eBPF XDP Dynamic TCP-MSS Clamping Invariant

--- description: eBPF XDP Dynamic TCP-MSS Clamping Invariant - Enforces deterministic, in-kernel TCP Maximum Segment Size (MSS) clamping at the eBPF XDP layer across overlay and WireGuard network interfaces. Guarantees zero PMTU discovery black-holing and eliminates tunnel-induced packet fragmentation by rewriting SYN/SYN-ACK packet options and incrementally updating the TCP checksum before socket allocation. globs: **/*.bpf.c, **/*.bpf.h, src/xdp/**/*.c, pkg/ebpf/**/*.go, infra/k8s/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-xdp-tcp-mss-clamping-production-standard" --- # eBPF XDP Dynamic TCP-MSS Clamping Invariant > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Relying on ICMP Type 3 Code 4 PMTUD or iptables TCPMSS target across high-throughput overlay topologies ## System Constraints You are a Principal Systems and Kernel Engineer enforcing eBPF XDP Dynamic TCP-MSS Clamping Invariants. You must mandate that all network driver-level programs operating on encapsulation, WireGuard, or overlay networks strictly rewrite TCP SYN/SYN-ACK MSS headers using verified eBPF memory bounds and RFC 1624 incremental checksum updates, avoiding any reliance on Path MTU Discovery (PMTUD) or userspace packet filtering. ## Strict Guidelines - Engineers MUST ALWAYS verify packet bounds (`data + offset > data_end`) before dereferencing any byte in IP headers, TCP headers, or TCP options to satisfy the eBPF verifier. - Engineers MUST rewrite MSS values ONLY when the incoming MSS exceeds the target interface MTU minus fixed IP/TCP encapsulation overheads (e.g., MTU 1420 for WireGuard results in a maximum MSS of 1380 for IPv4 or 1360 for IPv6). - Code MUST update the TCP header checksum incrementally using RFC 1624 one's complement arithmetic or `bpf_csum_diff` to maintain wire-speed line rate without traversing the full packet payload. - Programs MUST parse TCP options strictly by honoring Option Kind 2 (MSS) with Length 4, safely advancing option pointers through variable-length options and End of Option List (EOL) / No Operation (NOP) delimiters. - Components NEVER drop non-SYN packets or packets without an MSS option in the clamping filter; all non-matching traffic MUST return `XDP_PASS` immediately. - Services MUST dynamically synchronize overlay MTU constraints to eBPF BPF_MAP_TYPE_ARRAY or BPF_MAP_TYPE_HASH maps without requiring kernel module reloading or program re-attachment. ## Bad vs Good Implementations ### eBPF XDP In-Place TCP MSS Option Clamping with RFC 1624 Checksum Fixup #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Fails eBPF verifier safety guarantees by accessing header fields without verifying against `ctx->data_end`. Assumes TCP options start immediately after fixed TCP header without inspecting Option Kind/Length, and fails to update `tcph->check`, causing TCP drops downstream due to invalid checksums. ```c // Vulnerable: Missing bounds verification, ignores variable IHL, and corrupts TCP checksum SEC("xdp") int xdp_clamp_mss_bad(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; struct iphdr *iph = data + sizeof(struct ethhdr); struct tcphdr *tcph = (void *)iph + (iph->ihl * 4); // Invariant Violation: No boundary checks; crashes verifier or dereferences out-of-bounds if (tcph->syn) { __u16 *mss = (void *)tcph + sizeof(struct tcphdr) + 2; // Invariant Violation: Direct overwrite without RFC 1624 TCP checksum update if (__ntohs(*mss) > 1380) { *mss = __hton16(1380); } } return XDP_PASS; } ``` #### Production Standard (Correct) > **Standard**: Performs comprehensive bounds verification for both IP and TCP variable headers, loops safely through TCP option bytes using unrolled iterations verified by the BPF verifier, dynamically updates the MSS option to 1380 bytes, and updates the TCP checksum via RFC 1624 one's complement math without performance penalty. ```c #include <linux/bpf.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/tcp.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> #define TARGET_MSS_IPV4 1380 static __always_inline void update_csum_16(__sum16 *csum, __be16 old_val, __be16 new_val) { __u32 sum = (~bpf_ntohs(*csum) & 0xffff) + (~bpf_ntohs(old_val) & 0xffff) + bpf_ntohs(new_val); sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); *csum = bpf_htons(~sum); } SEC("xdp") int xdp_clamp_mss_good(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return XDP_PASS; if (eth->h_proto != bpf_htons(ETH_P_IP)) return XDP_PASS; struct iphdr *iph = (void *)(eth + 1); if ((void *)(iph + 1) > data_end || iph->protocol != IPPROTO_TCP) return XDP_PASS; __u32 ip_hdr_len = iph->ihl * 4; if (ip_hdr_len < sizeof(struct iphdr)) return XDP_PASS; struct tcphdr *tcph = (void *)iph + ip_hdr_len; if ((void *)(tcph + 1) > data_end) return XDP_PASS; if (!tcph->syn) return XDP_PASS; __u8 *opts = (__u8 *)(tcph + 1); __u8 *opts_end = (void *)tcph + (tcph->doff * 4); if ((void *)opts_end > data_end) return XDP_PASS; #pragma unroll for (int i = 0; i < 40; i++) { if (opts + 1 > opts_end || opts + 1 > data_end) break; __u8 opt_kind = *opts; if (opt_kind == 0) break; // EOL if (opt_kind == 1) { opts++; continue; } // NOP if (opts + 2 > opts_end || opts + 2 > data_end) break; __u8 opt_len = *(opts + 1); if (opt_len < 2 || opts + opt_len > opts_end || opts + opt_len > data_end) break; if (opt_kind == 2 && opt_len == 4) { __be16 *mss = (__be16 *)(opts + 2); __u16 current_mss = bpf_ntohs(*mss); if (current_mss > TARGET_MSS_IPV4) { __be16 new_mss = bpf_htons(TARGET_MSS_IPV4); update_csum_16(&tcph->check, *mss, new_mss); *mss = new_mss; } break; } opts += opt_len; } return XDP_PASS; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF XDP Dynamic TCP-MSS Clamping Invariant

eBPF XDP Dynamic TCP-MSS Clamping Invariant defines an industrial-grade behavioral standard for devops engineering. Enforces deterministic, in-kernel TCP Maximum Segment Size (MSS) clamping at the eBPF XDP layer across overlay and WireGuard network interfaces. Guarantees zero PMTU discovery black-holing and eliminates tunnel-induced packet fragmentation by rewriting SYN/SYN-ACK packet options and incrementally updating the TCP checksum before socket allocation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on ICMP Type 3 Code 4 PMTUD or iptables TCPMSS target across high-throughput overlay topologies Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on ICMP Type 3 Code 4 PMTUD or iptables TCPMSS target across high-throughput overlay topologies	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify packet bounds (`data + offset > data_end`) before dereferencing any byte in IP headers, TCP headers, or TCP options to satisfy the eBPF verifier.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.