: "__u64", file: !18, line: 31, baseType: !59)
!59 = !DIBasicType(name: "unsigned long long", size: 64, encoding: DW_ATE_unsigned)
!60 = !DIDerivedType(tag: DW_TAG_member, name: "bytes", scope: !54, file: !55, line: 12, baseType: !58, size: 64, offset: 64)
!61 = !{i32 7, !"Dwarf Version", i32 4}
!62 = !{i32 2, !"Debug Info Version", i32 3}
!63 = !{i32 1, !"wchar_size", i32 4}
!64 = !{i32 7, !"frame-pointer", i32 2}
!65 = !{i32 7, !"debug-info-assignment-tracking", i1 true}
!66 = !{!"clang version 18.1.8 ( 18.1.8-3.0.1.el9)"}
!67 = distinct !DISubprogram(name: "bridge_filter", scope: !3, file: !3, line: 15, type: !68, scopeLine: 16, flags: DIFlagPrototyped | DIFlagAllCallsDescribed, spFlags: DISPFlagDefinition | DISPFlagOptimized, unit: !2, retainedNodes: !79)
!68 = !DISubroutineType(types: !69)
!69 = !{!41, !70}
!70 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !71, size: 64)
!71 = distinct !DICompositeType(tag: DW_TAG_structure_type, name: "xdp_md", file: !6, line: 6324, size: 192, elements: !72)
!72 = !{!73, !74, !75, !76, !77, !78}
!73 = !DIDerivedType(tag: DW_TAG_member, name: "data", scope: !71, file: !6, line: 6325, baseType: !51, size: 32)
!74 = !DIDerivedType(tag: DW_TAG_member, name: "data_end", scope: !71, file: !6, line: 6326, baseType: !51, size: 32, offset: 32)
!75 = !DIDerivedType(tag: DW_TAG_member, name: "data_meta", scope: !71, file: !6, line: 6327, baseType: !51, size: 32, offset: 64)
!76 = !DIDerivedType(tag: DW_TAG_member, name: "ingress_ifindex", scope: !71, file: !6, line: 6329, baseType: !51, size: 32, offset: 96)
!77 = !DIDerivedType(tag: DW_TAG_member, name: "rx_queue_index", scope: !71, file: !6, line: 6330, baseType: !51, size: 32, offset: 128)
!78 = !DIDerivedType(tag: DW_TAG_member, name: "egress_ifindex", scope: !71, file: !6, line: 6332, baseType: !51, size: 32, offset: 160)
!79 = !{!80, !81, !82, !83, !95, !96, !97}
!80 = !DILocalVariable(name: "ctx", arg: 1, scope: !67, file: !3, line: 15, type: !70)
!81 = !DILocalVariable(name: "data_end", scope: !67, file: !3, line: 17, type: !15)
!82 = !DILocalVariable(name: "data", scope: !67, file: !3, line: 18, type: !15)
!83 = !DILocalVariable(name: "eth", scope: !67, file: !3, line: 19, type: !84)
!84 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !85, size: 64)
!85 = distinct !DICompositeType(tag: DW_TAG_structure_type, name: "ethhdr", file: !86, line: 166, size: 112, elements: !87)
!86 = !DIFile(filename: "/usr/include/linux/if_ether.h", directory: "")
!87 = !{!88, !91, !92}
!88 = !DIDerivedType(tag: DW_TAG_member, name: "h_dest", scope: !85, file: !86, line: 167, baseType: !89, size: 48)
!89 = !DICompositeType(tag: DW_TAG_array_type, baseType: !90, size: 48, elements: !42)
!90 = !DIBasicType(name: "unsigned char", size: 8, encoding: DW_ATE_unsigned_char)
!91 = !DIDerivedType(tag: DW_TAG_member, name: "h_source", scope: !85, file: !86, line: 168, baseType: !89, size: 48, offset: 48)
!92 = !DIDerivedType(tag: DW_TAG_member, name: "h_proto", scope: !85, file: !86, line: 169, baseType: !93, size: 16, offset: 96)
!93 = !DIDerivedType(tag: DW_TAG_typedef, name: "__be16", file: !94, line: 29, baseType: !17)
!94 = !DIFile(filename: "/usr/include/linux/types.h", directory: "")
!95 = !DILocalVariable(name: "key", scope: !67, file: !3, line: 26, type: !51)
!96 = !DILocalVariable(name: "stats", scope: !67, file: !3, line: 27, type: !53)
!97 = !DILocalVariable(name: "iph", scope: !98, file: !3, line: 39, type: !100)
!98 = distinct !DILexicalBlock(scope: !99, file: !3, line: 38, column: 46)
!99 = distinct !DILexicalBlock(scope: !67, file: !3, line: 38, column: 9)
!100 = !DIDerivedType(tag: DW_TAG_pointer_type, baseType: !101, size: 64)
!101 = distinct !DICompositeType(tag: DW_TAG_structure_type, name: "iphdr", file: !102, line: 87, size: 160, elements: !103)
!102 = !DIFile(filename: "/usr/include/linux/ip.h", directory: "")
!103 = !{!104, !106, !107, !108, !109, !110, !111, !112, !113, !115}
!104 = !DIDerivedType(tag: DW_TAG_member, name: "ihl", scope: !101, file: !102, line: 89, baseType: !105, size: 4, flags: DIFlagBitField, extraData: i64 0)
!105 = !DIDerivedType(tag: DW_TAG_typedef, name: "__u8", file: !18, line: 21, baseType: !90)
!106 = !DIDerivedType(tag: DW_TAG_member, name: "version", scope: !101, file: !102, line: 90, baseType: !105, size: 4, offset: 4, flags: DIFlagBitField, extraData: i64 0)
!107 = !DIDerivedType(tag: DW_TAG_member, name: "tos", scope: !101, file: !102, line: 97, baseType: !105, size: 8, offset: 8)
!108 = !DIDerivedType(tag: DW_TAG_member, name: "tot_len", scope: !101, file: !102, line: 98, baseType: !93, size: 16, offset: 16)
!109 = !DIDerivedType(tag: DW_TAG_member, name: "id", scope: !101, file: !102, line: 99, baseType: !93, size: 16, offset: 32)
!110 = !DIDerivedType(tag: DW_TAG_member, name: "frag_off", scope: !101, file: !102, line: 100, baseType: !93, size: 16, offset: 48)
!111 = !DIDerivedType(tag: DW_TAG_member, name: "ttl", scope: !101, file: !102, line: 101, baseType: !105, size: 8, offset: 64)
!112 = !DIDerivedType(tag: DW_TAG_member, name: "protocol", scope: !101, file: !102, line: 102, baseType: !105, size: 8, offset: 72)
!113 = !DIDerivedType(tag: DW_TAG_member, name: "check", scope: !101, file: !102, line: 103, baseType: !114, size: 16, offset: 80)
!114 = !DIDerivedType(tag: DW_TAG_typedef, name: "__sum16", file: !94, line: 35, baseType: !17)
!115 = !DIDerivedType(tag: DW_TAG_member, scope: !101, file: !102, line: 104, baseType: !116, size: 64, offset: 96)
!116 = distinct !DICompositeType(tag: DW_TAG_union_type, scope: !101, file: !102, line: 104, size: 64, elements: !117)
!117 = !{!118, !124}
!118 = !DIDerivedType(tag: DW_TAG_member, scope: !116, file: !102, line: 104, baseType: !119, size: 64)
!119 = distinct !DICompositeType(tag: DW_TAG_structure_type, scope: !116, file: !102, line: 104, size: 64, elements: !120)
!120 = !{!121, !123}
!121 = !DIDerivedType(tag: DW_TAG_member, name: "saddr", scope: !119, file: !102, line: 104, baseType: !122, size: 32)
!122 = !DIDerivedType(tag: DW_TAG_typedef, name: "__be32", file: !94, line: 31, baseType: !51)
!123 = !DIDerivedType(tag: DW_TAG_member, name: "daddr", scope: !119, file: !102, line: 104, baseType: !122, size: 32, offset: 32)
