XDP in Practice: DDoS Mitigation @Cloudflare

XDP is a Linux technology which brings fast networking to native Linux.

Historically Linux required specialized patches to reduce the overhead of network packet processing. XDP fixes that: it allows packet filtering, modification and retransmission with arbitrary user logic.

The logic for an XDP program is expressed using eBPF, a byte code format for programs that run in a new in-kernel virtual machine. It allows a user to run arbitrary code in kernel space, safely and with great performance. Safety is enforced by the magical eBPF bytecode runtime, which guarantees a cap on per-packet processing time. Speed is achieved by aggressively JIT-ting the eBPF program, even if it relies on data structures such as eBPF maps.

This talk will introduce the following topics:

• The architecture of Cloudflare’s automatic DDoS mitigation pipeline

• Our initial packet filtering solution based on Iptables, and why we had to introduce userspace offload

• An introduction to XDP and eBPF

• How we switched from a proprietary offload technology to XDP for network stack bypass

• Using XDP to load balance traffic