On 8/28/20 12:14 AM, Daniel Borkmann wrote: > Hi Lukas, > > On 8/27/20 10:55 AM, Lukas Wunner wrote: >> Introduce a netfilter egress hook to allow filtering outbound AF_PACKETs >> such as DHCP and to prepare for in-kernel NAT64/NAT46. > > Thinking more about this, how will this allow to sufficiently filter AF_PACKET? > It won't. Any AF_PACKET application can freely set PACKET_QDISC_BYPASS without > additional privileges and then dev_queue_xmit() is being bypassed in the host ns. > This is therefore ineffective and not sufficient. (From container side these can > be caught w/ host veth on ingress, but not in host ns, of course, so hook won't > be invoked.) Presumably dev_direct_xmit() could be augmented to support the hook. dev_direct_xmit() (packet_direct_xmit()) was introduced to bypass qdisc, not to bypass everything.
