microsoft / microsoft/ebpf-for-windows

netebpfext does not allow recv-accept filters to re-evaluate connections when WFP does a reauth

Open
#5,215 0 comments 0 reactions 1 assignee Claimed by @shankarseal View on GitHub
enhancement P2 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the bug

See code in net_ebpf_extension_sock_addr_authorize_recv_accept_classify:

// eBPF programs will not be invoked on connection re-authorization.
if (net_ebpf_sock_addr_ctx.flags & FWP_CONDITION_FLAG_IS_REAUTHORIZE) {
goto Exit;
}

Our eBPF program requires leveraging WFP reauth behavior to re-evaluate connections.

### OS information

_No response_

### Steps taken to reproduce bug

Trigger a re-auth - such as changing the Firewall Profile

### Expected behavior

Our bpf program is allowed to evaluate and consider blocking already-established inbound connections.

### Actual outcome

The bpf program does not see already-established inbound connections during a WFP reauthorization.

### Additional details

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.