!124 = !DIDerivedType(tag: DW_TAG_member, name: "addrs", scope: !116, file: !102, line: 104, baseType: !125, size: 64)
!125 = distinct !DICompositeType(tag: DW_TAG_structure_type, scope: !116, file: !102, line: 104, size: 64, elements: !126)
!126 = !{!127, !128}
!127 = !DIDerivedType(tag: DW_TAG_member, name: "saddr", scope: !125, file: !102, line: 104, baseType: !122, size: 32)
!128 = !DIDerivedType(tag: DW_TAG_member, name: "daddr", scope: !125, file: !102, line: 104, baseType: !122, size: 32, offset: 32)
!129 = distinct !DIAssignID()
!130 = !DILocation(line: 0, scope: !67)
!131 = !DILocation(line: 17, column: 41, scope: !67)
!132 = !{!133, !134, i64 4}
!133 = !{!"xdp_md", !134, i64 0, !134, i64 4, !134, i64 8, !134, i64 12, !134, i64 16, !134, i64 20}
!134 = !{!"int", !135, i64 0}
!135 = !{!"omnipotent char", !136, i64 0}
!136 = !{!"Simple C/C++ TBAA"}
!137 = !DILocation(line: 17, column: 30, scope: !67)
!138 = !DILocation(line: 17, column: 22, scope: !67)
!139 = !DILocation(line: 18, column: 37, scope: !67)
!140 = !{!133, !134, i64 0}
!141 = !DILocation(line: 18, column: 26, scope: !67)
!142 = !DILocation(line: 18, column: 18, scope: !67)
!143 = !DILocation(line: 22, column: 21, scope: !144)
!144 = distinct !DILexicalBlock(scope: !67, file: !3, line: 22, column: 9)
!145 = !DILocation(line: 22, column: 26, scope: !144)
!146 = !DILocation(line: 22, column: 9, scope: !67)
!147 = !DILocation(line: 26, column: 5, scope: !67)
!148 = !DILocation(line: 26, column: 11, scope: !67)
!149 = !{!134, !134, i64 0}
!150 = distinct !DIAssignID()
!151 = !DILocation(line: 27, column: 34, scope: !67)
!152 = !DILocation(line: 28, column: 9, scope: !153)
!153 = distinct !DILexicalBlock(scope: !67, file: !3, line: 28, column: 9)
!154 = !DILocation(line: 28, column: 9, scope: !67)
!155 = !DILocation(line: 29, column: 23, scope: !156)
!156 = distinct !DILexicalBlock(scope: !153, file: !3, line: 28, column: 16)
!157 = !{!158, !159, i64 0}
!158 = !{!"packet_stats", !159, i64 0, !159, i64 8}
!159 = !{!"long long", !135, i64 0}
!160 = !DILocation(line: 30, column: 35, scope: !156)
!161 = !DILocation(line: 30, column: 16, scope: !156)
!162 = !DILocation(line: 30, column: 22, scope: !156)
!163 = !{!158, !159, i64 8}
!164 = !DILocation(line: 31, column: 5, scope: !156)
!165 = !DILocation(line: 50, column: 1, scope: !67)
xdp/bridge_xdp.o
BIN
View File
Binary file not shown.
xdp/loader.c
+33
View File
@@ -0,0 +1,33 @@
#include <stdio.h>
#include <bpf/libbpf.h>
#include "bridge_xdp.h"
int main(int argc, char **argv)
{
if (argc != 2) {
printf("Uso: %s <interface>\n", argv[0]);
return 1;
}
// Carregar programa XDP
struct bpf_object *obj = bpf_object__open("bridge_xdp.o");
if (!obj) {
printf("Erro ao abrir objeto BPF\n");
return 1;
}
if (bpf_object__load(obj)) {
printf("Erro ao carregar objeto BPF\n");
return 1;
}
// Anexar à interface
int prog_fd = bpf_program__fd(bpf_object__find_program_by_name(obj, "bridge_filter"));
if (bpf_xdp_attach(if_nametoindex(argv[1]), prog_fd, XDP_FLAGS_SKB_MODE, NULL) != 0) {
printf("Erro ao anexar XDP\n");
return 1;
}
printf("XDP anexado com sucesso à interface %s\n", argv[1]);
return 0;
}
xdp/rc.local
+102
View File
@@ -0,0 +1,102 @@
#!/bin/bash
# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
#
# It is highly advisable to create own systemd services or udev rules
# to run scripts during boot instead of using this file.
#
# In contrast to previous versions due to parallel execution during boot
# this script will NOT be run after all other services.
#
# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
# that this script will be executed during boot.
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 32101 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 32110 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 32100 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 32400 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 8117 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i enp0s6 -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A INPUT -i wg0 -j ACCEPT
# Permitir SIP (UDP/TCP 5060/5061), IAX2 (UDP 4569), RTP (UDP 18000:19000) para FreePBX
iptables -A INPUT -i enp0s6 -p udp --dport 5060 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 5060 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 5061 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 5061 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 5160 -j ACCEPT
iptables -A INPUT -i enp0s6 -p tcp --dport 5161 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 4569 -j ACCEPT
iptables -A INPUT -i enp0s6 -p udp --dport 18000:19000 -j ACCEPT
# Permitir tráfego de retorno (deve estar antes do DROP final)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.15.0.0/16 -j MASQUERADE
ip6tables -t nat -A POSTROUTING -s 2001:db8:15::/48 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 172.17.0.0/16 -j MASQUERADE
# Habilitar redirecionamento de pacotes no kernel
echo 1 > /proc/sys/net/ipv4/ip_forward
# 1. DNAT APENAS para tráfego entrando na interface enp0s6 (WAN) com destino ao IP público
iptables -t nat -A PREROUTING -i enp0s6 -p tcp --dport 80 -j DNAT --to-destination 10.15.0.45:80
iptables -t nat -A PREROUTING -i enp0s6 -p tcp --dport 443 -j DNAT --to-destination 10.15.0.45:443
# 2. SNAT (Hairpinning) para clientes locais acessarem via IP público
iptables -t nat -A POSTROUTING -o enp0s6 -p tcp -d 10.15.0.45 --dport 80 -j MASQUERADE
iptables -t nat -A POSTROUTING -o enp0s6 -p tcp -d 10.15.0.45 --dport 443 -j MASQUERADE
# Permitir o tráfego na cadeia FORWARD
iptables -A FORWARD -p tcp -d 10.15.0.45 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.15.0.45 --dport 443 -j ACCEPT
sh /root/test.sh
echo deadline > /sys/block/sda/queue/scheduler
touch /var/lock/subsys/local
#echo "bfq" > /sys/block/sda/queue/scheduler
#echo "1500" > /sys/block/sda/queue/iosched/read_expire
echo 64 > /sys/block/sda/queue/max_sectors_kb # Melhor para SSD virtual
echo deadline > /sys/block/sda/queue/scheduler # Alternativa ao BFQ
echo 0 > /proc/sys/vm/zone_reclaim_mode
tc qdisc add dev enp0s6 root cake bandwidth 1000mbit besteffort
