microsoft / microsoft/ebpf-for-windows
net-ebpf-ext is indicating BLOCK at sockops, but WFP does not support it there
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
### Describe the bug
We can see net-ebpf-ext returning BLOCK back to WFP where it implemented a callout at WFP Flow Established layer to implement the bpf sockops. But WFP documents not to return ALLOW or BLOCK from this layer (https://learn.microsoft.com/en-us/windows/win32/fwp/ale-layers):
Under "FLOW_ESTABLISHED"
"A filter at this layer should not return Block or Permit."
https://github.com/microsoft/ebpf-for-windows/blob/7b279e966d0b74a6d2cec621dc48aa8658519200/netebpfext/net_ebpf_ext_sock_ops.c#L558
### OS information
_No response_
### Steps taken to reproduce bug
Reviewed the code
### Expected behavior
the callout driver should not return ALLOW or BLOCK back to WFP
### Actual outcome
Unknown - we're breaking the documented contract at this WFP layer
### Additional details
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.