There is no way for a rule to match ALL the packets (except with meta.probability 100), so users can't apply an action to all the packets going through a hook (e.g. mark or log).
Currently, a rule without any matcher would be disallowed, as that would be considered the program's last instruction from the BPF verifier perspective, and would skip the chain's policy (hence creating dead code).
There are multiple ways to implement this feature:
- Empty rule -> match all traffic (preferred)
- Dedicated
meta.all matcher
In both cases, the chain's policy should be properly handled, as should subsequent rules (after the match-all rule):
- If the match-all rule has a terminal verdict, all the subsequent rules are void, and the chain's policy will never be processed
- If the match-all rule has a non-terminal verdict (e.g.
CONTINUE), the ruleset can continue as usual
There is no way for a rule to match ALL the packets (except with
meta.probability 100), so users can't apply an action to all the packets going through a hook (e.g. mark or log).Currently, a rule without any matcher would be disallowed, as that would be considered the program's last instruction from the BPF verifier perspective, and would skip the chain's policy (hence creating dead code).
There are multiple ways to implement this feature:
meta.allmatcherIn both cases, the chain's policy should be properly handled, as should subsequent rules (after the match-all rule):
CONTINUE), the ruleset can continue as usual