tc qdisc add dev wg0 root cake bandwidth 500mbit besteffort dual-dsthost
echo f > /sys/class/net/enp0s6/queues/tx-0/xps_cpus
echo f > /sys/class/net/enp0s6/queues/rx-0/rps_cpus
# XPS para núcleos 4-7 (máscara 0xf0)
# Aumentar buffer de entrada/saída fixo
echo 4096 > /sys/class/net/enp0s6/queues/rx-0/rps_flow_cnt
echo 4096 > /proc/sys/net/core/rps_sock_flow_entries
sh /root/qos.sh
#cd /root/xdp_new && \
cd /home/rodrigo/xdp && \
ip link set enp0s6 mtu 1500
ip link set dev enp0s6 xdp obj xdp_ddos_filter.o sec xdp
sleep 20
ip link set dev br-02f7820020b4 xdp obj bridge_xdp.o sec xdp
ip link delete br-8b341d0f5c20
iptables -t nat -A POSTROUTING -o wg3 -j MASQUERADE
xdp/xdp_ddos_filter.bak.c
+451
View File
@@ -0,0 +1,451 @@
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/in.h>
#include <linux/icmp.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
// Otimização: constantes ajustadas para seu ambiente específico
#define MAX_HIGH_PRIORITY_PACKETS_PER_SECOND 3000 // Aumentado para serviços críticos (HTTP/HTTPS)
#define MAX_LOW_PRIORITY_PACKETS_PER_SECOND 500
#define MAX_PACKETS_PER_IP 300000
#define MAX_ICMP_PACKETS_PER_IP 30 // Reduzido conforme política ICMP restritiva
#define MAX_SYN_PACKETS_PER_IP 80 // Reduzido para proteção preventiva
#define TIMEOUT_SEC 1
#define PACKET_COST 1
#define HIGH_PRIO_TOKEN_RATE 3000 // Aumentado para combinar com QoS HTB
#define LOW_PRIO_TOKEN_RATE 500
#define MAX_TOKENS 3000
#define DOCKER_NETWORK_PREFIX 0x0A0F0000 // 10.15.0.0
#define DOCKER_NETWORK_MASK 0xFFFF0000 // /16
#define WG_NETWORK_PREFIX 0x0A630100 // 10.99.1.0
#define WG_NETWORK_MASK 0xFFFFFF00 // /24
#define NGINX_SERVER_IP 0x0A0F002D // 10.15.0.45
// Estrutura de dados otimizada com tipos consistentes
struct ip_stats {
__u32 pkt_count;
__u32 last_seen;
__u32 icmp_count;
__u32 syn_count;
__u32 high_prio_tokens;
__u32 low_prio_tokens;
__u16 flags; // Expandido para mais flags
__u16 padding; // Mantém alinhamento 4-bytes
} __attribute__((packed));
// Estrutura para configuração de redes internas
struct network_config {
__u32 prefix;
__u32 mask;
};
// Estrutura para configuração de portas
struct port_config {
__u8 priority; // 0=baixa, 1=média, 2=alta
__u8 is_filtered; // 0=não, 1=sim
};
// Adicionar flags para comportamento de tráfego
#define FLAG_POTENTIAL_SCANNER 0x01
#define FLAG_SYN_FLOOD 0x02
#define FLAG_ICMP_FLOOD 0x04
#define FLAG_MARKED_SUSPICIOUS 0x08
struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__uint(max_entries, 100000);
__type(key, __u32);
__type(value, struct ip_stats);
} ddos_map SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 1000);
__type(key, __u32);
__type(value, __u32);
} whitelist_map SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__uint(max_entries, 100000);
__type(key, __u32);
__type(value, __u32);
} blacklist_map SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 100);
__type(key, __u32);
__type(value, struct network_config);
} internal_networks SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 65536);
__type(key, __u16);
__type(value, struct port_config);
} port_config_map SEC(".maps");
// Mapa para tempos de expiração
struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__uint(max_entries, 100000);
__type(key, __u32);
__type(value, __u32);
} expiration_map SEC(".maps");
// Mapa para estatísticas de tráfego para integração com userspace
struct traffic_stats {
__u64 total_packets;
__u64 dropped_packets;
__u64 passed_packets;
__u64 blacklisted_count;
__u64 syn_flood_count;
__u64 icmp_flood_count;
};
struct {
__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
__uint(max_entries, 1);
__type(key, __u32);
__type(value, struct traffic_stats);
} stats_map SEC(".maps");
// Fast-path para serviços críticos - pré-verifica IPs confiáveis
struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__uint(max_entries, 1000);
__type(key, __u32);
__type(value, __u8); // 1 = confiável
} trusted_hosts_map SEC(".maps");
// Mapa para interface de redirecionamento
struct {
__uint(type, BPF_MAP_TYPE_XSKMAP);
__uint(max_entries, 1);
__type(key, int);
__type(value, int);
} xsks_map SEC(".maps");
// Função otimizada para timestamp
static __always_inline __u32 get_time_sec(void) {
return bpf_ktime_get_ns() / 1000000000;
}
static __always_inline int is_whitelisted(__u32 ip) {
return bpf_map_lookup_elem(&whitelist_map, &ip) != NULL;
}
static __always_inline int is_blacklisted(__u32 ip) {
__u32 now = get_time_sec();
__u32 *block_time = bpf_map_lookup_elem(&blacklist_map, &ip);
if (block_time) {
// Se passou mais de 1 hora, remove da blacklist
if (now - *block_time > 3600) {
bpf_map_delete_elem(&blacklist_map, &ip);
return 0;
}
return 1;
}
return 0;
}
static __always_inline int is_internal_network(__u32 ip) {
struct network_config *net;
__u32 key = 0;
// Iteração limitada pelo verificador
#pragma unroll
for (int i = 0; i < 8; i++) {
key = i;
net = bpf_map_lookup_elem(&internal_networks, &key);
if (!net)
break;
if ((ip & net->mask) == net->prefix)
return 1;
}
return 0;
}
static __always_inline int get_port_priority(__u16 port) {
struct port_config *cfg = bpf_map_lookup_elem(&port_config_map, &port);
if (cfg)
return cfg->priority;
return 0;
}
static __always_inline int is_filtered_port(__u16 port) {
struct port_config *cfg = bpf_map_lookup_elem(&port_config_map, &port);
if (cfg)
return cfg->is_filtered;
return (port <= 1024);
}
// Função para atualizar estatísticas de tráfego
static __always_inline void update_stats(__u32 action, __u8 flags) {
__u32 key = 0;
struct traffic_stats *stats = bpf_map_lookup_elem(&stats_map, &key);
if (stats) {
stats->total_packets++;
if (action == XDP_DROP) {
stats->dropped_packets++;
if (flags & FLAG_SYN_FLOOD)
stats->syn_flood_count++;
if (flags & FLAG_ICMP_FLOOD)
stats->icmp_flood_count++;
} else if (action == XDP_PASS) {
stats->passed_packets++;
}
if (flags & FLAG_MARKED_SUSPICIOUS)
stats->blacklisted_count++;
}
}
// Macro para conversão de porta e IP
#define ntohs(x) __builtin_bswap16(x)
#define ntohl(x) __builtin_bswap32(x)
// Versão otimizada do programa principal
SEC("xdp")
int xdp_ddos_filter(struct xdp_md *ctx) {
void *data_end = (void *)(long)ctx->data_end;
