Hardware-Offloaded eBPF XDP Invariant for L4 Reflection and Amplification Defense

--- description: Hardware-Offloaded eBPF XDP Invariant for L4 Reflection and Amplification Defense - Enforces strict offload-compatible eBPF XDP invariants to intercept and drop UDP-based amplification vectors (e.g., DNS, NTP, Memcached, CLDAP) directly within the NIC RX descriptor ring buffer. Prohibits helper functions, packet mutations, and map architectures that breach hardware offload boundaries or cause fallback to native/generic driver processing. Ensures deterministic wire-rate drop throughput without triggering host network stack overhead or kernel socket allocations. globs: src/bpf/**/*.c, bpf/**/*.c, kernel/xdp/**/*.c, src/network/**/*.c, src/xdp/**/*.h alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-xdp-hardware-offloaded-l4-amplification-mitigation-invariant" --- # Hardware-Offloaded eBPF XDP Invariant for L4 Reflection and Amplification Defense > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Executing Non-Offloadable eBPF Operations or Deferring Volumetric L4 Drop Logic to sk_buff Stack Ingress ## System Constraints You are a Principal Systems Engineer and Kernel Networking Architect enforcing strict eBPF XDP Hardware-Offload Invariants for L4 volumetric mitigation. You must reject any eBPF bytecode targeting XDP offload mode that uses unsupported BPF helpers, dynamic packet resizes, non-offloadable map types (e.g., standard hash maps with dynamic allocation), or unbounded loops that fail the SmartNIC verifier. Every drop decision for spoofed reflection vectors must happen prior to socket allocation and sk_buff construction. ## Strict Guidelines - Engineers MUST ALWAYS verify bounds for every packet header dereference (Ethernet, IPv4/IPv6, UDP) using explicit pointer comparisons against `ctx->data_end` before accessing any payload or header fields. - Engineers MUST NOT utilize BPF helper functions unsupported by SmartNIC hardware offload engines (e.g., `bpf_ktime_get_ns`, dynamic map insertions, `bpf_trace_printk`) inside the critical offload packet path. - Code MUST restrict map access to offload-supported primitive map types such as `BPF_MAP_TYPE_ARRAY` with `BPF_F_NUMA_NODE` and strictly pre-allocated slots or compile-time constant lookup tables. - Services MUST return `XDP_DROP` deterministically for matching reflection signatures (e.g., source port 53/123/11211/389 paired with specific amplification payload thresholds) without modifying packet buffers. - Components NEVER fall back silently to `XDP_PASS` or driver-generic mode (`XDP_FLAGS_SKB_MODE`) when handling volumetric amplification floods under offload degradation. ## Bad vs Good Implementations ### Hardware-Offloaded XDP L4 Amplification Filter #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Uses BPF_MAP_TYPE_HASH and bpf_ktime_get_ns, which are unsupported by hardware offload engines on SmartNICs (e.g., Netronome, Mellanox BlueField). Accesses ip and udp pointers without rigid data_end checks, failing both verifier safety and causing offload compilation failures. ```c #include <linux/bpf.h> #include <bpf/bpf_helpers.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/udp.h> // ANTI-PATTERN: Using Hash Map and Helper Functions that break hardware offload struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 10240); __type(key, __u32); __type(value, __u64); } drop_stats SEC(".maps"); SEC("xdp") int xdp_amplification_filter(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; struct ethhdr *eth = data; // Inadequate bounds check: access before data_end validation if (eth + 1 > (struct ethhdr *)data_end) return XDP_PASS; struct iphdr *ip = data + sizeof(*eth); // Missing bounds verification for IP header if (ip->protocol == IPPROTO_UDP) { struct udphdr *udp = (void *)ip + (ip->ihl * 4); // Potential out-of-bounds dereference if (udp->source == __constant_htons(11211)) { // Disallowed helper in offload path __u64 ts = bpf_ktime_get_ns(); bpf_map_update_elem(&drop_stats, &ip->saddr, &ts, BPF_ANY); return XDP_DROP; } } return XDP_PASS; } ``` #### Production Standard (Correct) > **Standard**: Adheres strictly to hardware offload constraints: leverages bounded single-pass parsing, checks ctx->data_end on every layer, relies strictly on pre-allocated BPF_MAP_TYPE_ARRAY with atomic increments, and eliminates calls to non-offloadable kernel helpers. ```c #include <linux/bpf.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/udp.h> #define MEMCACHED_PORT 11211 #define NTP_PORT 123 #define DNS_PORT 53 #define CLDAP_PORT 389 // Static array map compatible with SmartNIC offload struct { __uint(type, BPF_MAP_TYPE_ARRAY); __uint(max_entries, 4); __type(key, __u32); __type(value, __u64); } offload_drop_counters SEC(".maps"); SEC("xdp_offload") int xdp_amplification_mitigate(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return XDP_PASS; if (eth->h_proto != __bpf_constant_htons(ETH_P_IP)) return XDP_PASS; struct iphdr *ip = (void *)(eth + 1); if ((void *)(ip + 1) > data_end) return XDP_PASS; if (ip->protocol != IPPROTO_UDP) return XDP_PASS; // Variable IP header length bounds check __u32 ip_hlen = ip->ihl * 4; if (ip_hlen < sizeof(struct iphdr)) return XDP_DROP; struct udphdr *udp = (void *)ip + ip_hlen; if ((void *)(udp + 1) > data_end) return XDP_PASS; __u16 src_port = __bpf_ntohs(udp->source); __u32 idx = 0; if (src_port == MEMCACHED_PORT) { idx = 0; } else if (src_port == NTP_PORT) { idx = 1; } else if (src_port == DNS_PORT) { idx = 2; } else if (src_port == CLDAP_PORT) { idx = 3; } else { return XDP_PASS; } __u64 *counter = bpf_map_lookup_elem(&offload_drop_counters, &idx); if (counter) __sync_fetch_and_add(counter, 1); return XDP_DROP; } char _license[] SEC("license") = "Dual BSD/GPL"; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Hardware-Offloaded eBPF XDP Invariant for L4 Reflection and Amplification Defense

Hardware-Offloaded eBPF XDP Invariant for L4 Reflection and Amplification Defense defines an industrial-grade behavioral standard for devops engineering. Enforces strict offload-compatible eBPF XDP invariants to intercept and drop UDP-based amplification vectors (e.g., DNS, NTP, Memcached, CLDAP) directly within the NIC RX descriptor ring buffer. Prohibits helper functions, packet mutations, and map architectures that breach hardware offload boundaries or cause fallback to native/generic driver processing. Ensures deterministic wire-rate drop throughput without triggering host network stack overhead or kernel socket allocations. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing Non-Offloadable eBPF Operations or Deferring Volumetric L4 Drop Logic to sk_buff Stack Ingress Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing Non-Offloadable eBPF Operations or Deferring Volumetric L4 Drop Logic to sk_buff Stack Ingress	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify bounds for every packet header dereference (Ethernet, IPv4/IPv6, UDP) using explicit pointer comparisons against `ctx->data_end` before accessing any payload or header fields.

Engineers MUST ALWAYS verify bounds for every packet header dereference (Ethernet, IPv4/IPv6, UDP) using explicit pointer comparisons against `ctx->data_end` before accessing any payload or header fields.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.