microsoft / microsoft/ebpf-for-windows

net-ebpf-ext is indicating BLOCK at sockops, but WFP does not support it there

Open
#4,738 0 comments 0 reactions 1 assignee Claimed by @nmlud21 View on GitHub
bug P3 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the bug

We can see net-ebpf-ext returning BLOCK back to WFP where it implemented a callout at WFP Flow Established layer to implement the bpf sockops. But WFP documents not to return ALLOW or BLOCK from this layer (https://learn.microsoft.com/en-us/windows/win32/fwp/ale-layers):

Under "FLOW_ESTABLISHED"
"A filter at this layer should not return Block or Permit."

https://github.com/microsoft/ebpf-for-windows/blob/7b279e966d0b74a6d2cec621dc48aa8658519200/netebpfext/net_ebpf_ext_sock_ops.c#L558

### OS information

_No response_

### Steps taken to reproduce bug

Reviewed the code

### Expected behavior

the callout driver should not return ALLOW or BLOCK back to WFP

### Actual outcome

Unknown - we're breaking the documented contract at this WFP layer

### Additional details

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.