void *data = (void *)(long)ctx->data;
__u8 flags = 0;
// Verificação rápida de tamanho mínimo do pacote
if (data + sizeof(struct ethhdr) + sizeof(struct iphdr) > data_end)
return XDP_PASS;
struct ethhdr *eth = data;
if (eth->h_proto != __constant_htons(ETH_P_IP))
return XDP_PASS;
struct iphdr *ip = (void *)(eth + 1);
if ((void *)(ip + 1) > data_end || ip->ihl != 5 || ip->version != 4)
return XDP_PASS;
__u32 src_ip = ip->saddr;
__u32 dst_ip = ip->daddr;
// Fast path: redes internas, whitelist e trusted hosts
if (is_internal_network(src_ip) || is_whitelisted(src_ip)) return XDP_PASS;
__u8 *trusted = bpf_map_lookup_elem(&trusted_hosts_map, &src_ip);
if (trusted && *trusted == 1) return XDP_PASS;
// Fast path: blacklist
if (is_blacklisted(src_ip)) {
update_stats(XDP_DROP, FLAG_MARKED_SUSPICIOUS);
return XDP_DROP;
}
// Fast path: WireGuard UDP/32100
if (ip->protocol == IPPROTO_UDP) {
struct udphdr *udp = (void *)(ip + 1);
if ((void *)(udp + 1) <= data_end) {
__u16 dest_port = ntohs(udp->dest);
if (dest_port == 32100 || dest_port == 32400 || dest_port == 32101 || dest_port == 32110) {
update_stats(XDP_PASS, 0);
return XDP_PASS;
}
}
}
// Variáveis locais para portas e flags
__u16 dest_port = 0;
int is_syn = 0, is_icmp = 0;
// Processamento por protocolo
if (ip->protocol == IPPROTO_TCP) {
struct tcphdr *tcp = (void *)(ip + 1);
if ((void *)(tcp + 1) > data_end) return XDP_PASS;
dest_port = ntohs(tcp->dest);
is_syn = tcp->syn && !tcp->ack;
// Detecção de port scan
if ((tcp->syn && tcp->rst) || (tcp->fin && tcp->rst) || (tcp->fin && tcp->syn))
flags |= FLAG_POTENTIAL_SCANNER;
} else if (ip->protocol == IPPROTO_UDP) {
struct udphdr *udp = (void *)(ip + 1);
if ((void *)(udp + 1) > data_end) return XDP_PASS;
dest_port = ntohs(udp->dest);
} else if (ip->protocol == IPPROTO_ICMP) {
is_icmp = 1;
struct icmphdr *icmp = (void *)(ip + 1);
if ((void *)(icmp + 1) > data_end) return XDP_PASS;
// Permitir apenas echo-reply (0) e limitar echo-request (8)
if (icmp->type != 0 && icmp->type != 8) {
update_stats(XDP_DROP, 0);
return XDP_DROP;
}
} else {
return XDP_PASS;
}
// Se não for porta filtrada e não for ICMP, libera rápido
if (!is_filtered_port(dest_port) && !is_icmp) {
struct ip_stats *entry = bpf_map_lookup_elem(&ddos_map, &src_ip);
if (entry && entry->pkt_count > 5 && entry->flags == 0) {
__u8 mark_trusted = 1;
bpf_map_update_elem(&trusted_hosts_map, &src_ip, &mark_trusted, BPF_ANY);
}
return XDP_PASS;
}
// Rate limiting e contadores
int priority = get_port_priority(dest_port);
struct ip_stats *entry = bpf_map_lookup_elem(&ddos_map, &src_ip);
__u32 now = get_time_sec();
// Use variáveis locais para tokens e contadores
__u32 pkt_count = 1, icmp_count = is_icmp ? 1 : 0, syn_count = is_syn ? 1 : 0;
__u32 high_tokens = MAX_TOKENS - PACKET_COST, low_tokens = MAX_TOKENS - PACKET_COST;
__u16 entry_flags = flags;
if (entry) {
__u32 elapsed = now > entry->last_seen ? now - entry->last_seen : 0;
pkt_count = entry->pkt_count + 1;
icmp_count = is_icmp ? entry->icmp_count + 1 : entry->icmp_count;
syn_count = is_syn ? entry->syn_count + 1 : entry->syn_count;
high_tokens = entry->high_prio_tokens;
low_tokens = entry->low_prio_tokens;
entry_flags = entry->flags | flags;
if (elapsed > 0) {
__u32 add_high = HIGH_PRIO_TOKEN_RATE * elapsed;
__u32 add_low = LOW_PRIO_TOKEN_RATE * elapsed;
high_tokens = (high_tokens + add_high > MAX_TOKENS) ? MAX_TOKENS : high_tokens + add_high;
low_tokens = (low_tokens + add_low > MAX_TOKENS) ? MAX_TOKENS : low_tokens + add_low;
if (elapsed >= TIMEOUT_SEC) {
icmp_count = is_icmp ? 1 : 0;
syn_count = is_syn ? 1 : 0;
entry_flags &= ~(FLAG_SYN_FLOOD | FLAG_ICMP_FLOOD);
}
}
// Flood ICMP
if (is_icmp && icmp_count > MAX_ICMP_PACKETS_PER_IP) {
entry_flags |= FLAG_ICMP_FLOOD;
__u32 one = 1;
bpf_map_update_elem(&blacklist_map, &src_ip, &one, BPF_ANY);
update_stats(XDP_DROP, FLAG_ICMP_FLOOD);
goto update_entry_and_drop;
}
// Flood SYN
if (is_syn && syn_count > MAX_SYN_PACKETS_PER_IP) {
entry_flags |= FLAG_SYN_FLOOD;
__u32 one = 1;
bpf_map_update_elem(&blacklist_map, &src_ip, &one, BPF_ANY);
update_stats(XDP_DROP, FLAG_SYN_FLOOD);
goto update_entry_and_drop;
}
// Flood total
if (pkt_count > MAX_PACKETS_PER_IP) {
entry_flags |= FLAG_MARKED_SUSPICIOUS;
__u32 one = 1;
bpf_map_update_elem(&blacklist_map, &src_ip, &one, BPF_ANY);
update_stats(XDP_DROP, FLAG_MARKED_SUSPICIOUS);
goto update_entry_and_drop;
}
// Token bucket
if (priority == 2) {
if (high_tokens >= PACKET_COST) {
high_tokens -= PACKET_COST;
goto update_entry_and_pass;
}
} else if (priority == 1) {
if (high_tokens >= PACKET_COST/2 && low_tokens >= PACKET_COST/2) {
high_tokens -= PACKET_COST/2;
low_tokens -= PACKET_COST/2;
goto update_entry_and_pass;
}
} else {
if (low_tokens >= PACKET_COST) {
low_tokens -= PACKET_COST;
goto update_entry_and_pass;
}
}
update_stats(XDP_DROP, 0);
goto update_entry_and_drop;
update_entry_and_pass:
{
struct ip_stats new_entry = {
.pkt_count = pkt_count,
.last_seen = now,
.icmp_count = icmp_count,
.syn_count = syn_count,
.high_prio_tokens = high_tokens,
.low_prio_tokens = low_tokens,
.flags = entry_flags
};
bpf_map_update_elem(&ddos_map, &src_ip, &new_entry, BPF_ANY);
update_stats(XDP_PASS, 0);
return XDP_PASS;
}
update_entry_and_drop:
{
struct ip_stats new_entry = {
.pkt_count = pkt_count,
.last_seen = now,
.icmp_count = icmp_count,
.syn_count = syn_count,
.high_prio_tokens = high_tokens,
.low_prio_tokens = low_tokens,
.flags = entry_flags
};
bpf_map_update_elem(&ddos_map, &src_ip, &new_entry, BPF_ANY);
return XDP_DROP;
}
} else {
// Primeira vez que vemos este IP
struct ip_stats new_entry = {
.pkt_count = pkt_count,
.last_seen = now,
.icmp_count = icmp_count,
.syn_count = syn_count,
.high_prio_tokens = high_tokens,
.low_prio_tokens = low_tokens,
.flags = entry_flags
};
bpf_map_update_elem(&ddos_map, &src_ip, &new_entry, BPF_ANY);
update_stats(XDP_PASS, 0);
return XDP_PASS;
}
// Redirecionamento AF_XDP para portas 80, 443 (TCP) e 32100 (UDP)
int xsk_map_key = ctx->rx_queue_index;
// TCP: 80 ou 443
if (ip->protocol == IPPROTO_TCP) {
struct tcphdr *tcp = (void *)(ip + 1);
if ((void *)(tcp + 1) > data_end) return XDP_PASS;
__u16 dest_port = ntohs(tcp->dest);
if (dest_port == 80 || dest_port == 443) {
