2

I'm just learning about XDP. During my journey, I came across a case which I could not make any sense of. I was trying some fancy things on certain UDP packets when I noticed nothing was changing. So I tried to reproduce the problem with a minimal example. Here is the minimal example:

#include <linux/bpf.h>
#include <linux/in.h>                             
#include <linux/if_ether.h>                       
#include <linux/ip.h>
#include <linux/udp.h>
                                                         
#define SEC(NAME) __attribute__((section(NAME), used))
                                                                                                                      
SEC("obfuscator_main")
int dropper(struct xdp_md *ctx) {
    return XDP_DROP;        
}
char _license[] SEC("license") = "GPL";

(Don't mind the "obfuscator" name, it's a leftover from the rest of the code).

I compile and load this:

clang -Wall -O2 -target bpf -c obfuscate.c -o obfuscate.o
sudo ip link set dev enp3s0 xdp obj obfuscate.o sec obfuscator_main

I confirm that the incoming traffic to my computer is totally dropped. However, packets can still go out. I ping a remote server which I run tcpdump on, and it sees the ICMP requests. But I get no response on my local computer.

Why could it not be doing anything about outgoing packets?

1 Answer 1

6

While digging through Google searches, I came across this issue on GitHub: https://github.com/iptraf-ng/iptraf-ng/pull/33

... since XDP doesn't handle outgoing traffic.

As it turns out, XDP does not handle outgoing packets. I have no idea why it took me this long to come across this. Turns out I've been misunderstanding things.

1
  • 1
    Right, there has been some proposal for egress XDP some time ago but it was not merged, not sure if there is still work in progress on that. If you want to process packets with eBPF on egress, you can just use the TC hook for example.
    – Qeole
    Mar 28, 2021 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.