XDP-Layer Stateful L4 Tracking and Netfilter Conntrack Bypass Guardrail

--- description: XDP-Layer Stateful L4 Tracking and Netfilter Conntrack Bypass Guardrail - Enforces in-driver eBPF XDP stateful L4 flow inspection and hardware-assisted SYN-cookie validation prior to kernel sk_buff allocation. Decouples state tracking from Linux Netfilter conntrack tables using BPF LRU maps to process line-rate traffic and prevent table exhaustion attacks. globs: **/*.bpf.c, **/*.bpf.h, src/bpf/**/*.c, kernel/**/*.c alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-xdp-l4-tracker-conntrack-bypass-standard" --- # XDP-Layer Stateful L4 Tracking and Netfilter Conntrack Bypass Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Delegating TCP SYN Validation to Kernel Netfilter and Exhausting nf_conntrack Under Line-Rate Floods ## System Constraints You are a Principal Linux Kernel and eBPF Systems Architect enforcing zero-allocation, wire-speed packet processing in the XDP driver layer. You mandate that stateful L4 tracking must never allow unauthenticated TCP SYN flows to traverse into the Linux Netfilter stack where they can exhaust the host nf_conntrack table. All eBPF programs must enforce strict packet pointer safety bounds, utilize bounded LRU maps (BPF_MAP_TYPE_LRU_HASH) or BPF SYN cookies helpers (bpf_tcp_raw_gen_syncookie_ipv4 / bpf_tcp_check_syncookie_ipv4), and return deterministic XDP action codes without leaking memory or unverified state. ## Strict Guidelines - Engineers MUST ALWAYS enforce pointer bounds verification (data + offset > data_end) before dereferencing any Ethernet, IP, or TCP header fields. - Engineers MUST NOT pass unverified TCP SYN packets to the host stack (XDP_PASS) when operating under high connection rates; state verification must occur directly at XDP via SYN cookies or bounded LRU session tracking. - Code SHOULD utilize BPF_MAP_TYPE_LRU_HASH instead of standard BPF_MAP_TYPE_HASH for flow state tracking to provide deterministic kernel eviction semantics under extreme volumetric loads. - Services MUST employ bpf_tcp_raw_gen_syncookie_ipv4 and bpf_tcp_check_syncookie_ipv4 or stateless client puzzles directly in XDP to validate handshakes before creating upstream state. - Components NEVER allocate memory in user-space or kernel-space per connection attempt before L4 validation has successfully transitioned the TCP handshake to an ESTABLISHED state. ## Bad vs Good Implementations ### Stateful L4 Ingress Handler: Conntrack Depletion vs XDP BPF SYN Cookie Validation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Passing unsolicited TCP SYN packets directly to the kernel network stack causes Linux Netfilter (nf_conntrack) to allocate tracking structures per packet, rapidly saturating nf_conntrack_max and dropping legitimate traffic at wire speeds. ```c #include <linux/bpf.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/tcp.h> #include <bpf/bpf_helpers.h> SEC("xdp") int xdp_filter_ingress(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; // ANTI-PATTERN: Incomplete pointer verification struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return XDP_PASS; struct iphdr *iph = (void *)(eth + 1); if ((void *)(iph + 1) > data_end) return XDP_PASS; if (iph->protocol != IPPROTO_TCP) return XDP_PASS; struct tcphdr *tcph = (void *)iph + (iph->ihl * 4); if ((void *)(tcph + 1) > data_end) return XDP_PASS; // ANTI-PATTERN: Passing all SYN packets to the host kernel stack // Directly induces nf_conntrack table exhaustion under SYN floods if (tcph->syn && !tcph->ack) { return XDP_PASS; } return XDP_PASS; } char _license[] SEC("license") = "GPL"; ``` #### Production Standard (Correct) > **Standard**: Validates TCP handshakes inside the XDP layer via bpf_tcp_raw_gen_syncookie_ipv4 and bpf_tcp_check_syncookie_ipv4. Malicious or unsolicited SYN frames are intercepted and resolved without allocating Netfilter conntrack entries or allocating sk_buff buffers. ```c #include <linux/bpf.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/tcp.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> struct { __uint(type, BPF_MAP_TYPE_LRU_HASH); __uint(max_entries, 65536); __type(key, __u64); // 5-tuple packed key __type(value, __u32); // connection state } flow_table SEC(".maps"); SEC("xdp") int xdp_filter_ingress(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return XDP_DROP; if (eth->h_proto != bpf_htons(ETH_P_IP)) return XDP_PASS; struct iphdr *iph = (void *)(eth + 1); if ((void *)(iph + 1) > data_end) return XDP_DROP; if (iph->protocol != IPPROTO_TCP) return XDP_PASS; __u32 ip_hdr_len = iph->ihl * 4; if (ip_hdr_len < sizeof(struct iphdr)) return XDP_DROP; struct tcphdr *tcph = (void *)iph + ip_hdr_len; if ((void *)(tcph + 1) > data_end) return XDP_DROP; // Intercept TCP SYN: Generate SYN-cookie or drop invalid attempts // Prevents unverified allocations in the host kernel's nf_conntrack if (tcph->syn && !tcph->ack) { __s64 cookie = bpf_tcp_raw_gen_syncookie_ipv4(iph, tcph, sizeof(*tcph)); if (cookie < 0) { return XDP_DROP; // Drop packet if cookie calculation fails } // In production: Reflect SYN-ACK with cookie via XDP_TX or bypass conntrack return XDP_DROP; } if (tcph->ack && !tcph->syn) { int res = bpf_tcp_check_syncookie_ipv4(iph, tcph); if (res == 0) { // Valid cookie verified directly in XDP: Allow connection into OS stack return XDP_PASS; } } return XDP_DROP; } char _license[] SEC("license") = "GPL"; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: XDP-Layer Stateful L4 Tracking and Netfilter Conntrack Bypass Guardrail

XDP-Layer Stateful L4 Tracking and Netfilter Conntrack Bypass Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces in-driver eBPF XDP stateful L4 flow inspection and hardware-assisted SYN-cookie validation prior to kernel sk_buff allocation. Decouples state tracking from Linux Netfilter conntrack tables using BPF LRU maps to process line-rate traffic and prevent table exhaustion attacks. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Delegating TCP SYN Validation to Kernel Netfilter and Exhausting nf_conntrack Under Line-Rate Floods Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Delegating TCP SYN Validation to Kernel Netfilter and Exhausting nf_conntrack Under Line-Rate Floods	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce pointer bounds verification (data + offset > data_end) before dereferencing any Ethernet, IP, or TCP header fields.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.