On Sun, Jan 24, 2021 at 11:18:00AM -0500, Willem de Bruijn wrote: > On Sun, Jan 24, 2021 at 6:14 AM Lukas Wunner <lukas@xxxxxxxxx> wrote: > > On Fri, Jan 22, 2021 at 11:13:19AM -0500, Willem de Bruijn wrote: > > > On Fri, Jan 22, 2021 at 4:44 AM Lukas Wunner <lukas@xxxxxxxxx> wrote: > > > > Add egress hook for AF_PACKET sockets that have the PACKET_QDISC_BYPASS > > > > socket option set to on, which allows packets to escape without being > > > > filtered in the egress path. > > > > > > > > This patch only updates the AF_PACKET path, it does not update > > > > dev_direct_xmit() so the XDP infrastructure has a chance to bypass > > > > Netfilter. > > > > > > Isn't the point of PACKET_QDISC_BYPASS to skip steps like this? > > > > I suppose PACKET_QDISC_BYPASS "was introduced to bypass qdisc, > > not to bypass everything." > > > > (The quote is taken from this message by Eric Dumazet: > > https://lore.kernel.org/netfilter-devel/a9006cf7-f4ba-81b1-fca1-fd2e97939fdc@xxxxxxxxx/ > > ) > > I see. I don't understand the value of a short-cut fast path if we > start chipping away at its characteristic feature. The point is to filter traffic coming in through af_packet. Exempting PACKET_QDISC_BYPASS from filtering would open up a trivial security hole. Thanks, Lukas
