On 8/28/20 12:14 AM, Daniel Borkmann wrote:
> Hi Lukas,
>
> On 8/27/20 10:55 AM, Lukas Wunner wrote:
>> Introduce a netfilter egress hook to allow filtering outbound AF_PACKETs
>> such as DHCP and to prepare for in-kernel NAT64/NAT46.
>
> Thinking more about this, how will this allow to sufficiently filter
> AF_PACKET?
> It won't. Any AF_PACKET application can freely set PACKET_QDISC_BYPASS without
> additional privileges and then dev_queue_xmit() is being bypassed in the host
> ns.
> This is therefore ineffective and not sufficient. (From container side these
> can
> be caught w/ host veth on ingress, but not in host ns, of course, so hook
> won't
> be invoked.)
Presumably dev_direct_xmit() could be augmented to support the hook.
dev_direct_xmit() (packet_direct_xmit()) was introduced to bypass qdisc,
not to bypass everything.
