Improved IP Handling, Error Management, and GitHub Actions Integration

.github/workflows/test.yml

@@ -0,0 +1,36 @@
+name: Test XDP program compile/load/attach on Ubuntu
+
+on: [push, pull_request]
+
+jobs:
+  xdp_test:
+    runs-on: ubuntu-latest
+
+    env:
+      C_INCLUDE_PATH: /usr/include/x86_64-linux-gnu
+      IFACE: lo
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+
+    - name: Set up BPF toolchain
+      run: |
+        sudo apt-get update
+        sudo apt-get install clang llvm libbpf-dev make linux-headers-$(uname -r) -y
+        find /usr/include -name 'types.h'
+
+    - name: Test compile XDP program
+      run: make compile
+
+    - name: Test attach XDP program
+      run: make attach
+
+    - name: Check if XDP program is attached
+      run: make iface-inspect
+
+    - name: Dump BPF map
+      run: make dump
+
+    - name: Test detach XDP program
+      run: make detach

Makefile

@@ -18,5 +18,8 @@ attach:
 detach:
 	sudo ip link set dev $(IFACE) xdp off
 
+iface-inspect:
+	sudo ip link show $(IFACE)
+
 dump:
 	sudo bpftool map dump name $(MAP) &> /dev/null

README.md

@@ -1,3 +1,5 @@
+[![Test XDP program compile/load/attach on Ubuntu](https://github.com/SRodi/xdp-ddos-protect/actions/workflows/test.yml/badge.svg)](https://github.com/SRodi/xdp-ddos-protect/actions/workflows/test.yml)
+
 # Protect from DDoS attacks with XDP 
 
 The [xdp_ddos_protection.c](./xdp_ddos_protection.c) file contains an eBPF program designed for DDoS protection using XDP (eXpress Data Path).

xdp_ddos_protection.c

@@ -21,9 +21,11 @@ struct {
 
 SEC("xdp") int ddos_protection(struct xdp_md *ctx) {
     void *data_end = (void *)(long)ctx->data_end;
-    void *data = (void *)(long)ctx->data; // Parse Ethernet header
+    void *data = (void *)(long)ctx->data;
+
+    // Parse Ethernet header
     struct ethhdr *eth = data;
-
+    // Check if packet is large enough to contain Ethernet header
     if ((void *)(eth + 1) > data_end)
         return XDP_PASS;
 
@@ -33,10 +35,12 @@ SEC("xdp") int ddos_protection(struct xdp_md *ctx) {
 
     // Parse IP header
     struct iphdr *iph = (void *)(eth + 1);
+    // Check if ethernet frame is large enough to contain IP header
     if ((void *)(iph + 1) > data_end)
         return XDP_PASS;
 
-    __u32 src_ip = iph->saddr; // Source IP address
+    // Convert source IP from network to host byte order
+    __u32 src_ip = __builtin_bswap32(iph->saddr);
 
     // Lookup rate limit entry for this IP
     struct rate_limit_entry *entry = bpf_map_lookup_elem(&rate_limit_map, &src_ip);
@@ -63,7 +67,9 @@ SEC("xdp") int ddos_protection(struct xdp_md *ctx) {
         __builtin_memset(&new_entry, 0, sizeof(new_entry));
         new_entry.last_update = current_time;
         new_entry.packet_count = 1;
-        bpf_map_update_elem(&rate_limit_map, &src_ip, &new_entry, BPF_ANY);
+        if (bpf_map_update_elem(&rate_limit_map, &src_ip, &new_entry, BPF_ANY) != 0) {
+            return XDP_ABORTED; // Handle error if update fails
+        }
     }
     return XDP_PASS; // Allow packet if under threshold   
 }