News for hackers. Stuff that matters.

A comment on EBPFSnitch: An eBPF based Linux Application Firewall.

Re:EBPFSnitch: An eBPF based Linux Application Firewall by Tcc1 on Sunday March 14, 2021 @11:45AM (#26456292)
Why does this need nf_queue? Wouldn't it be sufficient to directly filter the connect syscalls using eBPF?

Dropping packets using netfilter makes many applications wait for a timeout. I prefer reject to filter unwanted outbound connections so that applications don't wait.

[ Parent | on HN ]
Re:EBPFSnitch: An eBPF based Linux Application Firewall by rkeene2 on Sunday March 14, 2021 @03:19PM (#26458012)
This uses NFQUEUE to get real-time userspace access to the ability to decide which connections to allow. NFQUEUE users must return a verdict on the packet (skb? I don't recall) before the packet continues to flow through the system. Using seccomp you don't get the opportunity to pass that up to a user to decide which action to take. Using other eBPF consumers are similar (since it represents a risk).
[ Parent | on HN ]