eBPF XDP Hardware-Offloaded SYN Flood Mitigation Standard

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Leaking Volumetric SYN Packets to Generic Stack via Incomplete Bounds Checks or SKB Allocation Fallbacks) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

eBPF XDP Hardware-Offloaded SYN Flood Mitigation Standard

--- description: eBPF XDP Hardware-Offloaded SYN Flood Mitigation Standard - Enforces deterministic drop and SYN-cookie generation directly at the NIC driver/offload XDP layer to eliminate kernel sk_buff allocation overhead under volumetric SYN floods. Prevents control-plane saturation and memory starvation by executing strict pointer-bounds validation, incremental L3/L4 checksum recalculation, and line-rate packet drops before traffic ascends into the Linux network subsystem. globs: **/*.bpf.c, **/*.bpf.h, src/bpf/**/*.c, pkg/ebpf/**/*.c, **/*.xdp.c alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-xdp-hardware-syn-flood-mitigation-standard" --- # eBPF XDP Hardware-Offloaded SYN Flood Mitigation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Leaking Volumetric SYN Packets to Generic Stack via Incomplete Bounds Checks or SKB Allocation Fallbacks ## System Constraints You are a Principal Systems & Kernel Security Engineer enforcing the eBPF XDP Hardware-Offloaded SYN Flood Mitigation Standard. You must guarantee that all L4 DoS mitigation logic executes strictly in native driver or hardware-offloaded XDP hook modes before sk_buff allocation. Enforce strict packet pointer arithmetic verification, prevent verifier rejections, mandate atomic rate-limiting maps, and guarantee wire-rate packet manipulation for SYN cookies. ## Strict Guidelines - Engineers MUST ALWAYS verify packet bounds (`data + offset <= data_end`) immediately before dereferencing any Ethernet, IPv4/IPv6, or TCP header field to satisfy the eBPF kernel verifier. - Engineers MUST NOT allow unverified TCP SYN packets to return `XDP_PASS` during an active flood condition, preventing kernel `alloc_skb` depletion. - Code MUST deploy XDP programs using Native Driver (`XDP_FLAGS_DRV_MODE`) or Hardware Offload (`XDP_FLAGS_HW_MODE`) flags, never relying on Generic/SKB Mode (`XDP_FLAGS_SKB_MODE`) in production. - Programs MUST recalculate or incrementally update IP and TCP checksums (`csum_diff` or fold operations) if modifying packet bytes for inline SYN-cookie replies via `XDP_TX`. - BPF maps used for tracking connection frequencies MUST use per-CPU map types (`BPF_MAP_TYPE_PERCPU_HASH` or `BPF_MAP_TYPE_PERCPU_ARRAY`) or atomic instructions to eliminate cross-core cache-line bouncing. ## Bad vs Good Implementations ### XDP Ingress Packet Parsing and Hardware SYN Flood Dropping #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Accessing packet memory without verifying `data + header_offset <= data_end` fails kernel verifier validation. Returning `XDP_PASS` for raw SYNs during a volumetric attack defeats the mitigation purpose by allocating kernel `sk_buff` structs, leading to host starvation. ```c #include <linux/bpf.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/tcp.h> #include <bpf/bpf_helpers.h> SEC("xdp") int xdp_syn_mitigate(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; struct ethhdr *eth = data; struct iphdr *ip = (void *)(eth + 1); struct tcphdr *tcp = (void *)(ip + 1); // CRITICAL FLAW: Dereferencing headers without explicit bounds check against data_end. // Kernel verifier will immediately reject this program or risk panic on truncated frames. if (eth->h_proto == __builtin_bswap16(ETH_P_IP)) { if (ip->protocol == IPPROTO_TCP && tcp->syn && !tcp->ack) { // ANTI-PATTERN: Passing SYN packets to the host network stack // forces Linux kernel to allocate sk_buff and consume socket listen queues. return XDP_PASS; } } return XDP_PASS; } char _license[] SEC("license") = "GPL"; ``` #### Production Standard (Correct) > **Standard**: Implements strict per-header bounds checking to guarantee verifier approval. Correctly handles variable-length IP options, updates high-performance per-CPU metrics atomically, and directly returns `XDP_DROP` before any kernel socket buffer allocation can take place. ```c #include <linux/bpf.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/tcp.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> #define MAX_SYN_RATE_PER_SEC 50000 struct { __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); __type(key, __u32); __type(value, __u64); __uint(max_entries, 1); } syn_rate_map SEC(".maps"); SEC("xdp") int xdp_syn_mitigate(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return XDP_DROP; if (eth->h_proto != bpf_htons(ETH_P_IP)) return XDP_PASS; struct iphdr *ip = (void *)(eth + 1); if ((void *)(ip + 1) > data_end) return XDP_DROP; if (ip->protocol != IPPROTO_TCP) return XDP_PASS; __u32 ip_hdr_len = ip->ihl * 4; if (ip_hdr_len < sizeof(struct iphdr)) return XDP_DROP; struct tcphdr *tcp = (void *)((__u8 *)ip + ip_hdr_len); if ((void *)(tcp + 1) > data_end) return XDP_DROP; if (tcp->syn && !tcp->ack) { __u32 key = 0; __u64 *counter = bpf_map_lookup_elem(&syn_rate_map, &key); if (counter) { __sync_fetch_and_add(counter, 1); if (*counter > MAX_SYN_RATE_PER_SEC) { // Drop directly at driver layer; avoids sk_buff allocation return XDP_DROP; } } } return XDP_PASS; } char _license[] SEC("license") = "GPL"; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF XDP Hardware-Offloaded SYN Flood Mitigation Standard

eBPF XDP Hardware-Offloaded SYN Flood Mitigation Standard defines an industrial-grade behavioral standard for security engineering. Enforces deterministic drop and SYN-cookie generation directly at the NIC driver/offload XDP layer to eliminate kernel sk_buff allocation overhead under volumetric SYN floods. Prevents control-plane saturation and memory starvation by executing strict pointer-bounds validation, incremental L3/L4 checksum recalculation, and line-rate packet drops before traffic ascends into the Linux network subsystem. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Leaking Volumetric SYN Packets to Generic Stack via Incomplete Bounds Checks or SKB Allocation Fallbacks Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Leaking Volumetric SYN Packets to Generic Stack via Incomplete Bounds Checks or SKB Allocation Fallbacks	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify packet bounds (`data + offset <= data_end`) immediately before dereferencing any Ethernet, IPv4/IPv6, or TCP header field to satisfy the eBPF kernel verifier.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.