boba/guard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

v0.3: 6-layer architecture complete

Browse source 
Layers:
  Layer 1: XDP/eBPF — TCP state machine, SYN throttle, blacklist, ringbuf
  Layer 2: PoW Challenge — SHA-256 hashcash, dynamic difficulty, constant-time verify
  Layer 3: Rust Core — HMAC handshake, rate limit, death code (existing)
  Layer 4: Velocity — Physics check, CAPTCHA, protocol verification
  Layer 5: Paper — Heartbeat, auto-registration (existing)
  Layer 6: Traffic Intel — EWMA, 168h profiling, reputation, alerts

Infra: XDP→Prometheus metrics, ClickHouse + Grafana dashboard, Docker Compose
Testing: 100-IP DDoS simulation, MHDDoS ref analysis, load test report
Fixes: VarInt sign extension UB, pure ACK deadlock, RST/FIN cleanup
Ref: MHDDoS, Sonar, LimboFilter, AtomGuard, Infrarust, MC-XDP-eBPF, PowGo
This commit is contained in:
loki5512344 2026-07-21 15:47:36 +02:00
parent 78fc6e00c7
commit 269daa071f
Signed by: boba
GPG key ID: 253067914055423B
66 changed files with 4529 additions and 1003 deletions
Download patch file Download diff file Expand all files Collapse all files

63
xdp/varint.h Normal file
View file

@ -0,0 +1,63 @@
#ifndef RAMPART_VARINT_H
#define RAMPART_VARINT_H
#include "common.h"
// ── VarInt reader with dual-bounds check ──
// Returns {value, bytes_consumed} on success, goto error on failure
// Fixed: no sign extension UB (shift in u32, cast to s32)
// Fixed: max 5 bytes per Minecraft protocol spec
#define VARINT_BYTE(ptr, pend, dend, max, idx, shift, result) \
do { \
if ((max) < (idx)) \
goto error; \
if ((void *)(ptr) + 1 > (void *)(dend)) \
goto error; \
if ((void *)(ptr) + 1 > (void *)(pend)) \
goto error; \
__u8 _b = *(ptr)++; \
(result) |= ((__u32)(_b & 0x7F) << (shift)); \
if (!(_b & 0x80)) \
return varint((__s32)(result), (idx)); \
} while (0)
struct varint_value {
__s32 value;
__u8 bytes;
};
static __always_inline struct varint_value varint(__s32 value, __u8 bytes)
{
struct varint_value v = { .value = value, .bytes = bytes };
return v;
}
static __always_inline struct varint_value read_varint_sized(
__u8 *ptr, __u8 *pend, __u8 max, void *dend)
{
__u32 result = 0;
VARINT_BYTE(ptr, pend, dend, max, 1, 0, result);
VARINT_BYTE(ptr, pend, dend, max, 2, 7, result);
VARINT_BYTE(ptr, pend, dend, max, 3, 14, result);
VARINT_BYTE(ptr, pend, dend, max, 4, 21, result);
if (max < 5) goto error;
if ((void *)(ptr) + 1 > (void *)(dend)) goto error;
if ((void *)(ptr) + 1 > (void *)(pend)) goto error;
__u8 b5 = *(ptr)++;
result |= ((__u32)(b5 & 0x7F) << 28);
result &= 0x7FFFFFFF;
return varint((__s32)result, 5);
error:
return varint(0, 0);
}
// Convenience: read varint with max=5 (full Minecraft varint)
static __always_inline struct varint_value read_varint(__u8 *ptr, __u8 *pend, void *dend)
{
return read_varint_sized(ptr, pend, 5, dend);
}
#endif /* RAMPART_VARINT_H */