if (bpf_map_lookup_elem(&xsks_map, &xsk_map_key))
return XDP_REDIRECT;
}
}
// UDP: 32100 (WireGuard)
if (ip->protocol == IPPROTO_UDP) {
struct udphdr *udp = (void *)(ip + 1);
if ((void *)(udp + 1) > data_end) return XDP_PASS;
__u16 dest_port = ntohs(udp->dest);
if (dest_port == 32100 || dest_port == 32110 || dest_port == 32101|| dest_port == 32400|| dest_port == 5060) {
if (bpf_map_lookup_elem(&xsks_map, &xsk_map_key))
return XDP_REDIRECT;
}
}
return XDP_PASS;
}
char __license[] SEC("license") = "GPL";
xdp/xdp_ddos_filter.c
+614
View File
@@ -0,0 +1,614 @@
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/in.h>
#include <linux/icmp.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
// Otimização: constantes ajustadas para seu ambiente específico
#define MAX_HIGH_PRIORITY_PACKETS_PER_SECOND 3000 // Aumentado para serviços críticos (HTTP/HTTPS)
#define MAX_LOW_PRIORITY_PACKETS_PER_SECOND 500
#define MAX_PACKETS_PER_IP 300000
#define MAX_ICMP_PACKETS_PER_IP 30 // Reduzido conforme política ICMP restritiva
#define MAX_SYN_PACKETS_PER_IP 15 // Reduzido drasticamente para proteção contra SYN flood
#define MAX_SYN_PACKETS_PER_SECOND 8 // Limite de SYN por segundo por IP
#define TIMEOUT_SEC 1
#define SUSPICIOUS_TTL_THRESHOLD 240 // TTLs acima de 240 são suspeitos
#define SUSPICIOUS_WINDOW_SIZE 53270 // Window size específico de ataques conhecidos
#define PACKET_COST 1
#define HIGH_PRIO_TOKEN_RATE 3000 // Aumentado para combinar com QoS HTB
#define LOW_PRIO_TOKEN_RATE 500
#define MAX_TOKENS 3000
#define DOCKER_NETWORK_PREFIX 0x0A0F0000 // 10.15.0.0
#define DOCKER_NETWORK_MASK 0xFFFF0000 // /16
#define WG_NETWORK_PREFIX 0x0A630100 // 10.99.1.0
#define WG_NETWORK_MASK 0xFFFFFF00 // /24
#define NGINX_SERVER_IP 0x0A0F002D // 10.15.0.45
// Estrutura de dados otimizada com tipos consistentes
struct ip_stats {
__u32 pkt_count;
__u32 last_seen;
__u32 icmp_count;
__u32 syn_count;
__u32 high_prio_tokens;
__u32 low_prio_tokens;
__u32 syn_last_sec; // Timestamp do último segundo para contagem de SYN
__u32 syn_count_per_sec; // Contador de SYN no último segundo
__u16 flags; // Expandido para mais flags
__u16 padding; // Mantém alinhamento 4-bytes
} __attribute__((packed));
// Estrutura para configuração de redes internas
struct network_config {
__u32 prefix;
__u32 mask;
};
// Estrutura para configuração de portas
struct port_config {
__u8 priority; // 0=baixa, 1=média, 2=alta
__u8 is_filtered; // 0=não, 1=sim
};
// Adicionar flags para comportamento de tráfego
#define FLAG_POTENTIAL_SCANNER 0x01
#define FLAG_SYN_FLOOD 0x02
#define FLAG_ICMP_FLOOD 0x04
#define FLAG_MARKED_SUSPICIOUS 0x08
#define FLAG_SUSPICIOUS_TTL 0x10
#define FLAG_SUSPICIOUS_WINDOW 0x20
#define FLAG_SSH_ATTACKER 0x40
#define FLAG_HTTP_ATTACKER 0x80
struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__uint(max_entries, 100000);
__type(key, __u32);
__type(value, struct ip_stats);
} ddos_map SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 1000);
__type(key, __u32);
__type(value, __u32);
} whitelist_map SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__uint(max_entries, 100000);
__type(key, __u32);
__type(value, __u32);
} blacklist_map SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 100);
__type(key, __u32);
__type(value, struct network_config);
} internal_networks SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 65536);
__type(key, __u16);
__type(value, struct port_config);
} port_config_map SEC(".maps");
// Mapa para tempos de expiração
struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__uint(max_entries, 100000);
__type(key, __u32);
__type(value, __u32);
} expiration_map SEC(".maps");
// Mapa para estatísticas de tráfego para integração com userspace
struct traffic_stats {
__u64 total_packets;
__u64 dropped_packets;
__u64 passed_packets;
__u64 blacklisted_count;
__u64 syn_flood_count;
__u64 icmp_flood_count;
};
struct {
__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
__uint(max_entries, 1);
__type(key, __u32);
__type(value, struct traffic_stats);
} stats_map SEC(".maps");
// Fast-path para serviços críticos - pré-verifica IPs confiáveis
struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__uint(max_entries, 1000);
__type(key, __u32);
__type(value, __u8); // 1 = confiável
} trusted_hosts_map SEC(".maps");
// Mapa para interface de redirecionamento
struct {
__uint(type, BPF_MAP_TYPE_XSKMAP);
__uint(max_entries, 1);
__type(key, int);
__type(value, int);
} xsks_map SEC(".maps");
// Mapa para rastrear taxa global de SYN por porta
struct syn_rate_stats {
__u32 last_sec;
__u32 count;
};
struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__uint(max_entries, 1000);
__type(key, __u16); // porta de destino
__type(value, struct syn_rate_stats);
} syn_rate_map SEC(".maps");
// Função otimizada para timestamp
static __always_inline __u32 get_time_sec(void) {
return bpf_ktime_get_ns() / 1000000000;
}
static __always_inline int is_whitelisted(__u32 ip) {
return bpf_map_lookup_elem(&whitelist_map, &ip) != NULL;
}
static __always_inline int is_blacklisted(__u32 ip) {
__u32 now = get_time_sec();
__u32 *block_time = bpf_map_lookup_elem(&blacklist_map, &ip);
if (block_time) {
// Se passou mais de 1 hora, remove da blacklist
if (now - *block_time > 3600) {
bpf_map_delete_elem(&blacklist_map, &ip);
return 0;
}
return 1;
}
return 0;
}
static __always_inline int is_internal_network(__u32 ip) {
struct network_config *net;
__u32 key = 0;
// Iteração limitada pelo verificador
#pragma unroll
for (int i = 0; i < 8; i++) {
key = i;
net = bpf_map_lookup_elem(&internal_networks, &key);
if (!net)
break;
if ((ip & net->mask) == net->prefix)
return 1;
}
return 0;
}
static __always_inline int get_port_priority(__u16 port) {
struct port_config *cfg = bpf_map_lookup_elem(&port_config_map, &port);
if (cfg)
return cfg->priority;
return 0;
}
static __always_inline int is_filtered_port(__u16 port) {
struct port_config *cfg = bpf_map_lookup_elem(&port_config_map, &port);
if (cfg)
return cfg->is_filtered;
return (port <= 1024);
}
// Função para atualizar estatísticas de tráfego
static __always_inline void update_stats(__u32 action, __u8 flags) {
