Validasi BGP Route Origin dan Filtrasi Prefix Menggunakan eBPF XDP pada Gateway Hosting Multi-Tenant

struct bpf_lpm_trie_key {
    __u32 prefixlen;
    __u8  data[0];
};

struct route_key {
    __u32 prefixlen;
    __u32 ipv4_addr; // Network byte order
};

struct route_val {
    __u32 origin_asn;
    __u8  rpki_status; // 0 = Valid, 1 = Invalid, 2 = Unknown
    __u8  action;      // 0 = Pass, 1 = Drop, 2 = Trap to Control Plane
};

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/in.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>

#define RPKI_VALID       0
#define RPKI_INVALID     1
#define RPKI_NOT_FOUND   2

#define ACTION_PASS      0
#define ACTION_DROP      1

struct lpm_key_ipv4 {
    __u32 prefixlen;
    __u32 addr;
};

struct lpm_val {
    __u32 origin_asn;
    __u8  rpki_status;
    __u8  action;
};

struct {
    __uint(type, BPF_MAP_TYPE_LPM_TRIE);
    __type(key, struct lpm_key_ipv4);
    __type(value, struct lpm_val);
    __uint(map_flags, BPF_F_NO_PREALLOC);
    __uint(max_entries, 1000000);
} prefix_validation_map SEC(".maps");

struct {
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
    __type(key, __u32);
    __type(value, __u64);
    __uint(max_entries, 4);
} drop_stats_map SEC(".maps");

static __always_inline void increment_stat(__u32 reason) {
    __u64 *counter = bpf_map_lookup_elem(&drop_stats_map, &reason);
    if (counter) {
        (*counter)++;
    }
}

SEC("xdp_bgp_filter")
int filter_ingress(struct xdp_buff *ctx) {
    void *data_end = (void *)(long)ctx->data_end;
    void *data = (void *)(long)ctx->data;

    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end) {
        return XDP_PASS;
    }

    if (eth->h_proto != bpf_htons(ETH_P_IP)) {
        return XDP_PASS;
    }

    struct iphdr *iph = (void *)(eth + 1);
    if ((void *)(iph + 1) > data_end) {
        return XDP_PASS;
    }

    // Ekstrak destination address untuk verifikasi keabsahan prefix tenant hosting
    struct lpm_key_ipv4 search_key = {
        .prefixlen = 32,
        .addr = iph->daddr
    };

    struct lpm_val *match = bpf_map_lookup_elem(&prefix_validation_map, &search_key);
    if (!match) {
        // Default action: prefix tidak berada di alokasi lokal gateway edge
        increment_stat(RPKI_NOT_FOUND);
        return XDP_PASS;
    }

    if (match->rpki_status == RPKI_INVALID || match->action == ACTION_DROP) {
        increment_stat(RPKI_INVALID);
        return XDP_DROP;
    }

    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <arpa/inet.h>
#include <bpf/bpf.h>
#include <bpf/libbpf.h>

struct lpm_key_ipv4 {
    uint32_t prefixlen;
    uint32_t addr;
};

struct lpm_val {
    uint32_t origin_asn;
    uint8_t  rpki_status;
    uint8_t  action;
};

int update_prefix_validation(int map_fd, const char *ip_str, uint32_t cidr, uint32_t asn, uint8_t status, uint8_t action) {
    struct lpm_key_ipv4 key;
    struct lpm_val val;

    key.prefixlen = cidr;
    if (inet_pton(AF_INET, ip_str, &key.addr) != 1) {
        return -1;
    }

    val.origin_asn = asn;
    val.rpki_status = status;
    val.action = action;

    // BPF_ANY: Perbarui jika sudah ada, atau buat baru jika belum ada
    return bpf_map_update_elem(map_fd, &key, &val, BPF_ANY);
}

int main(int argc, char **argv) {
    int map_fd = bpf_obj_get("/sys/fs/bpf/xdp_prefix_validation_map");
    if (map_fd < 0) {
        perror("Gagal membuka pinned bpf map");
        return 1;
    }

    // Inisialisasi rute prefix tenant sah (misal 198.51.100.0/24, AS64496, VALID)
    if (update_prefix_validation(map_fd, "198.51.100.0", 24, 64496, 0, 0) == 0) {
        printf("Berhasil memuat rute valid 198.51.100.0/24
");
    }

    // Blokir rentang prefix yang terdeteksi leak/hijack (misal 203.0.113.0/24, INVALID, DROP)
    if (update_prefix_validation(map_fd, "203.0.113.0", 24, 64511, 1, 1) == 0) {
        printf("Berhasil menyuntikkan rule drop untuk prefix bocor 203.0.113.0/24
");
    }

    return 0;
}

# Kompilasi C source code menjadi target BPF ELF object
clang -O2 -g -Wall -target bpf -c xdp_bgp_filter.c -o xdp_bgp_filter.o

# Mount BPF Virtual Filesystem jika belum terpasang
mount -t bpf bpf /sys/fs/bpf

# Attach program XDP ke network interface fisik (misal: eth0) pada mode native driver
ip link set dev eth0 xdpgeneric off
ip link set dev eth0 xdpdrv object xdp_bgp_filter.o section xdp_bgp_filter

# Pinning map agar dapat dimanipulasi oleh userspace synchronization agent
bpftool prog show name filter_ingress
bpftool map pin name prefix_validation_map /sys/fs/bpf/xdp_prefix_validation_map

# Memeriksa isi LPM Trie Map yang terpasang di filesystem BPF
bpftool map dump pinned /sys/fs/bpf/xdp_prefix_validation_map

# Membaca per-CPU array statistik drop akibat RPKI invalid
bpftool map dump name drop_stats_map

[{   "key": 1,
    "values": [{
            "cpu": 0,
            "value": 14820921
        },{
            "cpu": 1,
            "value": 15201194
        },{
            "cpu": 2,
            "value": 14991203
        },{
            "cpu": 3,
            "value": 15110488
        }
    ]
}]

# Evaluasi alokasi waktu siklus CPU pada kernel
perf top --sort comm,dso,symbol

# Pantau konsumsi CPU softirq per core secara real-time
mpstat -P ALL 1 5

# Memeriksa RX drop pada level hardware ring buffer
ethtool -S eth0 | grep -E 'rx_dropped|rx_missed_errors|rx_discards'