Skip to content

Commit d445099

Browse files
vincentmlivincentmli
committed
Add xdp-synproxy Dockerfile and Kubernetes DaemonSet manifest
User could build xdp-synproxy container and runs in kubernetes as daemonset to protect kubernetes node from SYN flood attack Signed-off-by: Vincent Li <[email protected]>
1 parent fed8da5 commit d445099

File tree

5 files changed

+199
-2
lines changed

5 files changed

+199
-2
lines changed

‎xdp-synproxy/Dockerfile‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#docker build . -t xdp-synproxy:0.1
2+
#docker run -it -h xdp-synproxy --network=host --privileged xdp-synproxy:0.1
3+
4+
FROM ubuntu:latest
5+
6+
RUN apt-get update && \
7+
apt-get install -y libelf1 \
8+
iptables \
9+
iproute2
10+
11+
COPY bpftool /usr/local/bin
12+
COPY install-rules.sh /
13+
COPY uninstall-rules.sh /
14+
COPY xdp_synproxy /usr/local/bin
15+
16+
#ENTRYPOINT ["/usr/local/bin/xdp_synproxy", "--iface", "ens192", "--file", "/usr/local/bin/xdp_synproxy_kern.o", "--mss4", "1460", "--mss6", "1440", "--wscale", "7", "--ttl", "254", "--ports", "80,8080"]
17+
18+

‎xdp-synproxy/README.org‎

Lines changed: 34 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ a real practical example for user to use. For an overview of accelerating
88
SYNPROXY WITH XDP, Please refer to this paper
99
(https://netdevconf.info/0x15/slides/30/Netdev%200x15%20Accelerating%20synproxy%20with%20XDP.pdf)
1010

11+
This sample application is tested with Ubuntu 22.04 with 6.2 kernel.
12+
1113
Note XDP SYNPROXY requires netfilter connection tracking and here are the
1214
sysctl knobs and iptables rules preparation for XDP SYNPROXY:
1315
#+BEGIN_SRC sh
@@ -21,9 +23,39 @@ sysctl knobs and iptables rules preparation for XDP SYNPROXY:
2123

2224
Here is how to start the XDP SYNPROXY application:
2325
#+BEGIN_SRC sh
24-
sudo xdp_synproxy --iface <interface> --file <path-to-xdp_synproxy_kern.o> --mss4 1460 --mss6 1440 --wscale 7 --ttl 254 --ports <port1>,<port2>
26+
sudo xdp_synproxy --iface <interface> --mss4 1460 --mss6 1440 --wscale 7 --ttl 64 --ports <port1>,<port2>
27+
#+END_SRC
28+
29+
XDP SYNPROXY could be built in in container and run by docker
30+
#+BEGIN_SRC sh
31+
sudo docker build . -t xdp-synproxy:0.1
32+
sudo docker run -it -h xdp-synproxy --network=host --privileged xdp-synproxy:0.1
33+
#+END_SRC
34+
35+
XDP SYNPROXY could be deployed in Kubernetes cluster as DaemonSet, Please see
36+
(https://youtu.be/nIrp0Lv-e0g?si=g-pXl4agVQM6_FYW)
37+
#+BEGIN_SRC sh
38+
sudo kubectl apply -f xdp-synproxy-daemonset.yaml
39+
sudo kubectl get po -o wide -l app=xdp-synproxy
40+
41+
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
42+
xdp-synproxy-6x29j 1/1 Running 0 5d2h 10.169.72.239 cilium-dev <none> <none>
43+
xdp-synproxy-xj98j 1/1 Running 0 5d2h 10.169.72.233 centos-dev.localdomain <none> <none>
2544
#+END_SRC
2645

2746
XDP SYNPROXY can coexist with other XDP programs since we use libxdp
2847
to attach the XDP SYNPROXY program, meaning you could build chain of
29-
XDP programs and attach them to same network interface.
48+
XDP programs and attach them to same network interface. Note xdp-loader
49+
could be built statically and shipped with xdp-synproxy container.
50+
51+
#+BEGIN_SRC sh
52+
sudo kubectl exec -it xdp-synproxy-6x29j -- xdp-loader status
53+
54+
CURRENT XDP PROGRAM STATUS:
55+
56+
Interface Prio Program name Mode ID Tag Chain actions
57+
--------------------------------------------------------------------------------------
58+
ens192 xdp_dispatcher native 899 90f686eb86991928
59+
=> 50 syncookie_xdp 908 6c6615566a2e0419 XDP_PASS
60+
#+END_SRC
61+

