Amir Keshavarz satrobit

Introduction

If you're reading this, chances are you have some idea of eBPF and XDP. In this article, we'll write an eBPF program that will count and categorize packets based on the destination port.

eBPF

Writing low-level tracing, monitoring, or network programs in Linux is not easy. Through all the layers of the kernel, people have been squeezing every bit of performance they could get.

And that's where eBPF comes in. eBPF is basically an extended and modern variation of BPF which is like a virtual machine inside the Linux kernel. It can execute user-defined programs inside a sandbox in the kernel.

These programs can be executed in various hook points but we will focus on XDP for now.

	package main

	import (
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"flag"
	"fmt"
	"github.com/hashicorp/memberlist"
	"log"

	/*!
	* The Final Countdown for jQuery v2.2.0 (http://hilios.github.io/jQuery.countdown/)
	* Copyright (c) 2016 Edson Hilios
	*
	* Permission is hereby granted, free of charge, to any person obtaining a copy of
	* this software and associated documentation files (the "Software"), to deal in
	* the Software without restriction, including without limitation the rights to
	* use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
	* the Software, and to permit persons to whom the Software is furnished to do so,
	* subject to the following conditions:

	package main

	import (
	"crypto/tls"
	"fmt"
	"log"
	"net/http"
	)

	func main() {

	package = "lua-resty-ddos"
	version = "v0.1.0-1"

	source = {
	url = "git://github.com/satrobit/lua-resty-ddos.git"
	}

	description = {
	summary = "A sample module to ddos mitigation in OpenResty",
	homepage = "https://github.com/satrobit/lua-resty-ddos",

	local cjson = require "cjson"
	local jwt = require "resty.jwt"
	local ck = require "resty.cookie"

	local function return_rf_cookie(cookie, key)

	-- Make JWT
	local jwt_token = jwt:sign(key,
	{
	header={typ="JWT", alg="HS256"},

	error_log logs/error.log;

	events {
	worker_connections 512;
	}

	worker_processes 4;

	http {