__u32 key = 0;
struct traffic_stats *stats = bpf_map_lookup_elem(&stats_map, &key);
if (stats) {
stats->total_packets++;
if (action == XDP_DROP) {
stats->dropped_packets++;
if (flags & FLAG_SYN_FLOOD)
stats->syn_flood_count++;
if (flags & FLAG_ICMP_FLOOD)
stats->icmp_flood_count++;
} else if (action == XDP_PASS) {
stats->passed_packets++;
}
if (flags & FLAG_MARKED_SUSPICIOUS)
stats->blacklisted_count++;
}
}
// Macro para conversão de porta e IP
#define ntohs(x) __builtin_bswap16(x)
#define ntohl(x) __builtin_bswap32(x)
// Versão otimizada do programa principal
SEC("xdp")
int xdp_ddos_filter(struct xdp_md *ctx) {
void *data_end = (void *)(long)ctx->data_end;
void *data = (void *)(long)ctx->data;
__u8 flags = 0;
// Verificação rápida de tamanho mínimo do pacote
if (data + sizeof(struct ethhdr) + sizeof(struct iphdr) > data_end)
return XDP_PASS;
struct ethhdr *eth = data;
if (eth->h_proto != __constant_htons(ETH_P_IP))
return XDP_PASS;
struct iphdr *ip = (void *)(eth + 1);
if ((void *)(ip + 1) > data_end || ip->ihl != 5 || ip->version != 4)
return XDP_PASS;
__u32 src_ip = ip->saddr;
__u32 dst_ip = ip->daddr;
// Fast path: redes internas, whitelist e trusted hosts
if (is_internal_network(src_ip) || is_whitelisted(src_ip)) return XDP_PASS;
__u8 *trusted = bpf_map_lookup_elem(&trusted_hosts_map, &src_ip);
if (trusted && *trusted == 1) return XDP_PASS;
// Fast path: blacklist
if (is_blacklisted(src_ip)) {
update_stats(XDP_DROP, FLAG_MARKED_SUSPICIOUS);
return XDP_DROP;
}
// Fast path: WireGuard UDP/32100
if (ip->protocol == IPPROTO_UDP) {
struct udphdr *udp = (void *)(ip + 1);
if ((void *)(udp + 1) <= data_end) {
__u16 dest_port = ntohs(udp->dest);
// Permitir UDP 32100, 32400, 32101, 32110, 5060, 5160, 18000-19000
if (dest_port == 32100 || dest_port == 32400 || dest_port == 32101 || dest_port == 32110 ||
dest_port == 5060 || dest_port == 5160 ||
(dest_port >= 18000 && dest_port <= 19000)) {
update_stats(XDP_PASS, 0);
return XDP_PASS;
}
}
}
// Variáveis locais para portas e flags
__u16 dest_port = 0;
__u16 tcp_window = 0;
int is_syn = 0, is_icmp = 0;
// Processamento por protocolo
if (ip->protocol == IPPROTO_TCP) {
struct tcphdr *tcp = (void *)(ip + 1);
if ((void *)(tcp + 1) > data_end) return XDP_PASS;
dest_port = ntohs(tcp->dest);
tcp_window = ntohs(tcp->window);
is_syn = tcp->syn && !tcp->ack;
// Detecção de port scan
if ((tcp->syn && tcp->rst) || (tcp->fin && tcp->rst) || (tcp->fin && tcp->syn))
flags |= FLAG_POTENTIAL_SCANNER;
// Detecção de padrões de SYN flood conhecidos
if (is_syn) {
// TTL alto (> 240) é suspeito de spoofing/ataque
if (ip->ttl >= SUSPICIOUS_TTL_THRESHOLD)
flags |= FLAG_SUSPICIOUS_TTL;
// Window size específico de ataques conhecidos
if (tcp_window == SUSPICIOUS_WINDOW_SIZE)
flags |= FLAG_SUSPICIOUS_WINDOW;
// Padrões de SYN flood na porta SSH (22)
if (dest_port == 22) {
// TTL suspeito: muito alto (>240) ou específico de bots (56, 245)
if (ip->ttl >= SUSPICIOUS_TTL_THRESHOLD || ip->ttl == 56 || ip->ttl == 245)
flags |= FLAG_SUSPICIOUS_TTL;
// Window sizes pequenos típicos de ataques (512, 1024, 2048)
if (tcp_window == 512 || tcp_window == 1024 || tcp_window == 2048 ||
tcp_window == SUSPICIOUS_WINDOW_SIZE)
flags |= FLAG_SUSPICIOUS_WINDOW;
// Bloquear SSH com qualquer padrão suspeito
if (flags & (FLAG_SUSPICIOUS_TTL | FLAG_SUSPICIOUS_WINDOW))
flags |= FLAG_SSH_ATTACKER;
}
// Padrões de SYN flood nas portas HTTP/HTTPS (80, 443, 8117)
if (dest_port == 80 || dest_port == 443 || dest_port == 8117) {
// TTL suspeito: muito alto (>240) ou específico de bots (56, 245)
if (ip->ttl >= SUSPICIOUS_TTL_THRESHOLD || ip->ttl == 56 || ip->ttl == 245)
flags |= FLAG_SUSPICIOUS_TTL;
// Window sizes pequenos típicos de ataques
if (tcp_window == 512 || tcp_window == 1024 || tcp_window == 2048 ||
tcp_window == SUSPICIOUS_WINDOW_SIZE)
flags |= FLAG_SUSPICIOUS_WINDOW;
// Bloquear HTTP/HTTPS com padrão suspeito
if (flags & (FLAG_SUSPICIOUS_TTL | FLAG_SUSPICIOUS_WINDOW))
flags |= FLAG_HTTP_ATTACKER;
}
}
} else if (ip->protocol == IPPROTO_UDP) {
struct udphdr *udp = (void *)(ip + 1);
if ((void *)(udp + 1) > data_end) return XDP_PASS;
dest_port = ntohs(udp->dest);
} else if (ip->protocol == IPPROTO_ICMP) {
is_icmp = 1;
struct icmphdr *icmp = (void *)(ip + 1);
if ((void *)(icmp + 1) > data_end) return XDP_PASS;
// Permitir apenas echo-reply (0) e limitar echo-request (8)
if (icmp->type != 0 && icmp->type != 8) {
update_stats(XDP_DROP, 0);
return XDP_DROP;
}
} else {
return XDP_PASS;
}
// Se não for porta filtrada e não for ICMP, libera rápido
if (!is_filtered_port(dest_port) && !is_icmp) {
// Fast path para TCP 5061, 5161
if (ip->protocol == IPPROTO_TCP && (dest_port == 5061 || dest_port == 5161)) {
struct ip_stats *entry = bpf_map_lookup_elem(&ddos_map, &src_ip);
if (entry && entry->pkt_count > 5 && entry->flags == 0) {
__u8 mark_trusted = 1;
bpf_map_update_elem(&trusted_hosts_map, &src_ip, &mark_trusted, BPF_ANY);
}
return XDP_PASS;
}
struct ip_stats *entry = bpf_map_lookup_elem(&ddos_map, &src_ip);
if (entry && entry->pkt_count > 5 && entry->flags == 0) {
__u8 mark_trusted = 1;
bpf_map_update_elem(&trusted_hosts_map, &src_ip, &mark_trusted, BPF_ANY);
}
return XDP_PASS;
}
// Rate limiting e contadores
int priority = get_port_priority(dest_port);
struct ip_stats *entry = bpf_map_lookup_elem(&ddos_map, &src_ip);
__u32 now = get_time_sec();
// Verificar taxa global de SYN para portas críticas (proteção contra distributed SYN flood)
if (is_syn && (dest_port == 22 || dest_port == 80 || dest_port == 443 || dest_port == 8117)) {
struct syn_rate_stats *syn_rate = bpf_map_lookup_elem(&syn_rate_map, &dest_port);
__u32 max_syn_per_sec = 50; // Padrão
// Ajustar limite por porta
if (dest_port == 80 || dest_port == 443 || dest_port == 8117)
max_syn_per_sec = 200; // HTTP/HTTPS pode ter tráfego legítimo maior
if (syn_rate) {
if (now == syn_rate->last_sec) {
syn_rate->count++;
// Se exceder limite de SYN/segundo para esta porta, bloqueia este IP
if (syn_rate->count > max_syn_per_sec) {
__u32 block_time = now;
bpf_map_update_elem(&blacklist_map, &src_ip, &block_time, BPF_ANY);
update_stats(XDP_DROP, FLAG_SYN_FLOOD);
return XDP_DROP;
}
} else {
syn_rate->last_sec = now;