‎xdp-synproxy/install-rules.sh‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
sysctl -w net.ipv4.tcp_syncookies=2
6+
sysctl -w net.ipv4.tcp_timestamps=1
7+
sysctl -w net.netfilter.nf_conntrack_tcp_loose=0
8+
9+
SYNPROXY="-m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460"
10+
CT="-j CT --notrack"
11+
12+
while test $# -gt 0; do
13+
case "$1" in
14+
--interface*)
15+
# shellcheck disable=SC2001
16+
# the below sed is to support both formats "--flag value" and "--flag=value"
17+
INTERFACE=$(echo "$1" | sed -e 's/^[^=]*=//g')
18+
shift
19+
;;
20+
--ports*)
21+
# shellcheck disable=SC2001
22+
# the below sed is to support both formats "--flag value" and "--flag=value"
23+
PORTS=$(echo "$1" | sed -e 's/^[^=]*=//g')
24+
shift
25+
;;
26+
*)
27+
break
28+
;;
29+
esac
30+
done
31+
32+
33+
34+
COMMA=','
35+
if [[ "$PORTS" == *"$COMMA"* ]]; then
36+
37+
IFS=',' read -ra PORT <<< "$PORTS"
38+
for p in "${PORT[@]}"; do
39+
echo $p
40+
/usr/sbin/iptables -t raw -I PREROUTING -i $INTERFACE -p tcp -m tcp --syn --dport $p $CT
41+
/usr/sbin/iptables -t filter -A INPUT -i $INTERFACE -p tcp -m tcp --dport $p $SYNPROXY
42+
done
43+
else
44+
/usr/sbin/iptables -t raw -I PREROUTING -i $INTERFACE -p tcp -m tcp --syn --dport $PORTS $CT
45+
/usr/sbin/iptables -t filter -A INPUT -i $INTERFACE -p tcp -m tcp --dport $PORTS $SYNPROXY
46+
fi
47+
48+
/usr/sbin/iptables -t filter -A INPUT -i $INTERFACE -m state --state INVALID -j DROP

‎xdp-synproxy/uninstall-rules.sh‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
SYNPROXY="-m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460"
6+
CT="-j CT --notrack"
7+
8+
while test $# -gt 0; do
9+
case "$1" in
10+
--interface*)
11+
# shellcheck disable=SC2001
12+
# the below sed is to support both formats "--flag value" and "--flag=value"
13+
INTERFACE=$(echo "$1" | sed -e 's/^[^=]*=//g')
14+
shift
15+
;;
16+
--ports*)
17+
# shellcheck disable=SC2001
18+
# the below sed is to support both formats "--flag value" and "--flag=value"
19+
PORTS=$(echo "$1" | sed -e 's/^[^=]*=//g')
20+
shift
21+
;;
22+
*)
23+
break
24+
;;
25+
esac
26+
done
27+
28+
29+
30+
COMMA=','
31+
if [[ "$PORTS" == *"$COMMA"* ]]; then
32+
33+
IFS=',' read -ra PORT <<< "$PORTS"
34+
for p in "${PORT[@]}"; do
35+
echo $p
36+
/usr/sbin/iptables -t raw -D PREROUTING -i $INTERFACE -p tcp -m tcp --syn --dport $p $CT
37+
/usr/sbin/iptables -t filter -D INPUT -i $INTERFACE -p tcp -m tcp --dport $p $SYNPROXY
38+
done
39+
else
40+
/usr/sbin/iptables -t raw -D PREROUTING -i $INTERFACE -p tcp -m tcp --syn --dport $PORTS $CT
41+
/usr/sbin/iptables -t filter -D INPUT -i $INTERFACE -p tcp -m tcp --dport $PORTS $SYNPROXY
42+
fi
43+
44+
/usr/sbin/iptables -t filter -D INPUT -i $INTERFACE -m state --state INVALID -j DROP

‎xdp-synproxy/xdp-synproxy-daemonset.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
apiVersion: apps/v1
2+
kind: DaemonSet
3+
metadata:
4+
name: xdp-synproxy
5+
labels:
6+
app: xdp-synproxy
7+
spec:
8+
selector:
9+
matchLabels:
10+
app: xdp-synproxy
11+
template:
12+
metadata:
13+
labels:
14+
app: xdp-synproxy
15+
spec:
16+
hostNetwork: true
17+
containers:
18+
- args:
19+
- "--iface=ens192"
20+
- "--mss4=1460"
21+
- "--mss6=1440"
22+
- "--wscale=7"
23+
- "--ttl=254"
24+
- "--ports=80,8080"
25+
command:
26+
- /usr/local/bin/xdp_synproxy
27+
image: vli39/xdp-synproxy:0.1
28+
imagePullPolicy: Always
29+
lifecycle:
30+
postStart:
31+
exec:
32+
command:
33+
- "/install-rules.sh"
34+
- "--interface=ens192"
35+
- "--ports=80,8080"
36+
preStop:
37+
exec:
38+
command:
39+
- "/uninstall-rules.sh"
40+
- "--interface=ens192"
41+
- "--ports=80,8080"
42+
name: xdp-synproxy
43+
securityContext:
44+
capabilities:
45+
add:
46+
- NET_ADMIN
47+
privileged: true
48+
volumeMounts:
49+
- mountPath: /sys/fs/bpf
50+
name: xdp-synproxy
51+
volumes:
52+
- hostPath:
53+
path: /sys/fs/bpf
54+
type: DirectoryOrCreate
55+
name: xdp-synproxy

0 commit comments

Comments
 (0)