Jamil 5e0ca45c67 fix(relay): XDP_PASS non-STUN UDP traffic (#10292) ...

To prevent userspace relaying, all traffic that seemingly looked like
STUN/TURN but we couldn't handle via the eBPF codepath we would
`XDP_DROP`.

This turned out to be too heavy-handed of an approach since it end up
matching DNS query responses as well due to them arriving within the
TURN ephemeral port range.

To fix this, we `XDP_PASS` the traffic up the stack so that the kernel
is able to match it to existing conntrack entries.

We've identified a minor race condition where the first few channel data
packets might be dropped when a channel is first being bound, but fixing
this will be saved for a later PR.

Related: https://github.com/firezone/infra/pull/132

2025-09-05 13:24:02 -07:00

..

ebpf-shared

feat(ci): enable relay eBPF offloading (#10160)

2025-08-31 23:37:03 +00:00

ebpf-turn-router

fix(relay): XDP_PASS non-STUN UDP traffic (#10292)

2025-09-05 13:24:02 -07:00

server

fix(relay): re-add eBPF channel map entry on refresh (#10291)

2025-09-05 01:29:50 +00:00