7 ms·
by the time a user prompt is displayed, all metadata has been joined to the packet, and libnetfilterqueue is waiting for a decision. my understanding of what i
by nathants 4y ago
by the time a user prompt is displayed, all metadata has been joined to the packet, and libnetfilterqueue is waiting for a decision.
my understanding of what is happening is as follows:
- 1: libnetfilterqueue gets a packet.
- 2: lookup packet via ebpf to get pid and argv.
- 3: lookup rule, on miss prompt user to allow/deny.
- 4: libnetfilterqueue allows/denies the packet.
the tricky part is step 2. afaik there are 3 possibilities:
- ebpf already knows about about this packet, return pid and argv.
- ebpf will know about this packet shortly, wait, then return pid
and argv.
- ebpf dropped the data because of ringbuffer overflow, wait, then give up.
- yencabulator 4y agoMy understanding: ebpf runs at connect(2) time, stores metadata in a map; later, an NFQUEUE userspace helper fetches the metadata from the map.
- nathants 4y agothis is correct. it's the datarace between these components, and the possibility of ebpf dropping data because of a slow userspace callback, that makes this flaky.