Zero-Allocation Driver-Native XDP Filter Invariants for 100Gbps Line-Rate Mitigation

--- description: Zero-Allocation Driver-Native XDP Filter Invariants for 100Gbps Line-Rate Mitigation - Enforces strict native-driver XDP execution patterns that discard malicious traffic before SKB (socket buffer) allocation. Prevents CPU exhaustion and softIRQ lockups across Kubernetes worker nodes during multi-terabit volumetric attacks by mandating bounded loops, constant-time LPM lookups, and per-CPU map primitives. globs: **/*.bpf.c, **/*.bpf.h, pkg/bpf/**/*.go, cmd/xdp/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-xdp-linerate-ddos-guardrail" --- # Zero-Allocation Driver-Native XDP Filter Invariants for 100Gbps Line-Rate Mitigation > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Generic XDP Skb-Fallback and Unbounded Packet Iteration Causing Host SoftIRQ Starvation ## System Constraints You are a Principal Systems and Kernel Engineer enforcing eBPF XDP Driver-Level Line-Rate DDoS Mitigation invariants. Mandate zero SKB allocations, compile-time bounded variable access, strict direct packet pointer boundary validations, lockless per-CPU memory layouts, and fail-open validation for cluster control plane CIDRs. ## Strict Guidelines - Engineers MUST ALWAYS verify packet pointers against data_end before any dereference to ensure the eBPF kernel verifier proves memory safety without fallback overhead. - Engineers MUST NEVER invoke helper functions that cause context switches or memory allocations (e.g., standard BPF ring buffer writes on every packet) in the XDP fast-path. - Engineers MUST attach programs using XDP_FLAGS_DRV_MODE or offload mode (XDP_FLAGS_HW_MODE) and fail closed if the kernel falls back to generic skb-mode (XDP_FLAGS_SKB_MODE). - Code MUST employ BPF_MAP_TYPE_PERCPU_ARRAY or BPF_MAP_TYPE_LPM_TRIE exclusively for packet counting and rate-limiting to avoid cross-core lock contention. - Services MUST hardcode allow-list rules for Kubernetes node-to-node health checks (Kubelet, Calico/Cilium VXLAN, BGP) using early-exit XDP_PASS before rate-limiting pipelines execute. ## Bad vs Good Implementations ### Direct Packet Bounds Checking and Native LPM Match #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Accessing packet headers without explicit compiler-verified bounds checks against ctx->data_end causes the BPF verifier to reject the program or introduce runtime penalties. It lacks proper protocol validation and does not bypass critical cluster traffic. ```c #include <linux/bpf.h> #include <bpf/bpf_helpers.h> #include <linux/if_ether.h> #include <linux/ip.h> SEC("xdp") int xdp_ddos_filter(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; struct ethhdr *eth = data; // UNSAFE: Dereferencing packet payload without verifying bounds against data_end // Kernel verifier will either reject this or force SKB allocation validation struct iphdr *ip = (struct iphdr *)(eth + 1); if (ip->protocol == 6) { // TCP return XDP_DROP; } return XDP_PASS; } ``` #### Production Standard (Correct) > **Standard**: Provides guaranteed compiler verifier safety by checking bounds before every header dereference, processes packets directly in the network card ring buffer via driver XDP, and performs constant-time Trie lookups with zero SKB allocations. ```c #include <linux/bpf.h> #include <bpf/bpf_helpers.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/in.h> struct { __uint(type, BPF_MAP_TYPE_LPM_TRIE); __uint(max_entries, 65536); __type(key, struct bpf_lpm_trie_key); __type(value, __u32); __uint(map_flags, BPF_F_NO_PREALLOC); } blocklist_lpm SEC(".maps"); SEC("xdp") int xdp_ddos_filter_native(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return XDP_DROP; if (eth->h_proto != __constant_htons(ETH_P_IP)) return XDP_PASS; struct iphdr *iph = (void *)(eth + 1); if ((void *)(iph + 1) > data_end) return XDP_DROP; struct { __u32 prefixlen; __u32 ipv4; } key = { .prefixlen = 32, .ipv4 = iph->saddr }; __u32 *action = bpf_map_lookup_elem(&blocklist_lpm, &key); if (action && *action == 1) return XDP_DROP; return XDP_PASS; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Zero-Allocation Driver-Native XDP Filter Invariants for 100Gbps Line-Rate Mitigation

Zero-Allocation Driver-Native XDP Filter Invariants for 100Gbps Line-Rate Mitigation defines an industrial-grade behavioral standard for devops engineering. Enforces strict native-driver XDP execution patterns that discard malicious traffic before SKB (socket buffer) allocation. Prevents CPU exhaustion and softIRQ lockups across Kubernetes worker nodes during multi-terabit volumetric attacks by mandating bounded loops, constant-time LPM lookups, and per-CPU map primitives. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Generic XDP Skb-Fallback and Unbounded Packet Iteration Causing Host SoftIRQ Starvation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Generic XDP Skb-Fallback and Unbounded Packet Iteration Causing Host SoftIRQ Starvation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify packet pointers against data_end before any dereference to ensure the eBPF kernel verifier proves memory safety without fallback overhead.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.