eBPF TC Ingress Rate-Fencing for L7 Distributed Denial-of-Wallet (DDoW) Prevention

--- description: eBPF TC Ingress Rate-Fencing for L7 Distributed Denial-of-Wallet (DDoW) Prevention - Enforces pre-socket drop semantics at the Linux Traffic Control (TC) clsact qdisc layer using eBPF maps to terminate unauthenticated, replay-heavy, or abusive LLM/serverless API traffic before TCP handshakes and user-space allocations occur. Protects downstream token generation and pay-per-execution cloud billing pipelines from algorithmic economic exhaustion attacks. globs: src/bpf/**/*.{c,h}, src/network/**/*.{ts,go,rs,c}, infra/k8s/**/*.{yaml,json}, src/security/rate_limiter/**/*.{ts,go,rs} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-tc-ddow-rate-fencing-standard" --- # eBPF TC Ingress Rate-Fencing for L7 Distributed Denial-of-Wallet (DDoW) Prevention > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Delegating High-Volume L7 Rate Limiting and Token Validation to User-Space Application Gateways ## System Constraints You are a Principal Systems & Network Security Architect enforcing kernel-level eBPF Traffic Control (TC) ingress rate-fencing. You mandate that high-cost LLM API endpoints and serverless functions protect their network perimeter by dropping invalid signatures, malformed API keys, and burst quotas at the Linux kernel packet scheduler level (TC clsact ingress), preventing socket buffer allocation (sk_buff) propagation to user-space runtimes. ## Strict Guidelines - Engineers MUST ALWAYS enforce rate limits at the eBPF TC (Traffic Control) ingress hook (clsact) before packet transit to the socket layer when cost-per-request exceeds standard I/O baseline. - Engineers MUST NOT rely exclusively on user-space reverse proxies (e.g., Envoy, Nginx, Node.js gateways) for DDoS/DDoW mitigation against pay-per-token LLM endpoints. - Code SHOULD inspect raw sk_buff payload offsets via bpf_skb_load_bytes to validate HMAC signatures or prefixed API bearer tokens without full TLS termination where eBPF kTLS or Layer 4 proxy handoff is available. - Services MUST synchronize user-space token buckets into BPF_MAP_TYPE_LRU_HASH or BPF_MAP_TYPE_PERCPU_ARRAY structures with lockless atomics (__sync_fetch_and_add) to prevent cross-core cache invalidation. - Components NEVER allow unmetered syn-floods or TCP handshakes to reach user-space endpoints when BPF map lookups indicate token exhaustion; they must return TC_ACT_SHOT immediately. ## Bad vs Good Implementations ### Kernel-Level Token Bucket Ingress Filter in eBPF C #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Forwarding every packet to user-space forces the kernel to complete TCP reassembly and socket buffering, allowing an adversary to execute hundreds of thousands of cheap unauthenticated HTTP requests that deplete serverless runtimes and trigger costly inference pipelines. ```c // ANTI-PATTERN: Passing all traffic to user-space gateway, deferring rate check to Node.js / Envoy #include <linux/bpf.h> #include <bpf/bpf_helpers.h> SEC("tc") int handle_ingress(struct __sk_buff *skb) { // Incurring full kernel network stack traversal, sk_buff allocation, // context switching, and user-space memory allocation for every packet. return 0; // TC_ACT_OK -> Forwarding directly to user-space proxy } ``` #### Production Standard (Correct) > **Standard**: The BPF program enforces strict leaky/token bucket limits at the TC ingress layer. Dropped packets (TC_ACT_SHOT) bypass user-space socket processing entirely, terminating DDoW amplification and preserving computational billing quotas. ```c // PRODUCTION STANDARD: Pre-socket rate-drop using eBPF TC and Per-CPU LRU Hash Maps #include <linux/bpf.h> #include <linux/pkt_cls.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> struct client_metric { __u64 last_timestamp_ns; __u32 tokens_remaining; }; struct { __uint(type, BPF_MAP_TYPE_LRU_HASH); __uint(max_entries, 1000000); __type(key, __u32); // IPv4 src address __type(value, struct client_metric); } rate_limit_map SEC(".maps"); #define BUCKET_BURST_CAP 100 #define REFILL_INTERVAL_NS 1000000000ULL // 1 second SEC("tc") int handle_ingress(struct __sk_buff *skb) { void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; // Parse IP header struct iphdr *ip = data + sizeof(struct ethhdr); if ((void *)(ip + 1) > data_end) { return TC_ACT_OK; } __u32 src_ip = ip->saddr; __u64 now = bpf_ktime_get_ns(); struct client_metric *metric = bpf_map_lookup_elem(&rate_limit_map, &src_ip); if (!metric) { struct client_metric init_m = { .last_timestamp_ns = now, .tokens_remaining = BUCKET_BURST_CAP - 1 }; bpf_map_update_elem(&rate_limit_map, &src_ip, &init_m, BPF_ANY); return TC_ACT_OK; } // Token refill calculation if (now - metric->last_timestamp_ns > REFILL_INTERVAL_NS) { metric->tokens_remaining = BUCKET_BURST_CAP; metric->last_timestamp_ns = now; } if (metric->tokens_remaining == 0) { // HARD DROP: Mitigate DDoW at driver layer return TC_ACT_SHOT; } __sync_fetch_and_sub(&metric->tokens_remaining, 1); return TC_ACT_OK; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF TC Ingress Rate-Fencing for L7 Distributed Denial-of-Wallet (DDoW) Prevention

eBPF TC Ingress Rate-Fencing for L7 Distributed Denial-of-Wallet (DDoW) Prevention defines an industrial-grade behavioral standard for security engineering. Enforces pre-socket drop semantics at the Linux Traffic Control (TC) clsact qdisc layer using eBPF maps to terminate unauthenticated, replay-heavy, or abusive LLM/serverless API traffic before TCP handshakes and user-space allocations occur. Protects downstream token generation and pay-per-execution cloud billing pipelines from algorithmic economic exhaustion attacks. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Delegating High-Volume L7 Rate Limiting and Token Validation to User-Space Application Gateways Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Delegating High-Volume L7 Rate Limiting and Token Validation to User-Space Application Gateways	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce rate limits at the eBPF TC (Traffic Control) ingress hook (clsact) before packet transit to the socket layer when cost-per-request exceeds standard I/O baseline.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.