1bcaddce25
Chain two XDP programs via libxdp dispatcher on the same interface: xdp_blocker (priority 10) handles CIDR/country/whitelist blocking, xdp_ddos (priority 20) handles rate limiting, EWMA analysis, and AI anomaly detection. Whitelist maps are shared via BPF map pinning so whitelisted IPs bypass both blocklist checks and DDoS rate limiting. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
26 lines
739 B
Desktop File
26 lines
739 B
Desktop File
[Unit]
|
|
Description=XDP Defense - Unified CIDR Blocker + DDoS Defense
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
Documentation=man:xdp-defense(8)
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStartPre=/usr/local/bin/xdp-defense load
|
|
ExecStart=/usr/local/bin/xdp-defense daemon start-foreground
|
|
ExecStop=/usr/local/bin/xdp-defense stop-all
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# Security hardening
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/xdp-defense /etc/xdp-defense /etc/xdp-blocker /sys/fs/bpf
|
|
ProtectHome=true
|
|
NoNewPrivileges=false
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_BPF CAP_SYS_ADMIN CAP_PERFMON
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_BPF CAP_SYS_ADMIN CAP_PERFMON
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|