Message ID | cover.1598517739.git.lukas@wunner.de |
---|---|
Headers | show |
Series | Netfilter egress hook | expand |
Hi Lukas, thank you for your patches. On Thu, Aug 27, 2020 at 10:55 AM Lukas Wunner <lukas@wunner.de> wrote: > > Introduce a netfilter egress hook to allow filtering outbound AF_PACKETs > such as DHCP and to prepare for in-kernel NAT64/NAT46. > Actually, we've found 2 additional use cases in container-based nodes that use the egress hook: 1. intra-node DSR load balancing connectivity 2. container-based outbound security policies We've been using your previous patch in an experimental project and it's working fine. Great job!
Hi Lukas, On 8/27/20 10:55 AM, Lukas Wunner wrote: > Introduce a netfilter egress hook to allow filtering outbound AF_PACKETs > such as DHCP and to prepare for in-kernel NAT64/NAT46. Thinking more about this, how will this allow to sufficiently filter AF_PACKET? It won't. Any AF_PACKET application can freely set PACKET_QDISC_BYPASS without additional privileges and then dev_queue_xmit() is being bypassed in the host ns. This is therefore ineffective and not sufficient. (From container side these can be caught w/ host veth on ingress, but not in host ns, of course, so hook won't be invoked.) Thanks, Daniel
On 8/28/20 12:14 AM, Daniel Borkmann wrote: > Hi Lukas, > > On 8/27/20 10:55 AM, Lukas Wunner wrote: >> Introduce a netfilter egress hook to allow filtering outbound AF_PACKETs >> such as DHCP and to prepare for in-kernel NAT64/NAT46. > > Thinking more about this, how will this allow to sufficiently filter AF_PACKET? > It won't. Any AF_PACKET application can freely set PACKET_QDISC_BYPASS without > additional privileges and then dev_queue_xmit() is being bypassed in the host ns. > This is therefore ineffective and not sufficient. (From container side these can > be caught w/ host veth on ingress, but not in host ns, of course, so hook won't > be invoked.) Presumably dev_direct_xmit() could be augmented to support the hook. dev_direct_xmit() (packet_direct_xmit()) was introduced to bypass qdisc, not to bypass everything.