How azrakrgll/xdp_internship works
This repository’s documented product is an XDP/eBPF Linux network firewall with a Python control and monitoring plane. Its main workflow is packet inspection and enforcement in the kernel, flow-stat collection by the userspace firewall process, then log processing and presentation through the web backend. Rule updates travel separately from the rules file through the Python rule engine into pinned kernel maps. The README also describes rate limiting, trusted-IP/port exceptions, MAC anti-spoofing, and SQLite-backed monitoring. Several other C/eBPF files appear to be standalone examples, so they are not included as firewall components; dashboard frontend files are not present in the supplied tree.
Main entry points: app.py Web backend · firewall.c Firewall runner · firewall.bpf.c XDP firewall · rule_engine.py Rule engine
Components 12
Packet enforcement
- XDP firewall
firewall.bpf.c - Firewall runner
firewall.c - Pinned BPF maps
firewall.bpf.c
Rule control
- Firewall rules
- Rule engine
rule_engine.py
Monitoring and UI
- Unix socket
app.py - Web backend
app.py - SQLite logs
db_manager.py - Web dashboard
Other components
- Network traffic
- Linux kernel
- Dashboard user
Connections 16
- Network traffic → Linux kernel: enters
- Linux kernel → XDP firewall: invokes XDP
- XDP firewall → Pinned BPF maps: updates rules and stats
- XDP firewall → Linux kernel: passes or drops
- Firewall runner → XDP firewall: loads and attaches
- Firewall runner → Pinned BPF maps: pins maps
- Firewall rules → Rule engine: provides rules
- Rule engine → Pinned BPF maps: updates pinned maps
- Firewall runner → Pinned BPF maps: reads flow stats
- Firewall runner → Unix socket: sends log batches
- Unix socket → Web backend: delivers batches
- Web backend → SQLite logs: writes logs
- Web backend → SQLite logs: queries history and stats
- Dashboard user → Web dashboard: views monitoring
- Web dashboard → Web backend: requests data
- Web backend → Web dashboard: serves live updates