microsoft / microsoft/ebpf-for-windows
netebpfext does not allow recv-accept filters to re-evaluate connections when WFP does a reauth
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
### Describe the bug
See code in net_ebpf_extension_sock_addr_authorize_recv_accept_classify:
// eBPF programs will not be invoked on connection re-authorization.
if (net_ebpf_sock_addr_ctx.flags & FWP_CONDITION_FLAG_IS_REAUTHORIZE) {
goto Exit;
}
Our eBPF program requires leveraging WFP reauth behavior to re-evaluate connections.
### OS information
_No response_
### Steps taken to reproduce bug
Trigger a re-auth - such as changing the Firewall Profile
### Expected behavior
Our bpf program is allowed to evaluate and consider blocking already-established inbound connections.
### Actual outcome
The bpf program does not see already-established inbound connections during a WFP reauthorization.
### Additional details
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.