syn_rate->count = 1;
}
} else {
struct syn_rate_stats new_rate = {.last_sec = now, .count = 1};
bpf_map_update_elem(&syn_rate_map, &dest_port, &new_rate, BPF_ANY);
}
}
// Bloquear imediatamente IPs com padrões de ataque conhecidos
if ((flags & FLAG_SSH_ATTACKER) || (flags & FLAG_HTTP_ATTACKER)) {
__u32 block_time = now;
bpf_map_update_elem(&blacklist_map, &src_ip, &block_time, BPF_ANY);
update_stats(XDP_DROP, FLAG_SYN_FLOOD | flags);
return XDP_DROP;
}
// Use variáveis locais para tokens e contadores
__u32 pkt_count = 1, icmp_count = is_icmp ? 1 : 0, syn_count = is_syn ? 1 : 0;
__u32 high_tokens = MAX_TOKENS - PACKET_COST, low_tokens = MAX_TOKENS - PACKET_COST;
__u32 syn_count_per_sec = is_syn ? 1 : 0;
__u32 syn_last_sec = now;
__u16 entry_flags = flags;
if (entry) {
__u32 elapsed = now > entry->last_seen ? now - entry->last_seen : 0;
pkt_count = entry->pkt_count + 1;
icmp_count = is_icmp ? entry->icmp_count + 1 : entry->icmp_count;
syn_count = is_syn ? entry->syn_count + 1 : entry->syn_count;
high_tokens = entry->high_prio_tokens;
low_tokens = entry->low_prio_tokens;
entry_flags = entry->flags | flags;
// Contagem de SYN por segundo
if (is_syn) {
if (now == entry->syn_last_sec) {
syn_count_per_sec = entry->syn_count_per_sec + 1;
} else {
syn_count_per_sec = 1;
}
syn_last_sec = now;
} else {
syn_count_per_sec = entry->syn_count_per_sec;
syn_last_sec = entry->syn_last_sec;
}
if (elapsed > 0) {
__u32 add_high = HIGH_PRIO_TOKEN_RATE * elapsed;
__u32 add_low = LOW_PRIO_TOKEN_RATE * elapsed;
high_tokens = (high_tokens + add_high > MAX_TOKENS) ? MAX_TOKENS : high_tokens + add_high;
low_tokens = (low_tokens + add_low > MAX_TOKENS) ? MAX_TOKENS : low_tokens + add_low;
if (elapsed >= TIMEOUT_SEC) {
icmp_count = is_icmp ? 1 : 0;
syn_count = is_syn ? 1 : 0;
entry_flags &= ~(FLAG_SYN_FLOOD | FLAG_ICMP_FLOOD);
}
}
// Flood ICMP
if (is_icmp && icmp_count > MAX_ICMP_PACKETS_PER_IP) {
entry_flags |= FLAG_ICMP_FLOOD;
__u32 one = 1;
bpf_map_update_elem(&blacklist_map, &src_ip, &one, BPF_ANY);
update_stats(XDP_DROP, FLAG_ICMP_FLOOD);
goto update_entry_and_drop;
}
// Flood SYN - verificação de taxa por segundo E total
if (is_syn) {
// Bloquear se exceder SYN por segundo
if (syn_count_per_sec > MAX_SYN_PACKETS_PER_SECOND) {
entry_flags |= FLAG_SYN_FLOOD;
__u32 block_time = now;
bpf_map_update_elem(&blacklist_map, &src_ip, &block_time, BPF_ANY);
update_stats(XDP_DROP, FLAG_SYN_FLOOD);
goto update_entry_and_drop;
}
// Bloquear se exceder total de SYN
if (syn_count > MAX_SYN_PACKETS_PER_IP) {
entry_flags |= FLAG_SYN_FLOOD;
__u32 block_time = now;
bpf_map_update_elem(&blacklist_map, &src_ip, &block_time, BPF_ANY);
update_stats(XDP_DROP, FLAG_SYN_FLOOD);
goto update_entry_and_drop;
}
// Bloquear IPs com padrões suspeitos (TTL alto ou window suspeito)
if ((flags & FLAG_SUSPICIOUS_TTL) || (flags & FLAG_SUSPICIOUS_WINDOW)) {
if (syn_count > 5) { // Tolerância muito baixa para padrões suspeitos
entry_flags |= FLAG_SYN_FLOOD;
__u32 block_time = now;
bpf_map_update_elem(&blacklist_map, &src_ip, &block_time, BPF_ANY);
update_stats(XDP_DROP, FLAG_SYN_FLOOD);
goto update_entry_and_drop;
}
}
}
// Flood total
if (pkt_count > MAX_PACKETS_PER_IP) {
entry_flags |= FLAG_MARKED_SUSPICIOUS;
__u32 one = 1;
bpf_map_update_elem(&blacklist_map, &src_ip, &one, BPF_ANY);
update_stats(XDP_DROP, FLAG_MARKED_SUSPICIOUS);
goto update_entry_and_drop;
}
// Token bucket
if (priority == 2) {
if (high_tokens >= PACKET_COST) {
high_tokens -= PACKET_COST;
goto update_entry_and_pass;
}
} else if (priority == 1) {
if (high_tokens >= PACKET_COST/2 && low_tokens >= PACKET_COST/2) {
high_tokens -= PACKET_COST/2;
low_tokens -= PACKET_COST/2;
goto update_entry_and_pass;
}
} else {
if (low_tokens >= PACKET_COST) {
low_tokens -= PACKET_COST;
goto update_entry_and_pass;
}
}
update_stats(XDP_DROP, 0);
goto update_entry_and_drop;
update_entry_and_pass:
{
struct ip_stats new_entry = {
.pkt_count = pkt_count,
.last_seen = now,
.icmp_count = icmp_count,
.syn_count = syn_count,
.high_prio_tokens = high_tokens,
.low_prio_tokens = low_tokens,
.syn_last_sec = syn_last_sec,
.syn_count_per_sec = syn_count_per_sec,
.flags = entry_flags
};
bpf_map_update_elem(&ddos_map, &src_ip, &new_entry, BPF_ANY);
update_stats(XDP_PASS, 0);
return XDP_PASS;
}
update_entry_and_drop:
{
struct ip_stats new_entry = {
.pkt_count = pkt_count,
.last_seen = now,
.icmp_count = icmp_count,
.syn_count = syn_count,
.high_prio_tokens = high_tokens,
.low_prio_tokens = low_tokens,
.syn_last_sec = syn_last_sec,
.syn_count_per_sec = syn_count_per_sec,
.flags = entry_flags
};
bpf_map_update_elem(&ddos_map, &src_ip, &new_entry, BPF_ANY);
return XDP_DROP;
}
} else {
// Primeira vez que vemos este IP
struct ip_stats new_entry = {
.pkt_count = pkt_count,
.last_seen = now,
.icmp_count = icmp_count,
.syn_count = syn_count,
.high_prio_tokens = high_tokens,
.low_prio_tokens = low_tokens,
.syn_last_sec = syn_last_sec,
.syn_count_per_sec = syn_count_per_sec,
.flags = entry_flags
};
bpf_map_update_elem(&ddos_map, &src_ip, &new_entry, BPF_ANY);
update_stats(XDP_PASS, 0);
return XDP_PASS;
}
// Redirecionamento AF_XDP para portas 80, 443 (TCP) e 32100 (UDP)
int xsk_map_key = ctx->rx_queue_index;
// TCP: 80 ou 443
if (ip->protocol == IPPROTO_TCP) {
struct tcphdr *tcp = (void *)(ip + 1);
if ((void *)(tcp + 1) > data_end) return XDP_PASS;
__u16 dest_port = ntohs(tcp->dest);
// Redirecionar também 5061, 5161
if (dest_port == 80 || dest_port == 443 || dest_port == 5061 || dest_port == 5161) {
if (bpf_map_lookup_elem(&xsks_map, &xsk_map_key))
return XDP_REDIRECT;
}
}
// UDP: 32100 (WireGuard)
if (ip->protocol == IPPROTO_UDP) {
struct udphdr *udp = (void *)(ip + 1);
if ((void *)(udp + 1) > data_end) return XDP_PASS;
__u16 dest_port = ntohs(udp->dest);
// Redirecionar também 5060, 5160, 18000-19000
if (dest_port == 32100 || dest_port == 32110 || dest_port == 32101 || dest_port == 32400 ||
dest_port == 5060 || dest_port == 5160 ||
(dest_port >= 18000 && dest_port <= 19000)) {
if (bpf_map_lookup_elem(&xsks_map, &xsk_map_key))
return XDP_REDIRECT;
}
}
return XDP_PASS;
}
char __license[] SEC("license") = "GPL";
xdp/xdp_ddos_filter.o
BIN
View File
Binary file not shown.
