eBPF & Kernel-Bypass Networking in Distributed Cloud Architectures

1// eBPF XDP Packet Inspection at the Network Driver Hook
2#include <linux/bpf.h>
3#include <linux/if_ether.h>
4#include <linux/ip.h>
5#include <linux/in.h>
6#include <bpf/bpf_helpers.h>
7
8struct {
9    __uint(type, BPF_MAP_TYPE_HASH);
10    __uint(max_entries, 65536);
11    __type(key, __u32);   // Source IP
12    __type(value, __u64); // Request Timestamp
13} rate_limit_map SEC(".maps");
14
15SEC("xdp")
16int fast_packet_filter(struct xdp_md *ctx) {
17    void *data_end = (void *)(long)ctx->data_end;
18    void *data = (void *)(long)ctx->data;
19
20    struct ethhdr *eth = data;
21    if ((void *)(eth + 1) > data_end)
22        return XDP_PASS;
23
24    if (eth->h_proto != __constant_htons(ETH_P_IP))
25        return XDP_PASS;
26
27    struct iphdr *ip = (void *)(eth + 1);
28    if ((void *)(ip + 1) > data_end)
29        return XDP_PASS;
30
31    __u32 src_ip = ip->saddr;
32    __u64 now = bpf_ktime_get_ns();
33
34    __u64 *last_seen = bpf_map_lookup_elem(&rate_limit_map, &src_ip);
35    if (last_seen && (now - *last_seen < 1000000)) {
36        // Rate limit exceeded (under 1ms burst) -> Drop immediately
37        return XDP_DROP;
38    }
39
40    bpf_map_update_elem(&rate_limit_map, &src_ip, &now, BPF_ANY);
41    return XDP_PASS;
42}
43
44char _license[] SEC("license") = "GPL";