search

gamemann / XDP-Firewall

A firewall that utilizes the Linux kernel's XDP hook. The XDP hook allows for very fast network processing on Linux systems. This is great for dropping malicious traffic from a (D)DoS attack. IPv6 is supported with this firewall! I hope this helps network engineers/programmers interested in utilizing XDP!
https://deaconn.net/
MIT License
492 stars 87 forks source link

Flags TCP ECE/CWR #18

Closed m0zZ3 closed 1 year ago

m0zZ3 commented 2 years ago

Hello, I would like to ask you a question. Why haven't you added the TCP ECE and CWR flags?

I've tried adding them manually and compiling it again, it seems to work, but I'm still not sure, I'm doing some tests.

gamemann commented 2 years ago

Hey!

I apologize for the delay, I've been dealing with personal issues and haven't had the time to work on open-source projects. I planned to add these a while ago, but haven't gotten around to it. I can add it quickly, but since you already have code, I was wondering if you wanted to make a PR request instead.

Thank you!

m0zZ3 commented 2 years ago

Hi, I'm not sure I did it right. I don't have as much experience as you in XDP.

The tests seem to work, but I'm not sure.

We are currently getting hit with +5 Gbps with TCP Flood and various flags active including: ECE, CWR, NS, URG, etc.

Can you add these flags when you have time? I understand what in the kernel they are already. It would be necessary to map them, I did that (but I'm not sure I did it right)

I also noticed that if I allow TCP_ENABLE = true and TCP_ACK = TRUE, it allows all the flags that are accompanied by the ACK, example: ACK/PSH, ACK/FIN, ACK/SYN, can this be improved? Or do you have an idea to allow flags according to "validation", i.e. useful flags?

Thank you very much for taking the time to respond, regards

gamemann commented 1 year ago

Hey! I'm sorry for the delayed response, I've been going through a lot the last few months and started working on a big exciting project!

I've implemented the TCP ECE and CWR flags.

https://github.com/gamemann/XDP-Firewall/commit/1c41ac296b91df2aefbad67c766364405c55a8df