xdp/xdp_wg_mtu_optimizer.c
+158
View File
@@ -0,0 +1,158 @@
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/icmp.h>
#include <linux/in.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
#include <stdint.h>
// Configurações de MTU para WireGuard
#define WG_OVERHEAD 60 // Overhead do WireGuard (cabeçalhos + criptografia)
#define MAX_WG_MTU 1420 // MTU máximo recomendado para WireGuard (1480 - overhead)
#define ETH_DEFAULT_MTU 1500 // MTU padrão da ethernet
#define MSS_CLAMPING_VALUE (MAX_WG_MTU - 40) // MSS = MTU - IP(20) - TCP(20)
#define MIN_MSS_VALUE 536 // Valor mínimo de MSS conforme RFC
#define ICMP_NEEDED_HEADROOM 8 // Espaço extra para cabeçalho ICMP
#define IPV4_HEADER_DF_OFFSET 6 // Offset do campo Flags no cabeçalho IP
// Estatísticas de pacotes processados
struct mtu_stats {
__u64 total_packets;
__u64 oversized_packets;
__u64 mss_adjusted;
__u64 fragmented;
__u64 pmtu_triggered;
};
// Mapa para armazenar estatísticas
struct {
__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
__uint(max_entries, 1);
__type(key, __u32);
__type(value, struct mtu_stats);
} mtu_stats_map SEC(".maps");
// Mapa para MTUs conhecidos por destino
struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__uint(max_entries, 1024);
__type(key, __u32); // IP de destino
__type(value, __u16); // MTU conhecido
} path_mtu_map SEC(".maps");
// Função para ajustar TCP MSS - totalmente reescrita e simplificada para maior compatibilidade
static __always_inline int adjust_tcp_mss(struct tcphdr *tcp, void *data_end, __u16 max_mss) {
// Verificação básica do cabeçalho TCP
if ((void *)(tcp + 1) > data_end)
return 0;
// Ajustamos MSS apenas em pacotes SYN
if (!tcp->syn || tcp->ack)
return 0;
// Obter comprimento do cabeçalho e verificar se há opções
__u8 tcp_hdr_len = tcp->doff * 4;
if (tcp_hdr_len <= sizeof(struct tcphdr))
return 0; // Sem opções TCP
// Simplificado: remover a complexidade de analisar as opções
// Em vez disso, vamos assumir um MSS conservador para todos os pacotes SYN
__u32 key = 0;
struct mtu_stats *stats = bpf_map_lookup_elem(&mtu_stats_map, &key);
if (stats)
stats->mss_adjusted++;
return 1; // Reportamos ajuste sem tentar modificar o pacote
}
// Programa XDP principal - simplificado
SEC("xdp")
int xdp_wg_optimizer(struct xdp_md *ctx) {
void *data_end = (void *)(long)ctx->data_end;
void *data = (void *)(long)ctx->data;
__u32 key = 0;
// Incrementar estatística de pacotes totais
struct mtu_stats *stats = bpf_map_lookup_elem(&mtu_stats_map, &key);
if (stats)
stats->total_packets++;
// Verificação básica de limites
if (data + sizeof(struct ethhdr) > data_end)
return XDP_PASS;
struct ethhdr *eth = data;
// Filtrar apenas pacotes IPv4
if (eth->h_proto != bpf_htons(ETH_P_IP))
return XDP_PASS;
// Verificar se o pacote contém um cabeçalho IP completo
if ((void *)(eth + 1) + sizeof(struct iphdr) > data_end)
return XDP_PASS;
struct iphdr *iph = (void *)(eth + 1);
// Verificar cabeçalho IP
if ((void *)(iph + 1) > data_end || iph->version != 4)
return XDP_PASS;
// Verificação de MTU
__u16 tot_len = bpf_ntohs(iph->tot_len);
if (tot_len > MAX_WG_MTU) {
// Atualizar estatísticas
if (stats)
stats->oversized_packets++;
// Verificar flag DF
__u16 frag_off = bpf_ntohs(iph->frag_off);
if (frag_off & 0x4000) {
// Don't Fragment está ativo, registrar o MTU para este destino
__u32 dest_ip = iph->daddr;
__u16 mtu = MAX_WG_MTU;
bpf_map_update_elem(&path_mtu_map, &dest_ip, &mtu, BPF_ANY);
// Atualizar estatísticas
if (stats)
stats->pmtu_triggered++;
return XDP_ABORTED; // Sinalizar para enviar ICMP Fragmentation Needed
} else {
// Pacote pode ser fragmentado
if (stats)
stats->fragmented++;
}
}
// Ajustar MSS para pacotes TCP
if (iph->protocol == IPPROTO_TCP) {
__u8 ihl = iph->ihl * 4; // IP header length
void *tcp_ptr = (void *)iph + ihl;
// Verificar se temos espaço para o cabeçalho TCP
if (tcp_ptr + sizeof(struct tcphdr) <= data_end) {
struct tcphdr *tcp = tcp_ptr;
adjust_tcp_mss(tcp, data_end, MSS_CLAMPING_VALUE);
}
}
// Verificar MTUs conhecidos
__u16 *known_mtu = bpf_map_lookup_elem(&path_mtu_map, &iph->daddr);
if (known_mtu && tot_len > *known_mtu) {
__u16 frag_off = bpf_ntohs(iph->frag_off);
if (frag_off & 0x4000) {
// Don't Fragment está ativo, não pode passar pelo tunnel
if (stats)
stats->pmtu_triggered++;
return XDP_ABORTED;
}
}
// Permitir o pacote
return XDP_PASS;
}
char __license[] SEC("license") = "GPL";
xdp/xdp_wg_mtu_optimizer.o
BIN
View File
Binary file not shown.