Owner on Input table

Owner on Input table

[Egon Phillips]

I read in the docs that the owner match as described below is not
available on the input chain.

    This module attempts to match various
    characteristics of the packet creator, 
    for locally-generated packets. It is 
    only valid in the OUTPUT chain, and even
    this some packets (such as ICMP ping responses)
    may have no owner, and hence never match. 

Are there any plans to change this policy?  If not, is this a limitation
of the software or of the OS?  Is it not possible to use the destination
ports process id to determine the owner?
____________________________________________________
The Brockton Initiative (http://brockton.dyndns.org)
Egon Phillips, Chair

Re: Owner on Input table

[Patrick Schaaf]

>     This module attempts to match various
>     characteristics of the packet creator, 
>     for locally-generated packets. It is 
>     only valid in the OUTPUT chain, and even
>     this some packets (such as ICMP ping responses)
>     may have no owner, and hence never match. 
> 
> Are there any plans to change this policy?  If not, is this a limitation
> of the software or of the OS?  Is it not possible to use the destination
> ports process id to determine the owner?

It may be possible - after all, the kernel will do it some milliseconds
later - but would you really want your packet processing halted until
it is decided WHICH userlevel apache process will finally accept()
this incoming SYN packet?

In other words: it is neither easy, nor the right place, nor a unique
decision. Thus the policy of "better don't even try".

best regards
  Patrick

Re: Owner on Input table

[Jonas Berlin]

Egon Phillips wrote:

>I read in the docs that the owner match as described below is not
>available on the input chain.
>
>    This module attempts to match various
>    characteristics of the packet creator, 
>    for locally-generated packets. It is 
>    only valid in the OUTPUT chain, and even
>    this some packets (such as ICMP ping responses)
>    may have no owner, and hence never match. 
>
>Are there any plans to change this policy?  If not, is this a limitation
>of the software or of the OS?  Is it not possible to use the destination
>ports process id to determine the owner?
>____________________________________________________
>The Brockton Initiative (http://brockton.dyndns.org)
>Egon Phillips, Chair
>  
>
Afaik the owner-socketlookup patch in patch-o-matic-ng does what you are 
asking for. It has been around for over a year now.

<snip>
The patch allows you to use the owner match in the INPUT chain to match
properties of the receiving socket. It is mainly intended to help filter 
weird
protocols like H.323 or IIOB without conntrack helpers, but could also come
handy for local user traffic accounting and similar stuff.
</snip>

-- 
- xkr47