Re: policy routing on locally generated packets

[Patrick Schaaf <bof@bof.de>]

Hi Charles,

> > What about mangle/PREROUTING? Doesn't it / shouldn't it sit before a
> > routing decision for locally generated packets?
> PREROUTING is "before" a routing decision. but only affects packets
> coming in over the wire, and not locally generated. 

To me, it could/would be the most logical extension to make PREROUTING
also see outbound locally generated packets, before the routing step.

What do others think?

[snip per-uid accounting requirement]

> So I am searching for a hopefully simple way to implement this without
> having to recompile a bunch of stuff.

Your application would be far better served, IMHO, by a suitable, small
piece of code that does exactly what you need, instead of invoking complex
configuration all over the place.

First, the kernel already has a nice per-uid data structure, the
'struct user_struct'. It is used today to count the number of
processes a uid posesses. It could certainly be easily extended
with some counters. Second, those counters would get incremented
whenever a socket-using user level process sends or receives something.
Third, add some /proc/ file to read out the current counters, and a way
to reset the counters to 0.

Anybody here who A) needs the feature and B) has the skill to write the code?
If I'm not mistaken, it's 1-2 days of work.

best regards
  Patrick