boba/guard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix: universal default protected port range (was Minecraft 25565-25570)

Browse source 
Verified on real kernel 5.15.0-186 (VDS, netns+veth, generic XDP):
- verifier accepts program, all maps created (BTF ok)
- legit TCP passes end-to-end; conntrack entry cleaned on close
- stats counters increment correctly; prefix_stats /24 key populated
- LPM blacklist ban blocks traffic with retransmit drops
This commit is contained in:
loki5512344 2026-08-24 11:18:57 +02:00
parent aa787a558c
commit 8b35ac693c
Signed by: boba
GPG key ID: 253067914055423B
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
xdp/core/config.h
View file

@ -6,8 +6,11 @@
// after loader writes to .rodata section
// ── Port range ──
static volatile const __u16 G_START_PORT = 25565;
static volatile const __u16 G_END_PORT = 25570;
// Protected port range: packets to ports OUTSIDE this range bypass the
// filter (XDP_PASS before any counting/filtering). Default protects all
// TCP/UDP ports; narrow it via loader patching for dedicated-edge setups.
static volatile const __u16 G_START_PORT = 1;
static volatile const __u16 G_END_PORT = 65535;
// ── SYN throttle ──
static volatile const __u32 G_SYN_HIT_COUNT = 10; // max SYNs / window